Skip to content
AI Compliance Tool
Check my AI risk
PlatformSolutionsPricingRegulationsFree toolsGuides Partners Sign in

Free tool

AI Vendor Risk Assessment

Unknown answers count against the vendor, because the point of due diligence is to replace unknowns with documented facts. Certification claims are not evidence until you have seen the report.

Does the vendor receive personal information about customers, employees or candidates?
Does it receive sensitive, financial, health or confidential information?
Is your data excluded from model training by contract or verified setting?
Do you know the retention period for prompts, files and logs?
Is there a signed agreement or data-processing terms beyond click-through?
Do you know where data is stored and processed?
Have you seen an independent audit report (not just a badge on the website)?
Is there a written incident notification commitment with a timeline?
Can your staff review or override outputs before they affect customers?
Does the vendor notify you of model or behaviour changes in advance?

Use the vendor due diligence checklist for the full twelve question areas, or send the questionnaire from a Business workspace and collect answers by secure link.