AI vendor due diligence checklist — before you sign

Legal entity name and jurisdiction; ownership structure (PE, subsidiary, startup runway); years operating in stated category; financial statements or credit references if policy requires; professional indemnity and cyber insurance certificates; bankruptcy or material litigation disclosure; key person dependency for small vendors.

For early-stage AI vendors, assess continuity plan if acquired or shut down—export and migration clauses matter more.

Verify marketing claims: "global HQ" addresses, certification badges, and client logos—reference checks validate substance.

SOC 2 Type II or equivalent (scope and date); ISO 27001 if claimed; penetration test summary and remediation status; SSO/SAML support; encryption at rest and in transit; access control model; vulnerability disclosure programme; incident response process and notification SLAs; employee background checks if required by your policy; secure SDLC for vendor-built models and integrations.

Map certifications to your jurisdiction—EU AI Act readiness—/resources/guides/eu-ai-act-enterprise-readiness—GDPR—/resources/guides/ai-data-privacy-gdpr-ai—sector rules as applicable.

Request evidence, not checkbox answers. Sample redacted audit report beats a marketing trust page.

Data residency options and default regions; training use of customer data (opt-in/out); retention and deletion timelines; subprocessors list including foundation model providers; cross-border transfer mechanisms; DPA availability and negotiation history; right to audit or receive third-party audit summaries; logging of prompts/outputs and who can access logs.

Clarify whether vendor staff review prompts for quality improvement. Regulated clients often prohibit or restrict such review.

Proof environments must not silently use production data. Diligence should confirm environment separation.

Model sources (own, partner, open-weight); update and rollback process; versioning communicated to customers; accuracy/limitation documentation; bias and safety testing summary for customer-facing features; human oversight features in product; API rate limits and downtime history; support for customer-owned evaluation sets.

Ask for incident examples: model update caused quality regression—how was it handled?

For consulting vendors: who builds, who operates after handover, and whether they resell licences with undisclosed incentive.

Pricing model and inference pass-through; renewal auto-terms; termination notice; data export formats and assistance; IP ownership for custom work; liability caps and indemnities—legal review; SLA credits; subcontractor flow-down; change-of-control clause; assignment restrictions.

Align contract acceptance with /resources/guides/ai-rfp-checklist commercial section. Exit drill: request sample export during diligence for finalists.

Document diligence outcomes in vendor risk register with review date—vendors change subprocessors and models frequently.

Reference calls with integration leads—not only executive sponsors. Questions: Did go-live match demo? Logging and override as sold? Hidden costs? Support quality after hypercare? Would they buy again for same use case?

Validate proof claims from RFP stage against production references. Discrepancies go back to vendor before sign.

For AI consultancies: ask for redacted sample deliverables and examples of stop recommendations—not only success stories.

Arcloops provides references when NDAs allow and expects buyers to verify delivery claims against /how-we-engage.

Tier 3 vendors should receive on-site or video walkthrough of logging and admin consoles—not questionnaire answers alone. Screenshots can be staged; live navigation reveals retention and access gaps.

Due diligence is not a one-time PDF archive. Subscribe to vendor status pages; track subprocessors list changes; re-run lightweight DD when the vendor ships a new foundation model default or changes data retention terms.

Quarterly, sample logs with security: who accessed prompt history, whether retention matches contract, whether deleted data requests were honoured in SLA.

For consulting partners, confirm insurance renewal annually and whether delivery team matches proposal key personnel—bait-and-switch teams are a common enterprise complaint.

Maintain a vendor risk register ranked by data tier and blast radius. Tier 3 vendors get executive review when incidents occur; Tier 1 may only need ticket tracking.

Arcloops expects reciprocal monitoring from clients and provides updated subprocessors and security summaries when material changes occur.

Document a four-hour exit drill before sign for Tier 3 vendors: export sample dataset, rotate API keys, and confirm deletion certificate timeline—vendors that stall in drill should not receive production data.

Most AI vendors rely on foundation model providers you may not contract with directly. Diligence must chain: your vendor's DPA, their subprocessor list, and the model provider's terms affecting training use, retention, and abuse monitoring.

Ask whether prompts are used for model improvement by default and how to opt out in production. Ask geographic routing—which region handles inference when your users work in Dubai, Dhaka, or London.

For open-weight models hosted by the vendor, ask patch cadence and security response when CVEs publish. Custom fine-tunes need data deletion guarantees if you terminate—weights may retain memorised samples.

Counsel should review the full chain, not only your direct vendor MSA. Arcloops documents subprocessors we use in client engagements and notifies clients when the chain changes materially.

Maintain a subprocessor diff log—what changed, when, and whether your DPA required notification. Missing notification is a contract breach independent of product quality.