AI Makes ITAD Accountability Unavoidable
When verification becomes practical, not verifying becomes difficult to defend.
For decades, organizations have handed retired computers, servers, laptops, and storage devices to IT asset disposition (ITAD) providers. In return, they receive certificates of destruction, recycling reports, and assurances that the equipment was handled properly.
Those documents answer an important question: was the equipment the provider received processed correctly?
They don’t answer a more basic one: did every asset the organization expected to retire actually reach the provider?
Answering that meant comparing inventories from different systems, reconciling inconsistent serial numbers, and investigating every gap. The work was tedious, so most organizations accepted the provider’s report as the record.
AI is changing that. Today, an organization can give an AI system two files, its expected inventory and its provider’s receiving report, and ask one question: what did we expect that was never reported received?
AI doesn’t make ITAD verification mandatory. It makes the decision not to verify increasingly difficult to defend.
The problem was documented years ago
In 2013, I published “The Most Overlooked Part of Your Data Security” in Harvard Business Review. It drew on 2,921 ITAD projects for 633 clients.
On average, 97.2% of assets were tracked. That sounds reassuring until you look at individual projects. Four out of five had at least one untracked asset, and 15% of untracked assets were potentially data-bearing equipment such as computers, laptops, and servers.
In 2017, Compliance Standards LLC used Retire-IT data to examine 402,363 assets across 4,812 projects for 732 companies. Manufacturer serial numbers matched about 78.4% of expected assets. Barcoded disposal tags matched 98.4%.
An unmatched asset is not necessarily a lost asset. It may reflect an inaccurate record, an inconsistent identifier, or a reporting error. That’s exactly why reconciliation matters. A discrepancy is a question that needs an answer.
The data documented a long-standing problem. AI now makes it easy to check whether that problem still exists in your organization.
Reconciliation is not verification
AI can reveal a discrepancy. Without reliable evidence, it cannot prove what physically happened to an asset.
Suppose an organization expects to retire 1,000 computers and its provider reports receiving 970. AI can find the 30 unmatched assets almost instantly. From two spreadsheets alone, though, it can’t tell whether each one:
- Was never picked up
- Was lost or stolen in transit
- Was received and left off the report
- Was never really part of the project
- Was recorded with a mistyped serial number
Answering that requires evidence that exists outside the files. It also requires reliable identification. Serial numbers are often missing, unreadable, or recorded inconsistently, which is why the 2017 study found such a large gap between serial-number and tag-based matching.
Under two-key tracking, a unique barcoded tag is applied to each asset before pickup. The receiving party records what arrives on its own, and the two inventories are reconciled without relying only on serial numbers.
The AI’s output is also a claim. Models can skip rows or mismatch similar serial numbers, so their results need checking too.
AI makes reconciliation faster. It cannot manufacture evidence that was never collected.
When ignorance becomes a decision
Consider a company that retires 10,000 computers a year. Its provider sends certificates for every device it received. The company never compares those records to its own expected inventory.
An internal auditor learns that an AI-assisted comparison could surface unresolved discrepancies in minutes, and asks why it was never done. Was it too difficult? Too expensive? Not something the provider required?
The more practical verification becomes, the weaker those answers sound. Choosing not to verify becomes a conscious risk decision, and that decision raises its own questions:
- Who made it?
- Was it documented?
- What was the justification?
- Would that justification hold up in front of an auditor, regulator, customer, or court?
Not reconciling isn’t automatically negligent. Legal duties depend on the circumstances, the applicable requirements, contracts, and how reasonable the organization’s controls are. But once a control becomes practical and affordable, the choice to skip it deserves closer scrutiny.
“We had no practical way to check” was once a reasonable answer. “We could have checked and chose not to” is a different one.
Discovery changes the responsibility
Before a comparison, a missing asset is an unknown. After one, it’s a documented exception with a date on it.
Suppose a reconciliation shows 47 servers the organization expected to retire that its provider never reported receiving. Someone now has to find out whether the servers are actually missing, whether the records are wrong, and whether the equipment held sensitive data.
