AI Vendor Due Diligence Checklist: Questions, Red Flags, Clauses
Group COO & CISO
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
AI vendor due diligence is the set of checks you run before buying or renewing an AI product: who the vendor is under the EU AI Act, which model sits underneath, what happens to your data, how it is secured, what documentation and logging you get, how incidents are reported, and how you leave. Ten areas, with red flags, follow.
Key takeaways
- Most organisations are deployers of AI they buy. Your AI Act duties depend on what the vendor gives you, so due diligence is where compliance starts.
- Ask about the underlying general-purpose AI model and its provider. The vendor you sign with is often not the company that trained the model.
- Data use is the most common deal-breaker: training on your data, retention, location and sub-processors.
- For high-risk systems, insist on instructions for use under Article 13, logging support and a working route for incident notification.
- Write the answers into the contract. A questionnaire without clauses gives you nothing to enforce.
Why AI vendor assessment is different from normal IT procurement
Standard supplier questionnaires ask about ISO 27001, penetration tests and GDPR. Those still matter, but AI products add new questions. The model may change behaviour after an update without any change on your side. Your prompts and documents may be used to improve the service. Outputs can be wrong in ways that look confident. And under Regulation (EU) 2024/1689, the AI Act, the vendor's documentation determines whether you can meet your own obligations as a deployer.
Role matters. The split between provider and deployer obligations means a provider of a high-risk system must deliver technical documentation, instructions for use, logging capability and a quality management system, while you as deployer must use it as instructed, assign human oversight, monitor and keep logs. If the provider cannot support you, your compliance fails too. For the bigger picture, see how the EU AI Act works. If you want this checklist tailored to your situation, assess your AI governance against the EU AI Act and the free assessment writes an AI Vendor Due Diligence Checklist for you in Word.
Need expert help with ai vendor due diligence checklist?
Our cloud architects can help you with ai vendor due diligence checklist — from strategy to implementation. Book a free 30-minute advisory call with no obligation.
Tier the due diligence before you start
Not every AI tool needs 80 questions. Tier vendors by the use case, not the product:
| Tier | Typical use case | Depth |
|---|---|---|
| Light | Minimal-risk productivity tools with no personal or confidential data (e.g. image generation for internal slides) | Sections 1, 3, 4 and 10 |
| Standard | Generative AI with business or personal data, customer-facing chatbots, AI features in core SaaS | All sections, lighter evidence |
| Enhanced | High-risk use under Annex III (HR, credit, education, essential services), or large volumes of special-category data | All sections with documentary evidence and contract clauses |
The checklist that follows uses the format question, why it matters, red flag.
1. Vendor and role under the AI Act
| Question | Why it matters | Red flag |
|---|---|---|
| Is the vendor the provider of the AI system, or a reseller, importer or distributor? | Provider obligations sit with the provider; importers and distributors have verification duties. | The vendor cannot name the provider or its EU establishment. |
| How does the vendor classify the system under the AI Act, and for which intended purpose? | Classification depends on intended purpose. Using it outside that purpose can shift obligations to you. | "The AI Act does not apply to us", with no reasoning. |
| If the provider is outside the EU, who is its authorised representative? | Non-EU providers of high-risk systems must appoint one (Art. 22). | No representative for a high-risk system. |
| Will our configuration or branding make us a provider? | Under Art. 25 a deployer that puts its name on a high-risk system or substantially modifies it takes on provider obligations. | White-label offers with no allocation of responsibilities. |
2. Model provenance and the GPAI provider
| Question | Why it matters | Red flag |
|---|---|---|
| Which model or models power the product, from which provider, which version? | Behaviour, data flows and risk depend on the model. | "Proprietary" with no further detail for a product clearly built on a third-party LLM. |
| Has the GPAI model provider supplied downstream documentation under Art. 53, and does the vendor pass relevant parts on? | Since 2 August 2025 GPAI providers must give integrators information on capabilities and limitations. | Vendor has never asked its model provider for it. |
| How are model changes communicated? | A model swap can change accuracy and bias overnight. | Silent updates, no release notes, no option to pin a version. |
| Does the GPAI provider follow the Code of Practice? | A signal of maturity, not a legal requirement. | Vendor does not know. |
For what the GPAI rules require of model providers, see general-purpose AI obligations and the Code of Practice.
