AI vendor due diligence evidence checklist

What is the review baseline?

The NIST resources provide a voluntary baseline. They do not establish every state, sector, privacy or contractual duty.

The FTC explains that advertising claims need evidence. Treat supplier claims as questions to substantiate, not approval evidence by themselves.

Tell the supplier the intended data, users and decisions. A generic assurance report may not cover the feature you plan to use.

Worked example. Training use is not retention

Fictional example. A supplier says prompts are not used for training. Its contract discusses model improvement but is unclear about prompt-log retention.

Record the contract version and relevant passage. Training use and retention are separate questions, so an answer to one cannot settle both.

Procurement requests service-specific clarification. The deployment owner restricts the pilot to synthetic data pending review.

The tool can identify candidate wording in a text-based document. A reviewer must decide whether the wording addresses the use and creates an adequate obligation.

Start with the actual use case

Tell the supplier what data, output, users and decisions are in scope. Generic questionnaires produce generic answers.

Collect operational evidence

Check security, privacy, model change, testing, incident handling, subcontractors, data use, retention, exit support and service limitations.

Turn gaps into contract or operating controls

Record each gap, evidence, owner, decision and treatment. Some gaps require a contractual term. Others require a technical restriction or a decision not to proceed.

Working checklist and fictional samples

Use this checklist as an operating aid, not an exhaustive legal assessment. Inspect the samples before entering your own facts.

• Identify service scope, model dependencies and subcontractors.
• Check data access, training use, retention, deletion and exit.
• Review security assurance scope, access and incident handling.
• Seek performance evidence for the intended use and its limitations.
• Record model-change notices and monitoring responsibilities.
• Preserve contract references, unresolved terms and the procurement decision.

• Fictional US AI supplier review PDF. Inspect review subjects, supplier evidence and unresolved actions.