Clarify the problem, scope and affected people.
AI SUPPLIER RISK
AI Supplier and Vendor Risk Review
Review AI suppliers before adoption: privacy, security, data retention, model training, subprocessors, contracts and exit planning.
Direct answer
SundAI reviews AI suppliers across data use, retention, model training, security, identity, subprocessors, regulatory roles, operational controls, incident handling and exit options.
Who this is for
Procurement, legal, privacy, security and business owners considering copilots, AI SaaS, model APIs or specialised AI vendors.
What you receive
- Supplier questionnaire and evidence request
- Privacy and data-flow review
- Security, access and contract questions
- Risk decision and follow-up actions
How the work runs
Collect relevant technical and operational evidence.
Assess value, risk, controls and decision points.
Prioritise action and establish ownership.
Frequently asked questions
Is a vendor questionnaire enough?
No. Answers should be tested against evidence, intended use and contractual terms.
Can the engagement be adapted?
Yes. Scope, language, depth and delivery format are adjusted to the organisation, roles and risk context.
Does SundAI claim certification?
No. Work is standards-informed, but SundAI does not claim organisational ISO certification unless a valid certificate explicitly covers the organisation and scope.
Primary standards and sources
These primary sources inform the work. They do not imply certification or endorsement.
Use cases
Related focused pages
Shadow AI Assessment and Governance
Identify unofficial AI use, data exposure and policy gaps without blocking useful innovation. Get a proportionate risk register and action plan.
Secure AI Assistants and RAG Systems
Design secure AI assistants with approved data, least privilege, retrieval boundaries, prompt-injection controls, human review, logging and fallback.
Discuss your needs
Start with a focused conversation about your AI goals, risk and practical next step.