Practical guide · Procurement, security, and AI governance teams
AI vendor due diligence checklist
Ask for answers about the product and use you are actually buying. A generic AI policy or model card may be useful context, but it cannot replace evidence about the service, contract, data flow, and controls you will rely on.
1. Define the intended use
What decisions will the system support? Who can act on its output? Which groups could be affected? Request the supported use cases and explicit exclusions. Document your own deployment context as well as the vendor’s product description.
Working record: An agreed use-case statement and prohibited-use list.
2. Trace data and suppliers
Ask what customer inputs, outputs, and logs are stored; retention and deletion settings; regions; sub-processors; and whether data can be used to train models. Request a current data-flow diagram and contractual evidence for material claims.
Working record: A data map and supplier list tied to the offered product version.
3. Review performance and human control
Ask what was tested, on which populations and conditions, what failure modes were found, and how users are warned or can override output. Obtain instructions for use, monitoring controls, and an escalation path for harmful or unreliable results.
Working record: A test summary, known limitations, and operational oversight plan.
4. Check security and change handling
Request access controls, incident notification process, model or supplier change notice, rollback options, and evidence of relevant security reviews. Decide which changes require a fresh approval before production use.
Working record: A contract and operations checklist with named vendor and buyer owners.
5. Close or accept each gap explicitly
Mark each response supported, pending, or unsupported. Record who accepts a residual risk and when to revisit it. Keep the exact vendor answer and supporting version instead of copying an unqualified yes into a master questionnaire.
Working record: A decision log with evidence links, exceptions, owners, and review dates.