Checklist: vetting AI vendors and AI features before use
For: Procurement, IT and data protection selecting AI services
Updated: 2026-10
Before using an AI service, clarify ten questions: is your data used for training, where is data processed, how long are inputs stored, is there a data processing agreement, how is security evidenced, what is your role under the AI Act, what documentation does the vendor provide, how are model changes announced, how are costs capped and how do you exit.
AI features enter companies in two ways: as standalone tools and as new features in software already in use. In both cases data goes to a vendor, often with third-country links and sometimes with usage rights nobody read at signup.
This checklist complements general software vendor selection with the questions that additionally matter for AI services. It applies to API providers of language models as well as SaaS tools with AI features.
The checklist
- 01
Clarify training on your data
Check whether inputs and outputs are used to train or improve the vendor’s models and whether that can be excluded contractually. For consumer accounts the default is often different from business or API access.
Done when: The data use rule is recorded in writing, and training is excluded for company data.
- 02
Processing location and sub-processors
Establish where data is processed and stored, whether processing in the EU or Switzerland is possible and which sub-processors are involved. For third countries, determine the basis for the transfer.
Done when: Processing locations, sub-processors and the basis of each disclosure abroad are documented.
- 03
Retention of inputs and outputs
Clarify how long prompts, files and outputs are stored by the vendor, for example for abuse monitoring, and whether shorter or no retention can be agreed.
Done when: The retention period is known and compatible with your own deletion rules.
- 04
Contract and data processing
Conclude a data processing agreement where personal data is processed, and review the terms for rights to inputs and outputs, liability and confidentiality.
Done when: A signed contract exists, and the provisions on rights and confidentiality are known.
- 05
Have security evidenced
Request evidence of information security, such as certifications or audit reports, and check access control options: single sign-on, roles, logging, API key management.
Done when: Security evidence is on file, and access is managed via company accounts with defined rights.
- 06
AI Act role and documentation
Determine whether you act as deployer of a third-party system or become provider through your own modifications and marketing. Clarify what information the vendor supplies on the system’s purpose, limits and risks, especially if use in a high-risk area is possible.
Done when: The role is recorded per application, and the vendor’s documentation is filed.
- 07
Model changes
Check whether the vendor announces model changes and deprecations in good time and whether a model version can be pinned. Unplanned changes can alter a feature’s quality and behaviour.
Done when: The rules on model versions and notice periods are known, and an evaluation set is ready for changes.
- 08
Cost and exit
Understand the pricing model and limits, set up budget alerts and quotas. Clarify the exit in advance: export of data and configuration, dependence on proprietary features and a possible alternative.
Done when: Cost limits are active, and an exit scenario with an export route is described.
Common mistakes
- —Consumer accounts for company data, where training is active by default.
- —AI features in existing software switched on without review.
- —EU processing for the data, but support or monitoring from third countries nobody considered.
- —No pinned model, so a feature’s behaviour changes unnoticed after a vendor update.
- —No cost limits until the first large invoice arrives.
What this checklist does not cover
- —This checklist is not legal advice and does not replace a contractual review in the individual case.
- —It covers vetting the vendor, not the risk assessment of your own use case; that requires an AI inventory and classification under the AI Act.
- —Regulated sectors have additional requirements for outsourcing and third parties, for example under FINMA rules or DORA.
- —AI vendors’ offerings and terms change often; repeat the review when they do.
Parent service: EU AI Act & Compliance Advisory
Matching offers
AI integration strategy
An AI integration strategy establishes where artificial intelligence creates genuine value in your organisation — and where it does not. It identifies use cases, assesses feasibility and benefit, prioritises, and delivers a plan that builds in AI Act conformity from the start rather than retrofitting it.
Building AI governance
AI governance gives your handling of AI a repeatable structure: an AI policy, a risk inventory, clear roles and a lifecycle process — oriented to ISO/IEC 42001. The result is the organisational backbone that produces the records the AI Act requires, audit-ready and durably.
FAQ
Do AI vendors train on our data?
That depends on the offering. Many business and API offerings exclude training; consumer accounts often do not. What counts is the written rule in the contract or terms.
Do we need a data processing agreement with the AI vendor?
Yes, as soon as personal data is processed on your behalf. The major vendors provide such agreements for business customers.
Are we a provider under the AI Act if we use a third-party model?
Usually you are a deployer. You become a provider if you offer a system under your own name, substantially modify it or use it for a high-risk purpose it was not intended for.
How often should the review be repeated?
At contract renewals, on significant changes to terms or models and at least on a fixed cycle, such as annually.
More checklists
Checklist: using AI safely in law firms and fiduciary offices
AI can save law firms and fiduciary offices a lot of time but touches professional secrecy and data protection directly. Use becomes safe with clarified secrecy duties, tools with a contract and no training on client data, minimised data, checking of every statement and citation, transparency towards clients, and a policy with training.
Checklist: website relaunch for law firms and fiduciaries
A law firm relaunch succeeds when practice areas and people are clearly structured, old addresses are cleanly redirected, content is factual under professional rules, the contact form is designed for confidentiality, structured data and local details are correct, and indexing and enquiries are measured after launch.
EU AI Act conformity: a checklist for the first pass
A workable first pass through the EU AI Act has six parts: know which AI runs in the business, determine your role for each system, classify under Article 6, check transparency duties separately, ensure AI literacy, and file everything so it can be found under scrutiny.