# AI Vendor Assessment Checklist

Use this as a structured starting point for procurement, renewal or deployment review. Adapt the depth to the use case, people affected, data and applicable law.

## Purpose and ownership
- What business problem does the service address?
- Who is the business owner and technical owner?
- Which users and affected people are in scope?
- What would happen if the service were unavailable or produced an incorrect result?

## Data and privacy
- What data is submitted, generated, stored or inferred?
- Where is data processed and stored?
- What are the retention and deletion rules?
- Is customer data used to train or improve models?
- Are subprocessors identified and are change notifications available?

## Identity and access
- Does the service support single sign-on, multi-factor authentication and role-based access?
- How are privileged roles controlled and reviewed?
- How is customer separation maintained?
- Can accounts and access be suspended and removed promptly?

## Model and service management
- Which models and material components are used?
- How are important changes communicated and tested?
- What known limitations and evaluation results are documented?
- How does the supplier reduce unintended disclosure and inappropriate output?

## Human oversight and quality
- Which outputs require human review before use?
- Can users understand limitations and challenge results?
- What testing supports quality, robustness and fairness claims?
- Is a safe fallback available when service quality is insufficient?

## Assurance and incidents
- What assurance reports, certifications and testing evidence are available?
- How are activity records protected and retained?
- What are the incident notification and cooperation terms?
- How are identified weaknesses tracked and corrected?

## Contract, exit and continuity
- Who owns inputs, outputs, configuration and derived data?
- Can data and configuration be exported in a usable format?
- How is deletion verified at termination?
- What continuity and supplier-exit arrangements exist?

## Decision record
- Decision: Approve / Approve with conditions / Pilot only / Reject / More evidence needed
- Conditions:
- Residual risk:
- Decision owner:
- Review date:
- Evidence links:

This checklist is a general governance tool, not legal advice or a guarantee of compliance.