Executive briefing: AI procurement
AI Vendor Due Diligence: The Questions Vendors Hope You Won't Ask
AI vendor due diligence is the set of checks an organisation runs before an AI vendor touches its data or its decisions. It goes beyond standard supplier checks because AI products change after you buy them, their outputs can be confidently wrong, and your data may flow to model providers you never contracted with. Good diligence covers eight areas of AI vendor assessment questions (data, models, security, performance, compliance, accountability, commercial terms and exit), escalates the red flags in the answers, and turns the answers that matter into six contract clauses.
Read the full briefingIn brief
- AI vendors are not like software vendors. The model can change underneath you, outputs vary, and your data may train models via providers you never met.
- Twenty-four questions in eight areas separate a vendor who has thought about AI risk from one who has not. Ask for evidence, not assurances.
- Six red flags in vendor answers should be escalated, starting with vague answers on whether your data trains models.
- Six clauses turn the key answers into obligations. If it is not in the contract, it is not a commitment.
- Tier every AI vendor by risk before signature, and move it up a tier when its use changes, for example when an agent feature is switched on.
Why the board should care
The organisation answers for its AI
Buying AI does not transfer accountability for it. If a vendor's AI gives a customer wrong advice or makes a biased decision, your organisation answers for it, so the contract has to say who bears the cost.
The product keeps changing
Vendors update the models underneath their products, often without notice. A tool that passed your tests at signature can behave differently next quarter.
Leverage ends at signature
Exit terms, data deletion and model change notice are easiest to win before you sign. Once a tool is embedded in your workflows, the cost of leaving rises every month.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The video briefing
- The full written briefing
Next step
See where your AI risk really sits
The AI Readiness Assessment: Full Report (£999 + VAT) shows where your governance, data and risk controls are weak, and includes a 60-minute debrief with a senior partner. Prefer to talk first? A free 30-minute scoping call with a senior partner.
FAQ
Frequently asked questions
What is AI vendor due diligence?
AI vendor due diligence is the review an organisation carries out before it buys, renews or switches on an AI product: how the vendor uses your data, which models sit behind the product, how it is secured and tested, who is liable for its outputs, and how you would exit.
What questions should you ask an AI vendor?
Twenty-four AI vendor assessment questions in eight areas: data, models, security, performance, compliance, accountability, commercial terms and exit. The most important is whether your data is used to train or improve any model, including by the model providers behind the vendor.
How is AI vendor due diligence different from normal supplier due diligence?
Standard checks assume the product behaves tomorrow as it did in the demo. AI products do not: the underlying model can change, outputs vary and can be wrong, and your data may flow to third-party model providers. Diligence has to cover those differences as well as the usual security and financial checks.
What clauses should an AI vendor contract include?
Six: no training on your data, model change notice, audit and assurance rights, data location and deletion, output liability including IP indemnity, and exit and portability. This is governance guidance, not legal advice: your lawyers draft the wording.
Is the AI vendor the provider or the deployer under the EU AI Act?
Usually the vendor that develops the system and places it on the market under its own name is the provider, and the organisation using it is the deployer. You can take on provider duties if you put your own name on the system or modify it substantially. Ask the vendor to confirm its role in writing, and take legal advice on your own position.
Does every AI tool need full due diligence?
No. Tier vendors by risk. Low-impact internal tools need the core questions, standard terms reviewed and a named owner. Vendors handling customer data or business decisions need the full question set and all six clauses. High-risk uses, such as regulated decisions or autonomous agents, also need independent testing, executive sign-off and ongoing monitoring.
What if we have already signed with an AI vendor?
Score the contract you have. Put the unanswered questions to the vendor in writing, and use the renewal or the next material change to negotiate the missing clauses. If you cannot see what the vendor does with your data, escalate it to the executive who owns the relationship.
This briefing is general information on AI vendor due diligence. It is governance guidance, not legal advice, and the contract clauses are not legal drafting. References to the EU AI Act and GDPR are governance guidance. AIPEX is not a certification body. For decisions about specific contracts, take advice from qualified advisers.