AI vendor due diligence file

Before you approve the AI vendor

An AI product awaits your approval. Your team wants it, or a client asks if you use it. Or a vendor you already pay switched on a feature.

You own the decision, and perhaps the client questionnaire, patient data or confidentiality question behind it. The product page will not say what data reaches the model or who can train on it. Nor will it say what changes without notice or how deletion works.

Ask the same 38 questions before purchase, at contract review and at each renewal. Keep one file across all three. It is a spreadsheet and the vendor’s written answers, so buy nothing to build it.

Three rules

1. Every AI vendor gets the same questions. Small or large, startup or trusted platform, the questions do not change. How long they take to answer is itself information.
2. An answer without evidence stays open. A sales engineer’s verbal assurance is a lead, not a fact. Keep the row open until you have a document, clause, screenshot or binding written statement. Open rows are fine, but open rows marked closed cause surprises.
3. There is no score. A weighted score lets a vendor win on twenty easy questions and lose on the three that mattered. It also invites argument about weights instead of facts, so read the answers and decide.

This file names no preferred platform and recommends nothing. Any vendor could do well on it.

Nine fields per question

These turn a questionnaire into a record you can act on.

Field	What goes in it
Answer	The vendor’s words, with the date and who said it
Evidence link	The document, clause, screenshot or written statement behind it. Blank means open
Answer owner	The named person at the vendor accountable for the answer, with title
Reviewer	Who on your side read it and judged it enough
Open question	What is missing, written so you could email it
Contract term	The agreement section holding the commitment, or a note that none does
Risk owner	Who inside owns the risk if the answer proves wrong
Decision	Accept, accept with a contract change, accept with a restriction, reject or pending
Review date	When the row is asked again, since AI terms change often

Contract term does the heaviest lifting. An answer in a sales email describes current practice, which can change on a Tuesday without notice.

An answer in the agreement is a commitment. Sorting answers into those two piles is often the most useful hour of the review.

Risk owner comes next, and it is the most uncomfortable. Every unresolved answer leaves a risk that belongs to a named person. If nobody will take it, that is the finding.

1. Who signs and stands behind the answers

#	Question	A real answer contains
1	Which legal entity would we contract with, where is it incorporated and based, and who is its parent?	The entity that actually signs, which may differ from the brand. Watch for an unmentioned foreign parent
2	Who holds control, and is a change of control under way or done within 24 months?	Named owners or investors, and a direct answer on pending deals. An acquisition changes data practices after you sign
3	How many staff work in engineering and security, and which jobs are outsourced, to whom and where?	Headcount with a breakdown. Offshore engineering or support is common and acceptable, but know it before a client asks

2. Where your data goes

#	Question	A real answer contains
4	What data does the product receive, by category, including prompts, files, telemetry, usage data and account details?	A list by category. If it covers only what users type, ask again about files, metadata and telemetry
5	Where is our data processed and stored, by region and infrastructure provider, including at inference?	Named regions and providers. Inference often runs somewhere other than storage, and vendors often answer only about storage
6	Does our data reach a model or service run by a third party? If so, which, under what agreement and where?	A named model provider and agreement. This surprises buyers most, since many AI products sit on someone else’s model
7	Who at your company can view our content, when, and is that logged and reported to us?	Named cases, such as support, abuse review, flagged content and debugging, and whether we can see the log
8	Is our content ever used in outputs for another customer, through caches, shared indexes or shared embeddings?	A direct no explaining tenant isolation, or a direct yes with the mechanism. Push again on vague answers

3. Whether the vendor trains on your data

#	Question	A real answer contains
9	Do you train or improve models on our inputs or outputs by default?	Yes or no about the default, which is what happens when nobody configures anything
10	Can training be switched off, where is the setting, and does it cover features released later?	The setting’s location and a statement on new features, which arrive with fresh defaults
11	If our content was used for training before we switched it off, what happens to it?	Usually that it cannot be extracted from a trained model. What matters is saying so plainly, and the commitment from now on
12	Do your subprocessors or model providers train on our data, and which contract term prevents it?	A clause in their upstream agreement. “Our provider says it does not” without a term is a hope, not a control

4. How long the vendor keeps your data

#	Question	A real answer contains
13	How long are inputs, outputs and logs kept by default, by category?	Numbers with units, by category. “As long as necessary” is not a retention period
14	Can retention be set, what is the shortest setting, and does it cover backups, embeddings, indexes and caches?	Derived data is where retention answers usually fall apart, so ask specifically
15	What do you keep after we stop paying, and for how long?	A number of days, and what the kept data consists of
16	Where is retention stated in the contract, not a help page or settings screen?	A section number. Help pages change without notice, and often do

