How-toAI GovernanceBuilding Capability
How to vet an AI vendor before you sign
Six steps to check an AI tool or vendor properly before it touches your data, without turning procurement into a project.
Chris Rigby
Co-Founder & CRO
- Published
- Last reviewed
New AI tools arrive every week, and existing vendors are adding AI features to products you already use. A light but consistent vetting process means you can say yes to useful tools quickly, and know why you said no to others.
This method takes around two hours for a typical tool. Higher-risk uses deserve more time.
- Time
- 2 hr
- Level
- Intermediate
- Steps
- 6
Before you start
- A clear description of what the tool will be used for
- Knowledge of what data will go into it
- Input from whoever handles data protection in your firm
Tools you need
- The vendor’s terms, privacy notice and data processing agreement
- Your AI register
- A simple vendor assessment template
1Be clear on the use case
Write down what the tool will be used for, by whom, and what data will go into it. This sets the level of scrutiny. A tool for drafting internal notes needs less checking than one that handles client files or influences decisions about people.
2Check how your data is used
Read the terms, privacy notice and data processing agreement. Find clear answers to: Is our data used to train the vendor’s models? Can we opt out? Where is data stored and processed? How long is it kept? Who at the vendor can access it?
If the answers aren’t clear in writing, ask. If they still aren’t clear, treat that as a warning sign.
3Check security basics
Look for recognised security certifications or independent assurance reports, single sign-on, admin controls, access logs and a clear process for reporting incidents to you.
4Understand accuracy and limits
Ask how the vendor tests the tool, what it’s known to get wrong, and what guidance they give users. Run a short trial with real (non-sensitive) tasks and check the output yourself.
5Review the contract terms
Check liability, ownership of outputs, notice of changes to the service or terms, subprocessors, and what happens to your data when you leave. Note whether the vendor can switch on new AI features without telling you.
6Decide, record and review
Make a clear decision: approved, approved with conditions, or not approved. Record it in your AI register with the reasons and any conditions, such as "no client data". Set a review date, and revisit sooner if the vendor changes its terms or adds major features.
Frequently asked questions
What is the most important question to ask an AI vendor?
Whether your data is used to train their models, and whether you can opt out. It’s the question with the biggest impact on client and personal data.
Do we need to vet AI features in software we already use?
Yes. New AI features can change how your data is processed. Treat a significant new AI feature like a new tool and run a light check.
