AI vendor due diligence in practice
Aranv’s short list of questions to ask an AI vendor: where does our data go and is it used for training, which models and subprocessors sit behind the product, how is accuracy measured on cases like ours, what happens when the model changes, who owns outputs and settings, and how do we leave?
Match depth to risk. A writing assistant for marketing needs a short review. A product that reads customer records, makes decisions about people or acts inside your systems needs the full list, plus a check against your AI acceptable use policy.
Security questions. Ask how the vendor handles prompt injection, access control, logging and incidents. The CISA and FBI Secure by Demand guide includes questions for software makers that apply to AI products too, and our AI agent security checklist covers agent-specific risks.
AI vendor due diligence in four parts
What to ask, and why
- 01 Data and privacy Storage location, retention, training use and the subprocessors involved.
- 02 Models and changes Which models power the product and how upgrades are tested and announced.
- 03 Quality and security Accuracy evidence on your cases, security practices and incident handling.
- 04 Terms and exit Pricing basis, ownership, support levels and how your data comes back.
Ask for answers in writing. What a salesperson says on a call is not a contract term.
AI procurement questions by topic
Group your questions by topic so the answers from different vendors line up side by side.
Data use
Is our data used to train any model? Where is it stored and for how long? Can we have it deleted on request?
Model dependency
Which third-party models do you rely on? Who is told when a model changes, and how is that change tested before release?
Accuracy evidence
Can we run a trial on our own examples? How do you measure errors, and what happens when the product gets something wrong?
Commercial terms
Is pricing per seat, per use or per token? What triggers an increase? Which support response times are written into the contract?
Questions about your data
Data terms decide most of the risk. Ask the vendor to point to the contract clause, not the marketing page, for each answer. Watch how prompts and outputs are treated, since some terms handle them differently from uploaded files, and ask about logs kept for abuse monitoring.
What we do
- Training use of prompts and files
- Storage region and retention period
- Subprocessors and model providers
- Deletion on request and at exit
- Vendor staff access to your data
Questions about support and exit
An AI product becomes part of daily work quickly, so plan how you would leave before you start. Ask how configuration, prompts, knowledge bases and conversation history can be exported, in what format, and how long the vendor keeps your data once the contract ends.
What we do
- Support hours and response times
- Export of prompts and settings
- Knowledge base and history export
- Data deletion after termination
- Notice period for product changes
How we approach a project
Builders as well as products. When the vendor is building something custom, add questions about code ownership, testing practice and support. Our guide to choosing an AI development company covers that side, and build vs buy AI helps decide which route fits.
Get answers you can compare. Send the same questions to each vendor and score the replies in one table. For a second reader, our AI consulting team can go through vendor answers with you; a 30-minute conversation on your shortlist can be booked from the Contact page.
How we work
- Written answers, not demos
- Evidence on your own cases
- Exit terms before entry
Our Process
-
Rank the risk
Decide how sensitive the data and decisions are, which sets how deep the review needs to go.
-
Send one question set
Give every shortlisted vendor the same written questions and the same deadline.
-
Trial on your examples
Run the product on a sample of your real cases and have your staff score the results.
-
Check the contract
Confirm that the answers on data, models, support and exit appear in the signed terms.
How Aranv helps you assess vendors
A second reader for answers
We read vendor replies alongside you and point out vague answers, missing contract terms and claims worth testing before you commit.
Trials on your own cases
We help set up a short trial with your real examples and a scoring method that your staff agree with in advance.
The same questions for our work
When we are the vendor, we answer this list in writing too: data handling, model providers, testing, ownership and how you would move on.
Technical checks where needed
For products that connect to your systems, we review the integration method, permissions and logging the vendor proposes.
Ready to act on this guide?
Ask our team in a 30-minute conversation.
Or see how we build it: Explore all services
AI vendor due diligence FAQs
-
What are the most important questions to ask an AI vendor?
Whether your data is used for training, where it is stored, which models and subprocessors are involved, how accuracy is measured on cases like yours, how model changes are handled, who owns outputs, and how you get your data back if you leave.
-
How do we check an AI vendor’s accuracy claims?
Ask for a trial on your own examples rather than relying on published figures. Agree beforehand what counts as a correct result, and have the staff who do the work score the outputs.
-
Should AI vendors sign a data processing agreement?
If the product handles personal data, yes. The agreement should cover purpose, retention, subprocessors, security measures and deletion. Ask whether prompts and outputs fall under it, not only the files you upload.
-
What should we ask about AI pricing?
Ask what the bill is based on, such as seats, usage or tokens, what happens at higher volume, how much notice comes before a price change, and whether you can set spending limits.
-
What if the AI vendor changes its underlying model?
Ask how much notice you get, whether you can stay on the current version for a period, and what testing the vendor runs before switching. A new model can change answers even when nothing else in the product changes.
Let’s talk about your next step
Contact Aranv to discuss your workflow, current tools, and goals. Meet with our team or send an inquiry.
Book a meeting with our team
Choose an available date and time for a 30-minute conversation about your project.
Tell us about your project
Share a few details so we can discuss a useful next step.
Prefer email? sales@aranv.com