5. What deletion means

#	Question	A real answer contains
17	How do we delete specific records, how long does it take and what confirmation do we get?	A named process, a number of days and a confirmation format you can show a client or regulator
18	Does deletion reach backups, logs, derived data and subprocessor copies, and if not, what stays and for how long?	Most honest vendors have a backup window where deleted content survives. Good ones state it, and worrying ones claim instant total deletion
19	What is the longest deletion time you will commit to in the agreement?	A number in the contract, the answer you need when a client or regulator asks

6. Which other companies receive your data

#	Question	A real answer contains
20	What is your current subprocessor list, with purpose, data and region for each?	A real, maintained list, ideally at a URL. Check it against question 6
21	How, and how far ahead, are we told of a new subprocessor, and can we object?	A notice period in days and a way to object. “We update the page” means you must keep checking it
22	Which duties flow down to subprocessors, such as confidentiality, security, deletion, training limits and breach notice?	Each flow-down term named. The training limit is the one most often missing
23	Which single subprocessor failure would cause your longest outage, and what is your plan?	Whether they have thought about it. Usually it is their model or cloud provider, and an honest vendor says so

7. Security evidence you can inspect

#	Question	A real answer contains
24	Which security documents do you hold, with scope and period, and will you share them under NDA?	Dated audit reports, attestations, test reports or architecture documents, and above all their scope. A report on a different product is common and easy to miss
25	How many people have privileged access to systems holding our data, and how is that reviewed?	A count, a review schedule, and MFA enforcement with its scope
26	How is our data encrypted at rest and in transit, who manages the keys and who can decrypt?	Key custody is what matters. If the vendor holds all keys and access, encryption only guards against a stolen disk. That may be fine, but know it
27	How do you manage vulnerabilities, with scan schedule, fix targets by severity and current open critical and high counts?	Real current numbers. A vendor that shares open finding counts is telling you about its culture
28	Do you log access to our data, how long are logs kept, and can we get them?	Yes or no on customer access to logs. It matters greatly in an incident and is rarely asked before one

8. When the vendor reports incidents

#	Question	A real answer contains
29	What notice time do you commit to, in hours, and from which event: discovery, determination or confirmation?	Both halves. A 72-hour promise from an undefined “confirmation” has no clock
30	What will the notice say, and will you tell us whether our own data was involved?	A commitment to tell you about your own data. Many vendors send a general notice, leaving your own duties unresolvable
31	Will you support our regulatory notices with forensic detail and a named contact, in the agreement?	A clause. Your clocks run whether or not the vendor helps, so put help in writing
32	Have you had an incident affecting customer data in 24 months, what happened and what changed?	A described incident with a fix beats a denial, since every mature company has had something

9. What can change before your next review

#	Question	A real answer contains
33	How, and how far ahead, are we told when the model version or model provider changes?	A notice method and lead time. Many vendors have neither and will say so when asked
34	Can we fix a model version or delay an upgrade, and for how long?	Yes with a duration, or an honest no, which is workable if known before you build on the product
35	What do you test before a model change ships, and will you share results for our use?	Evidence of a test process. It separates real engineering from wrappers that ship whatever the provider ships

10. What you can take when you leave

#	Question	A real answer contains
36	In what format can we export our data, settings and outputs, and for how long after termination?	A format and a post-termination window. “Contact support” is not an export method
37	At termination, how long until deletion, do we get a certificate, and what survives?	A number, a document and an honest list of what survives, usually backups on a stated cycle
38	What could we not take with us, such as prompts, tuned settings, past outputs, embeddings or integrations?	Usually more than buyers expect. Ask before signing, since it sets your real switching cost

Who earns money from your approval

Ask whoever recommends the vendor, whether your IT provider, integrator, consultant or internal champion. Ask in writing, and record the answers in the same file.

Field	Question	Why it matters
Resale	Do you resell this product, and earn a margin on the licence?	A reseller can still be right, but read the advice knowing the margin
Referral	Do you get a referral fee, finder’s fee or spiff for introducing us?	Common, and almost never volunteered
Implementation	Do you earn from setting it up, and what share of the project is that?	An adviser paid to implement wants the implementation chosen
Usage	Do you earn anything tied to our usage, seats or consumption?	It rewards you using more
Renewal	Do you earn anything at renewal, and does it differ from year one?	Renewal pay makes some advice stickier than it should be
Switching	Do you earn anything if we move to this product from another?	Migration incentives shape which options get shown

This is not suspicion. Disclosed incentives are manageable and hidden ones are not. An adviser who answers all six plainly tells you how they work, and so does one who refuses.

Apply the same lens to the vendor. Usage-based pricing means the vendor gains as your consumption grows. Know that before you design a workflow that creates volume.

