AI Vendor Due Diligence: Evidence Before Approval

Begin with a proposed use: which product, edition, deployment region, users, data and actions are involved? A supplier may operate several services with different infrastructure and controls. Record the configuration being considered and ask the supplier to identify which documents and commitments apply to it.

Map the proposed data flow in plain language. What enters the service, which components or providers process it, what is stored, what is logged and what comes back? For an agent, include tool calls and destinations. Use this map to decide which questions require technical evidence, contractual clarification or your organization's own risk judgment.

Assign the review responsibilities before sending a long questionnaire. Engineering should understand integration and failure behavior; security should inspect controls; privacy and legal teams should assess the questions within their remit; a business owner should accept the intended use and residual issues. A completed questionnaire is an evidence input, not an automatic approval.

Choose a small set of consequential claims to test in an authorized sandbox. Demonstrate an ordinary user's access boundary, a denied action, a data export and a failure in a dependency your integration relies on. Use synthetic material. Record the product configuration and observed behavior rather than treating a guided screen tour as a test result.

For AI-specific workflows, inspect how model or provider changes are surfaced, whether the application preserves relevant versions and what happens when an output or tool action requires human review. Ask who can override a control and how that action is logged. Do not assume that an AI-generated questionnaire answer has been approved merely because it is presented confidently.

Keep unresolved questions visible. Mark each response as documented, demonstrated, promised, disputed or unknown according to your team's definitions. A roadmap commitment can be commercially relevant, but it should not become a current capability in the approval record. Give every material gap an owner and an explicit decision about whether it blocks the proposed use.

Before relying on a service, request a sample export that your team can open and interpret. Identify what it omits: attachments, relationships, prompts, datasets, review history or configuration. Decide which omissions matter to continuity and which information is available only through a separate process or agreement.

Write an exit checklist covering internal ownership, access revocation, relevant data handling, integration changes and record retention under your organization's policies and agreements. Where a deletion or termination confirmation is required, identify who requests it and who reviews the response. This is operational planning, not a statement about universal legal requirements.

The final diligence memo should explain the proposed use, evidence considered, test results, unresolved gaps, accepted exceptions and decision authority. That memo is more useful than an unexplained supplier score. It gives the next reviewer a starting point when the service changes and gives the business a clear account of what it has actually approved.