3. Data use, training, retention and location
| Question | Why it matters | Red flag |
|---|---|---|
| Are our prompts, files or outputs used to train or fine-tune any model, by the vendor or its model provider? | Training on your data can leak confidential information to other customers and breaks purpose limitation. | Opt-out rather than opt-in, or a different answer in the terms than in sales materials. |
| How long are prompts, outputs and logs retained, and can we set retention? | Retention must match your GDPR and record-keeping needs, including the six-month log minimum for high-risk deployers. | Indefinite retention, or logs deleted too quickly for you to meet Art. 26(6). |
| Where is data processed and stored, including abuse monitoring and support access? | EU processing simplifies GDPR transfers and customer commitments. | "EU region" for storage only, while inference or human review happens elsewhere. |
| Is personal data filtered, pseudonymised or redacted before reaching the model? | Reduces exposure if prompts are logged or reviewed. | No technical controls, only a policy telling users not to paste personal data. |
4. GDPR: DPA, sub-processors and transfers
| Question | Why it matters | Red flag |
|---|---|---|
| Is there an Art. 28 data processing agreement covering AI features? | Required when the vendor processes personal data for you. | DPA excludes the AI add-on or "beta" features. |
| Who are the sub-processors, including the model provider and hosting? | You must be able to object to new sub-processors. | No list, or no notice of changes. |
| What transfer mechanism applies to data leaving the EEA? | Chapter V GDPR requires adequacy, SCCs or another mechanism. | No transfer impact assessment available. |
| Can the vendor support data subject rights in prompts, logs and fine-tuned models? | Access and erasure requests can reach AI logs. | "Not technically possible", with no alternative. |
The interaction between the two regimes is covered in the EU AI Act versus GDPR.
5. Security certifications and testing
| Question | Why it matters | Red flag |
|---|---|---|
| Which certifications or reports cover the AI service (ISO/IEC 27001, SOC 2, ISO/IEC 42001)? What is the scope? | Certificates often exclude new products. | Certificate scope does not include the AI service. |
| Has the AI feature been penetration tested, including prompt injection and data exfiltration? | LLM applications have attack classes classic tests miss. | Pen test predates the AI feature. |
| How are connectors and agent permissions scoped? | Over-broad access turns one injected instruction into a data breach. | Admin-level tokens by default. |
| Are secrets and credentials detected and blocked in prompts? | Users paste keys and passwords more often than you would expect. | No controls. |
6. Transparency and documentation
| Question | Why it matters | Red flag |
|---|---|---|
| For high-risk systems: can we see the instructions for use required by Article 13? | They must state intended purpose, accuracy levels and metrics, known risks, human oversight measures and log handling. Your Art. 26 duties depend on them. | Instructions not available before contract signature. |
| What accuracy, robustness and bias testing has been done, on what data? | You need to judge whether results hold for your population. | Only aggregate marketing claims. |
| Does the product support Art. 50 transparency, such as AI disclosure in chat and marking of generated content? | Art. 50 obligations apply from 2 August 2026. | No disclosure options for customer-facing bots. |
7. Human oversight and logging
| Question | Why it matters | Red flag |
|---|---|---|
| Can a human review, override or stop outputs before they take effect? | Deployers must assign effective human oversight (Art. 26(2)). | Fully automated decisions with no review queue. |
| Which events are logged, and can we export logs? | High-risk systems must allow automatic logging (Art. 12); deployers keep logs under their control for at least six months. | Logs only visible to the vendor. |
| Are explanations or reasons available for individual outputs? | Affected people may ask why, and GDPR may require meaningful information. | None. |
8. Incident notification
| Question | Why it matters | Red flag |
|---|---|---|
| How quickly will the vendor tell us about security incidents, personal data breaches and AI malfunctions? | GDPR breach clocks run from your awareness; providers of high-risk AI must report serious incidents (Art. 73). | "Without undue delay" with no ceiling and no contact. |
| How do we report a suspected serious incident to the provider? | Deployers must inform the provider when they identify a serious incident. | No defined channel. |
9. Contractual clauses
Turn the answers into terms. Clauses to consider:
- No training on customer data without written opt-in, binding on sub-processors.
