AI Vendor Risk Checklist (template)

Lean AI Gov template by Fresco Consulting. Use one copy per AI tool. Most answers are in the vendor's terms of service, privacy policy, data processing addendum, trust or security page, and admin settings. If you cannot find an answer, ask the vendor in writing and keep the reply. Not legal advice.

Tool: [name] Vendor: [company] Plan: [free / paid individual / business / enterprise] Reviewed by: [name] Date: [date] Planned use: [what for] Most sensitive data it will touch: [public / internal / confidential / regulated]

A. Data use

• ☐ Does the vendor use our inputs or outputs to train or improve its models? Yes / No / Can be turned off (where: ______)
• ☐ How long does the vendor keep our data? ______ Can we delete it? Yes / No
• ☐ Can vendor staff view our content? Under what conditions? ______
• ☐ Where is the data stored and processed (countries)? ______
• ☐ Does the vendor share data with sub-processors? Is the list published? Link: ______

B. Security

• ☐ Security certifications or audits listed (for example SOC 2 Type II, ISO 27001): ______
• ☐ Encryption in transit and at rest stated: Yes / No
• ☐ Multi-factor authentication available and enforced for our users: Yes / No
• ☐ Single sign-on available on our plan: Yes / No / Not needed
• ☐ Admin console lets us add and remove users and see usage: Yes / No

C. Contract and legal

• ☐ Data processing addendum available: Yes / No
• ☐ Breach notification commitment (how fast, to whom): ______
• ☐ For health information: will the vendor sign a Business Associate Agreement? Yes / No / Not applicable
• ☐ Who owns the outputs? ______
• ☐ Any client contracts of ours that restrict this tool or data? ______

D. Output quality and control

• ☐ Known limits documented by the vendor (accuracy, sources, citations): ______
• ☐ Can we turn off features we do not want (for example web browsing, plug-ins, sharing links)? ______
• ☐ Does the tool show sources for answers? Yes / No

E. Business risk

• ☐ Cost and plan needed for the controls above: ______
• ☐ What happens to our data if we cancel? ______
• ☐ Is there a reasonable alternative if this vendor disappears? ______

Decision

• ☐ Approve for: [data classes and uses]
• ☐ Approve with limits: [limits]
• ☐ Change plan first: [which plan and why]
• ☐ Do not approve. Reason: ______

Re-check date: [date, 6 to 12 months out or when terms change] Ask your IT provider to confirm sections B and D if you are unsure.