Which open answers can stop approval

You will not get all 38 answered well, so spend attention here.

Question	Why it matters most
6, a third-party model	It decides who actually holds your data, and everything else depends on it
9 and 12, training by the vendor and its providers	Training cannot be undone, and no deletion request removes content from a trained model
19, the contracted deletion time	You need it when a client or regulator asks, and it must be in the agreement
29, notice time and its trigger	Your own deadlines depend on learning fast, so a vague trigger becomes your missed deadline
36 and 38, export and what you cannot take	They decide whether the choice can be reversed, which sets how much scrutiny it deserves

Ask questions 23, 27, 32 and 35 mainly for the reaction. A vendor that answers them candidly, unflattering details included, shows an engineering culture. One that deflects all four shows you something too.

Claims that still need a source or clause

These appear constantly in AI marketing, and none answers any question here.

Claim	What is wrong with it	Ask instead
”Enterprise-grade security”	It has no definition and no issuing body	Questions 24 to 28
”Military-grade encryption”	Marketing for AES-256, which is ordinary and fine, and silent on key custody	Question 26, on who holds keys
”NIST compliant” or “NIST AI certified”	No such certification exists. NIST AI 600-1, from July 2024, is a voluntary profile with no deadline or certificate	Which NIST AI 600-1 actions they implemented, and the evidence
”SOC 2 compliant” with no report	SOC 2 produces a report with a scope and period, so a claim without one is unverified	Question 24, asking for the report, scope, period and product covered
”We never sell your data”	Selling and training differ, and this line often dodges a training question	Questions 9 to 12
”Your data is encrypted and secure”	It says nothing about access, retention or training	Questions 7, 13 and 9
”99% accurate”	Meaningless without the task, test data and date	What was measured, on what data, when, and what happens when it is wrong
”GDPR compliant”	Compliance belongs to processing, not to a product badge	The DPA, subprocessor list and deletion terms
Certification logos in a footer	Often a parent’s, another product’s or an expired period’s	The scope and period of each

What belongs in the answer column

The difference shows in a single sentence.

Question	Deflection	Good answer
Do you train on our data?	”Your data is private and secure."	"Not by default on Business plans and above, where the setting under Admin, Data Controls is off. Free plans default to on. Section 4.3 of our agreement covers it.”
Where is our data processed?	”In the cloud, with enterprise-grade security."	"Storage is in us-east-1 on [provider]. Inference runs on [model provider] in the US, under our [date] agreement, with nothing processed abroad.”
How fast do you report a breach?	”We take security very seriously and would tell you promptly."	"Within 72 hours of determining customer data was affected, as section 9.2 defines. The notice says whether your tenant was involved.”
Can we delete our data?	”Yes, absolutely, just contact support."	"Delete through the API or console. It leaves production within 24 hours and backups within 35 days, with a certificate on request, under section 6.4.”
What happens when the model changes?	”We are always improving the product."	"Admins get 30 days’ email notice, and you can hold the current version for up to 90 days. We publish test results for changes to summaries.”

Good answers hold a number, a location, a definition or a section. Deflections hold a sentiment.

When you get one, ask again in the exact form you need, and log the round trip under open question. Two rounds are normal, and four without specifics are an answer in themselves.

Getting the answers

The questions are the easy part. A few habits get them answered faster.

• Send them in writing, to a named person. Send them all at once. A demo or call produces confident answers from someone paid to sound confident, and none of it is evidence. Ask the account executive to route the file to the security owner, and get that person’s name and title.
• Say what happens next. “We are comparing three products, and this file is the review. Answers with documents move fastest.” Vendors prioritise buyers who explain their process.
• Accept partial answers at first. Move gaps to the open question field and send a second round with only those. A short, specific email gets answered, and a repeat of the whole file does not.
• Watch the routing. One vendor connects you to a security engineer within a week. Another has sales answer all 38. Neither rules a vendor out, but it previews support during an incident.
• Ask for stated non-applicability. Open with “Where a question does not apply, say so and why.” A blank is ambiguous, and a stated reason can be recorded.

Read a large departure from these times as information.

