AI Vendor Evaluation for Small Teams

Start here

Pillar guide

AI Vendor Due Diligence in 30 Minutes (Questions + Scoring Sheet)

A fast procurement pass for AI vendors: the questions that matter, a simple risk score, and how to document evidence when the team has no procurement desk.

9 min read

Related guides

Governance · 12 min

When Your AI Vendor Has a Security Incident

An AI vendor security incident on a tool you depend on is still your governance problem. This practical guide helps small teams assess scope, rotate credentials, update threat models, and document decisions — without waiting for confirmed harm.

Frequently Asked Questions

What questions should I ask an AI vendor about data?

Key questions: Is our data used to train your models? Where is data stored and processed? Do you have a Data Processing Agreement? Can we delete our data on request?

What's the most important clause in an AI vendor contract?

Data ownership and the right to deletion. Ensure the contract is explicit that your data (including prompts and outputs) belongs to you and is not used for training.

How do I evaluate model accuracy claims?

Ask for benchmark results on your specific use case, not just general benchmarks. Better yet, run a time-limited pilot with real tasks before committing to a contract.

Do we need a DPA with every AI vendor?

If you're subject to GDPR (or similar), yes — for any vendor processing personal data on your behalf. Most major vendors have standard DPAs available on request.