AI vendor due diligence

Every question here has one purpose: what happens on the day the vendor stops being useful, or stops being safe.

Data

• What is sent, where is it stored, for how long?
• Is it used to train models, and is the opt-out auditable?
• Can you export everything in a readable format?

Exit

• Notice period, and what happens to your data on termination?
• Is deletion certified, or merely stated?
• Migration cost in hours, not promises?

Terms and control

• How much notice before they change terms, price, model or subprocessor?
• Can you see what the system did — logs, retention, access?
• Can you shut it off without their cooperation?
• Who owns the “no”, by name?

The contract test

Read the termination and change-of-terms clauses aloud to the person who will explain them to a regulator. If either of you cannot finish the sentence, you have found the risk.