Vendor Due Diligence

The process of evaluating an AI vendor before adopting their product and on an ongoing basis, to assess security, privacy, legal compliance, and reliability. AI vendor due diligence covers: data handling and retention policies, security certifications, subprocessor lists, incident response procedures, model training policies (is your data used?), contractual protections, and financial stability. The EU AI Act requires deployers of high-risk AI systems to verify that the AI they purchase complies with the Act's requirements. Even outside regulated contexts, vendor due diligence protects against supply chain risk.