Vendor	Reasonable time to a real first answer
An established platform with a trust page and standard DPA	2 to 5 business days, often self-service
A mid-size vendor with a security owner	1 to 2 weeks
An early-stage vendor with no security team	2 to 4 weeks, often candid, since nobody has learned to deflect

One completed row

Field	Content
Question	Q9. Do you train or improve models on our inputs or outputs by default?
Answer	”Team and Enterprise customer content is not used for training. Free and Pro individual accounts are opted in by default.” Emailed by [name], Solutions Engineer, on [date]
Evidence link	The 4 August 2026 training email, section 4.3 of the terms, and a dated Data Controls screenshot
Answer owner	[Name], VP of Security at [vendor], who confirmed the engineer’s statement in writing on [date]
Reviewer	[Your name], [date]
Open question	Does the exclusion cover features released after the contract date? Asked on [date], not yet answered
Contract term	MSA section 4.3 and DPA section 7. The MSA covers “Customer Content” without saying whether telemetry is included, which is flagged to counsel
Risk owner	[Name], VP Engineering, for the telemetry gap
Decision	Accept with a contract change, adding that the training exclusion covers all current and future features
Review date	[Date plus 12 months], or on any notice of changed terms

This row records the answer and catches a contract gap the sales answer glossed over. It keeps one question genuinely open and gives the remaining risk to a person. That is the whole method.

AI added to software you already use

You never evaluated this vendor. You licensed a help desk, practice system, document platform or CRM years ago, and a release note added AI. The data flow changed with no purchase order or review, and often the feature is on by default.

This is now a common way AI enters organisations, and most review processes miss it, since they hang on purchases. Put two things in place.

• A trigger. When any vendor announces an AI feature, it gets a row. Have someone read release notes and vendor emails for your top ten platforms. It takes fifteen minutes a month and is the only detection that works.
• A short question set. An added feature in a product you already contract for needs ten questions, not 38. Cite your existing agreement as you ask.

Priority question	In the full set
Which model powers it, and is it yours or a third party’s?	6
Is our content used to train any model by default?	9
Can we switch the feature off for the whole tenant?	10, adapted
Does it add a subprocessor, and when did the list change?	20 and 21
Does its content follow our existing retention terms, or different ones?	13 and 16
Does our existing DPA cover this processing, or need an amendment?	12 and 22
Who at your company can see content it processes?	7
Is it on for all our users, and can we limit it by role?	25, adapted
Does it shape any decision about a person?	Question 1 of the shadow AI screen
Where is its processing documented in a contract, not a help page?	16

The DPA question matters most, and vendors are least ready for it. Your DPA was negotiated for the processing that existed then. A new AI feature may add processing it never covered, including a new model provider as subprocessor.

Ask in writing whether the vendor thinks your DPA covers it, and keep the reply. If the feature is on by default and answers are pending, switching it off while you review can be undone. Leaving it on cannot.

What counsel must screen

Much of what is said about AI regulation in sales calls is wrong, so here it is accurately.

No federal AI certification exists. NIST’s Generative AI Profile, NIST AI 600-1 from July 2024, offers voluntary actions for managing generative AI risk. It is guidance, with no certificate and no deadline.

State law holds the dates. Colorado’s amended AI law takes effect on 1 January 2027 for covered systems used in consequential decisions. Your counsel decides whether a system is in scope.

State privacy laws also start on staggered dates. Louisiana and Oklahoma start on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028. Each varies by state, entity and data type, with its own thresholds and exemptions.

Two points follow for this file.

Whether a tool shapes a decision about a person, and whether a qualified person checks its output, are separate questions. Keep them apart in your record. If the first answer is yes, it is no longer a technology decision, and counsel must review it first.

One file for purchase, contract and renewal

Moment	What you do	Time
Before purchase	All 38, plus the six payment questions to whoever recommended it. Expect two email rounds, and record open rows	4 to 8 hours over two weeks
At contract review	Walk the contract term field. Every key answer found only in email becomes a redline request, where the file earns most of its value	2 to 3 hours
At yearly renewal	Ask the six key questions again, plus any row due for review. Changed answers are the finding	2 hours

People skip the renewal pass, yet it catches the most. AI vendors switch model providers, revise terms, add features with new defaults and get acquired. A year-old answer is genuinely unreliable.

Before you add a governance platform

Some third-party AI risk platforms are sold as if vendor review needs software. It does not. This file is a spreadsheet and some emails, and the hard part is reading answers, which no product does.

Before anyone quotes you a platform, ask which of the 38 questions it answers without you sending an email. Ask what it does when a vendor replies with a sentiment instead of a number. If it only tracks questionnaires you still send and read, you have built that here.

If your adviser answers your vendor review with a platform proposal, ask which parts of the review it removes. Then put the six payment questions to that adviser first.

Record the decision, owner and review date

This is general guidance on evaluating AI vendors, not legal advice. Whether an arrangement or data flow triggers a duty is a question for your counsel. That covers state AI and privacy law, HIPAA, GLBA, professional rules and your client agreements.

Have counsel review contract language before you rely on any answer recorded here.

SBK reads completed vendor files, starting with your open rows, before you sign. Call (718) 407-4169.