AI due diligence is the check you run before you commit to an AI vendor, acquire a company that relies on AI, or let a client rely on AI-produced work. This checklist covers the vendor, the data, the model and the contract.
1. The vendor
- ☐ Company identity, ownership and location confirmed.
- ☐ Financial stability and length of time in business considered.
- ☐ Customer references or case studies in your sector.
- ☐ Security certifications (SOC 2, ISO 27001) and AI standards (ISO/IEC 42001) checked.
- ☐ Any public incidents, regulatory actions or lawsuits reviewed.
2. Data
- ☐ What data goes in, and whether it trains the model.
- ☐ Retention, deletion and data location.
- ☐ DPA in place; GDPR, HIPAA or sector rules covered.
- ☐ Sub-processors listed and acceptable.
3. The AI system
- ☐ Which model is used, and whether it can change without notice.
- ☐ Evidence of testing for accuracy, bias and safety.
- ☐ Limits documented (what it should not be used for).
- ☐ Human oversight options and logging.
- ☐ EU AI Act classification for your use (prohibited, high-risk, transparency, minimal).
4. Legal and IP
- ☐ Ownership of outputs and licence to inputs.
- ☐ IP indemnity offered, and its limits.
- ☐ Training data provenance and copyright position stated.
- ☐ Liability caps, warranties and termination rights acceptable.
5. Operations
- ☐ Uptime, support and incident notification commitments.
- ☐ Data export and exit plan.
- ☐ Internal owner and review date assigned.
Use the AI vendor questionnaire to collect the answers, and the AI procurement checklist when you buy.