- Model change notice: advance notice of material model changes, with the right to test or stay on a version for a period.
- Regulatory cooperation: the vendor provides documentation and assistance you need for AI Act, GDPR and authority requests.
- Role allocation: who is provider, who is deployer, and what happens if your use changes.
- Audit and evidence rights: test results, certificates and pen test summaries on request.
- Incident notification with hard timelines and content.
- Liability and IP: indemnity for third-party IP claims arising from outputs, where you can get it.
Make sure your AI acceptable use policy only allows tools that have passed this process, otherwise shadow AI bypasses the checks.
10. Exit
| Question | Why it matters | Red flag |
|---|---|---|
| Can we export our data, configurations, prompts and fine-tuned assets in a usable format? | Avoids lock-in and supports record-keeping after exit. | Proprietary formats only. |
| How is deletion confirmed at the end of the contract, including backups and sub-processors? | GDPR and confidentiality obligations continue. | No deletion certificate. |
| What happens to logs we must retain? | You may need them after the service ends. | Logs deleted at termination. |
Running the process
- Register the request in your AI inventory with the intended use case.
- Tier it (light, standard, enhanced).
- Send the relevant sections; ask for evidence, not just yes or no.
- Score each answer as acceptable, acceptable with conditions, or not acceptable.
- Agree contract clauses for every condition.
- Record the decision, owner and review date. Re-run when the vendor changes model, terms or sub-processors, and at renewal.
Frequently asked questions
What is AI vendor due diligence?
It is the assessment you carry out before contracting an AI product, covering the vendor's role under the AI Act, the underlying model, data use and location, GDPR terms, security, documentation, human oversight, logging, incident handling, contract terms and exit. The aim is to confirm that the product is safe for your use case and that the vendor can support your own legal obligations.
Does the EU AI Act require vendor due diligence?
The AI Act does not use that phrase. But deployers of high-risk systems must use them according to the instructions for use, ensure oversight, monitor and keep logs, which is impossible without information from the provider. Importers and distributors have explicit verification duties. In practice, due diligence is how deployers make sure they can comply.
What is the biggest red flag in an AI vendor assessment?
Unclear data use. If a vendor cannot say in writing whether your prompts and files train its or its model provider's models, how long they are kept and where they are processed, you cannot assess GDPR compliance or confidentiality. Second on the list is a vendor that cannot name the model it uses or give notice before changing it.
Is ISO/IEC 42001 certification enough to approve an AI vendor?
It is a useful signal that the vendor runs a managed AI governance process, but it does not prove that a specific product is compliant with the AI Act or suits your use case. Check the certificate scope covers the product you are buying, and still ask the product-level questions on data, documentation and oversight.
How often should AI vendors be reassessed?
At renewal at the latest, and whenever the vendor changes the underlying model, its terms, its sub-processors or its data location, or after an incident. For high-risk use cases, an annual review with refreshed evidence is a sensible minimum.
Get your vendor checklist written for you
Use the ten sections above as your template, or let us draft it from your context. The free AI Act gap assessment asks about your AI use, vendors and controls over 14 steps, about 40 minutes, and writes four editable Word documents: AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template, plus a maturity score across ten areas. No card, no obligation. If you want an EU-hosted gateway that pseudonymises personal data and logs every generative AI call, look at Opsio Vault AI.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Statements are as of October 2026.
Related Articles
About the Author
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by a certified practitioner and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.