Depending on the circumstances, that may require investigation, escalation, documentation, or notification. The finding doesn’t automatically establish a breach or a duty to report one. But it is information that responsible management can’t simply set aside, and it may later matter to auditors, regulators, insurers, or litigants.
An exception that was found and investigated shows a working control. An exception that was found and left unresolved looks worse than one that was never found.
The person who runs the comparison may not be the IT asset manager. It could be an internal auditor, someone in security, or an employee uneasy about what they found. AI lowers the barrier for all of them.
The risk is no longer limited to what an organization failed to know. It also covers what the organization discovered and failed to investigate.
You cannot sanitize what you cannot account for
Auditors routinely evaluate information security and asset management controls. An organization can show that its ITAD provider uses certified data destruction and still be unable to show that every data-bearing asset scheduled for retirement was accounted for.
These are two different controls:
- Effectiveness: were the devices that reached the provider sanitized or destroyed properly?
- Completeness: did every device that needed sanitizing actually get there?
An organization can have excellent erasure software and still suffer a serious failure if a device never shows up for erasure.
SOC 2 and ISO 27001 engagements have defined scopes, and neither guarantees that every retired asset has been independently verified. But where disposition controls are in scope, practical reconciliation may change what auditors consider reasonable evidence. The question could shift from “Do you use an approved ITAD provider?” to “Can you show that every expected data-bearing asset was accounted for?”
Who owns the gap?
A certificate of destruction can show that certain assets were processed. It can’t show that every asset the customer meant to retire was received.
The customer may assume the processor reconciles. The processor may assume its responsibility begins at its receiving dock. Neither assumption makes anyone accountable for comparing the two inventories. That is the ITAD accountability gap, and AI will make it increasingly visible.
The fix isn’t to make processors answerable for equipment they never received. It’s to assign clear roles: the customer establishes what is expected, the processor documents what is received, and an independent party reconciles the two and reports exceptions. That arrangement protects both sides, as I described in AI Makes ITAD Verification Inevitable.
The next standard of care
Technology often changes expectations before regulations and standards catch up.
Practices that once seemed exceptional become routine when they’re effective, affordable, and hard to justify skipping.
AI-assisted reconciliation may follow that path. Today, many organizations rely on certificates, vendor reports, and assumptions about chain of custody. Tomorrow, auditors and security teams may expect a documented reconciliation of expected and actual inventories, backed by reliable identification and explanations for every unresolved exception.
Standards bodies have a chance to get ahead of this. They can distinguish between assets processed, assets reported received, and assets expected but never accounted for. They can require that verification limits be disclosed. And they can encourage independent verification without making processors responsible for equipment outside their custody.
The goal isn’t zero discrepancies. That’s unrealistic. The goal is that every discrepancy is identified, investigated, explained, and communicated.
A defensible disposition program isn’t one that never has exceptions. It’s one that can account for them.
The question has changed
For more than 20 years, I’ve argued that organizations should independently verify what happened to their retired IT assets. The evidence of inadequate tracking has existed for years. What has changed is the technology.
AI won’t eliminate discrepancies. It won’t replace chain-of-custody evidence, and it can’t establish what happened to equipment that was never properly tracked. But it makes discrepancies easy to find. That changes what organizations can reasonably be expected to know, and in time, what they can reasonably be expected to do.
For decades, organizations could say they had no practical way to know whether every retired asset was accounted for. AI is eliminating that excuse.
The question is no longer whether organizations can verify what happened to their retired assets.
It’s why they don’t.
References
- Kyle Marks, “The Most Overlooked Part of Your Data Security,” Harvard Business Review, June 14, 2013.
- Compliance Standards LLC, Enterprise ITAD | Data Security, October 10, 2017.
- Veridy, “AI Makes ITAD Verification Inevitable“.
- Veridy, “What Is Two-Key Tracking in ITAD?“
