AI Vendor Due Diligence Checklist

How to use this document

• What it is for. This is a base questionnaire to assess a vendor of AI software or services before signing or renewing: data use and training, security, privacy, model transparency, bias, compliance, intellectual property, sub-processors, support and exit. It includes a scoring method and a recommendation format.
• Who should own it. The AI lead, with procurement or vendor management as operational coordinator. Information security, the data protection officer and Legal assess their own sections. Enter the function in [RESPONSIBLE FUNCTION] and the person who coordinates the assessment in [OWNER].
• Decisions to take first. Before using it, set the section weights and result thresholds (Section 3) and decide which questions are critical. The assessment depth (Section 2) and who approves (Section 7.3) follow the risk level of the use, as recorded in the "AI System Inventory".
• Models with no vendor. If you will use an open-weight model downloaded from a public repository, there is no vendor to answer the questionnaire: apply the self-assessment in Section 4.10 and record the result in the "Third-Party and Open-Weight Model Provenance Sheet".
• Fields to complete. Complete the assessment details, send the vendor the Section 4 questions for its depth (you can use the message in aid B), score each answer and complete Sections 5 to 7. Keep [OPTIONAL] questions only if they apply.
• Country variants. This document has no country variants. If the vendor will process personal data or provide a critical service in a regulated industry, check "Related regulatory references" for the processing agreement, international transfer mechanism or third-party register your jurisdiction expects, and add it to Sections D and I.
• Review. Ask Legal to review the conclusions on Sections D, H and I before negotiating, and carry the findings into the contract and the service level agreement (aid D).
• Approval and filing. The result is approved by the people listed in Section 7.3 for the risk level. File the questionnaire, answers, evidence and score in the vendor's file.

Module selection

Profile	Sections to keep
P1: uses AI inside software it buys	Sections 1 to 8, questions A to I
P2: integrates models through APIs or RAG	Sections 1 to 8, questions A to I, with special attention to A3, A7 and B2
P3: hosts models on its own or rented infrastructure	Sections 1 to 8; Section 4.10 for each open-weight model; questions A to I for the cloud or infrastructure vendor, if any
P5: uses agents that act in systems	Sections 1 to 8, including question C7

Delete the module sections and questions that do not apply to your organization.

AI Vendor Due Diligence Checklist

Field	Value
Organization	[LEGAL ENTITY NAME]
Function coordinating the assessment	[RESPONSIBLE FUNCTION]
Assessment coordinator	[OWNER]
Vendor assessed	[VENDOR]
AI solution or service	[AI SYSTEM]
Intended use at [ORGANIZATION NAME]	[COMPLETE: process, user team, data to be shared and decisions it will support]
Entry in the "AI System Inventory"	[COMPLETE: identifier]
Risk level of the use	[COMPLETE: Low, Medium or High]
Assessment depth	[COMPLETE: Basic, Standard or Reinforced]
Assessors	[COMPLETE: system owner, information security, data protection officer, Legal, AI lead]
Date questionnaire sent and date closed	[DATE] and [DATE]
Type of assessment	[COMPLETE: new contract, renewal or reassessment after a change]

1. Purpose and scope

1.1 [ORGANIZATION NAME] applies this checklist before contracting, renewing or expanding the use of any product or service that includes AI, including AI features that an existing vendor turns on in its product.

1.2 This assessment supplements general vendor due diligence (financial, legal, security and continuity) and focuses on AI-specific risks.

1.3 No AI vendor may receive the organization's data or be used in production without a closed assessment with a result of "Suitable" or "Suitable with conditions" and the approval set out in Section 7.3.

1.4 General contracting terms, the vendor register and vendor follow-up are governed by the "AI Vendor Management Policy" and the "AI Vendor and Audit Register"; this checklist does not repeat them.

2. Assessment depth by risk

The depth follows the organization's single risk scale: Low → Basic, Medium → Standard, High → Reinforced. A use at the Unacceptable level is not assessed: it is not contracted.

Risk level of the use	Depth	Sections applied	Evidence
Low (internal use, no personal data or only trivial data, no decisions about people, easy to reverse)	Basic	A, B, C, D and I	Vendor statements and public documentation
Medium (personal data, interaction with customers or the public, published content, errors reversible but visible)	Standard	All	Current documentation and certifications
High (decisions with significant effects on people, special-category or children's data, regulated sector, agents acting in production)	Reinforced	All, including applicable [OPTIONAL] questions	Verified evidence, a pilot or demonstration and, where appropriate, an audit or technical interview