Includes 4 documents
Generative AI Starter Kit
Four base documents to start with from day one: usage rules, intellectual property, a tool inventory and staff training.
USD 109USD 176
Complete kit · available to buyAI features inside vendor software
AI features built into software the organization already buys, such as CRM, ERP, office suites or HR tools. The customer remains responsible for how they are used and must control contracts, data, training on its information and subprocessors.
Examples
- AI copilot inside the CRM
- AI features in the office suite
- Automated analytics in HR software
- AI transcription in the video meeting platform
By country
We only list countries where an obligation in force or adopted mentions this use case.
How rules treat it, by jurisdiction
| Jurisdiction | Level | Date | Note |
|---|---|---|---|
| European Union | Data protection | — | Processor agreement (GDPR Art. 28) covering training on customer data and subprocessors; high-risk providers must supply instructions for use. |
| European Union | Sector rules | January 17, 2025 | DORA: financial entities must register their ICT providers, including AI vendors. |
| Ecuador | Data protection | March 10, 2026 | The amended general rule on AI requires vendors to report on functioning, limitations and risks; transfers have a transition period until January 2027. |
| Peru | Data protection | March 31, 2025 | Cross-border flows must be reported and registered with the authority (DS 016-2024-JUS, Art. 21). |
| Brazil | Data protection | — | ANPD Resolution 19/2024: standard clauses for international transfers. |
| Argentina | Data protection | — | Law 25,326 Art. 12: contracts for transfers to countries without adequate protection. |
| Chile | Data protection | December 1, 2026 | Law 21,719: processor contracts and international transfers. |
| Colorado | Consequential decision | January 1, 2027 | If the feature influences a consequential decision, the deployer has duties even if the system is third-party. |
| United States (federal) | Minimal risk or no specific regime | — | No specific law; banking guidance SR 26-2 expects vendor models to be governed like internal ones. |
Common base documents
- AI Vendor Management Policy
Policy · USD 39 · Available to buy
- AI Data Processing Agreement (DPA)
Contract or addendum · USD 59 · Available to buy
- AI Vendor Due Diligence Checklist
Checklist · USD 39 · Available to buy
- AI Vendor and Audit Register
Register · USD 39 · Available to buy
- AI System Inventory
Register · USD 59 · Available to buy
Depending on your situation
- If data leaves the country
- If the vendor is critical to operations
- If the feature decides about people
Related kits
Includes 6 documents
AI Adoption Starter Kit: First 90 Days
Six base documents to launch AI adoption in the right order: 90-day roadmap, usage rules, tool approval, use case portfolio, pilots and training.
USD 139USD 234
Complete kit · available to buyIncludes 6 documents
AI Integrators Kit
Six base documents for integrating third-party models through APIs or RAG: due diligence, model provenance, architecture, integration map, adversarial security and service level agreement.
USD 119USD 194
Complete kit · available to buy