The AI Vendor Due Diligence Checklist We Use Now

A client almost signed with an AI vendor whose sales deck described their model as trained on anonymized, aggregated data with strong privacy guarantees. A round of actual due diligence, not just reading the deck, surfaced that the anonymization approach they described was substantially weaker than implied, and a determined adversary with access to auxiliary data could plausibly re-identify individuals in the training set. That near-miss is why we built a checklist that now runs before any AI vendor contract.

What the checklist actually asks

The questions aren't exotic — they're mostly things a sales deck won't volunteer unless you ask directly, and a vendor confident in their practices should be able to answer specifically rather than in marketing language.

• Exactly what data was the model trained on, and what's the actual anonymization or privacy-preservation method used, described technically, not just labeled 'anonymized.'
• What happens to our data if we stop being a customer — is it deleted, retained for 'model improvement,' or ambiguous?
• Can they produce any third-party audit or certification of their stated privacy or bias practices, or is it self-reported?
• What's their incident response process if the model produces a harmful or clearly wrong output in production?
• Do they allow us to run our own bias or accuracy evaluation on our specific use case before committing, or only accept their published benchmarks?

A vendor's sales deck describes their product. Due diligence is the only thing that tells you whether the deck and the actual system agree with each other.

What changed once we made it a standard step

A few vendors have visibly bristled at some of these questions, which is itself useful information — a vendor confident in their practices generally answers specifically and quickly, while a vague or defensive answer to "describe your anonymization method technically" tells you something a polished sales deck never would. The checklist has killed two vendor relationships outright before a contract was signed, which is a far better outcome than discovering the same gap after the data's already shared.

None of this is about assuming vendors are acting in bad faith — most aren't. It's that a sales process is optimized to get a deal signed, and due diligence is the only part of the process optimized to find out what you're actually signing up for before it's too late to walk away cheaply.