AI vendor due diligence questionnaire: [Vendor name]
[Organization name] is reviewing [Vendor name] before using its AI product. Please answer each question in writing and attach supporting documents where they exist. If a question doesn’t apply, say so and explain why. Please don’t answer with marketing material alone. We may follow up with questions or ask for a call.
About the company and the product
- Which models power the product? Are they your own or from a third party, and which providers act as subprocessors?
- How long has the product been in production, and how many customers like us use it?
- How do you notify customers of changes to models, features, terms, or pricing, and how much notice do you give?
- What can administrators see of our people’s conversations and activity, and what stays private to each user?
Data handling and privacy
- What data do you collect, store, and process on our behalf, and in which countries or regions?
- Is our data used to train or improve your models, or anyone else’s? Will you confirm in the contract that it is not?
- How long do you keep prompts, outputs, and logs? Can we set the retention period or ask for deletion?
- Who at your company and at your subprocessors can access our data, and how is that access approved and logged?
- What happens to our data when the contract ends, and how quickly is it deleted?
- How do you protect trade secrets and confidential information, and do your terms give you any rights in what we enter or what is produced?
Security
- Which independent security reports or certifications do you hold, such as SOC 2 Type II or ISO 27001? Can we see the most recent report?
- How is data encrypted in transit and at rest, and who manages the keys?
- Do you support single sign-on, multi-factor authentication, role-based access, and audit logs?
- How often do you run independent penetration tests, and how do you handle vulnerability reports?
- How do you defend against attacks specific to AI, such as prompt injection and data leaking between customers?
- If there is a breach or a serious incident, how quickly will you tell us, and what will you tell us?
How the AI behaves
- What are the known limitations and failure modes, and which uses do you advise against?
- How do you test the product for accuracy and safety? Can you share results for tasks similar to ours?
- Can we test it on our own examples before we sign?
- Do you keep logs of inputs and outputs that we can review when something goes wrong?
Contract and commercial terms
- Do the terms give us ownership of outputs? Do you offer protection if the outputs infringe someone else’s rights?
- What uptime, support response times, and service credits do you commit to?
- How is pricing set, what usage limits and overage charges apply, and what could change at renewal?
- What are your liability limits, and what cyber insurance do you carry?
- Can we export our data and settings, and what help do you provide if we leave?