AI Vendor Due Diligence

AI vendor due diligence is the structured review of an AI provider before its models, tools, or agents are connected to business-critical workflows. It goes beyond a normal software comparison because an AI vendor can shape model access, data processing, runtime behavior, security controls, legal exposure, and part of the technical supply chain. A proper review covers model provenance and versioning, data handling, customer-data retention, rights to prompts and outputs, trade secret exposure, regional availability, failure modes, pricing structure, roadmap stability, and exit or migration rights. It also checks whether the vendor can provide evidence, such as security reports, model cards, attestations, audit logs, or clear subcontractor policies. In practice, due diligence turns these findings into a decision matrix that weighs capability, compliance risk, dependency risk, and operational fit. The process should not stop at procurement. It should define which models may be used in production, which data is off limits, which fallback options exist, and when the vendor assessment must be repeated as products, laws, and pricing change.