AI vendor due diligence evidence checklist
Supplier answers need evidence, contract treatment and an owner. Marketing claims alone do not establish a usable control.
Start with the actual use case
Tell the supplier what data, output, users and decisions are in scope. Generic questionnaires produce generic answers.
Collect operational evidence
Check security, privacy, model change, testing, incident handling, subcontractors, data use, retention, exit support and service limitations.
Turn gaps into contract or operating controls
Record each gap, evidence, owner, decision and treatment. Some gaps require a contractual term. Others require a technical restriction or a decision not to proceed.
Material reviewed for this guide
- Generative Artificial Intelligence ProfileNational Institute of Standards and Technology
- Artificial Intelligence Risk Management Framework 1.0National Institute of Standards and Technology
- Keep your AI claims in checkFederal Trade Commission
This guide is general operational information, not legal advice. Check the official material and obtain appropriate advice for circumstances outside the stated scope.