AI Vendor Due Diligence & Procurement Check

Buying an AI tool is not like buying standard software. The supplier may process personal data, use your inputs to train models, rely on sub-processors overseas, or change model behaviour without notice. Under UK GDPR Articles 28 and 32 you remain responsible for personal data handled on your behalf, and you must have a written contract with any processor and assess its security. The Data (Use and Access) Act 2025 also reshapes the rules on automated decision-making, which matters if the tool influences decisions about customers or staff.

Contract risk matters too. Many AI vendors offer standard terms that cap liability, disclaim accuracy and give the supplier broad rights over your content. Under the Consumer Rights Act 2015 and the Unfair Contract Terms rules some of that may not bind consumers, but business-to-business terms are usually enforceable as written. Larger customers are also starting to ask suppliers about AI governance in procurement questionnaires. A short, repeatable due diligence process protects you from data leaks, IP disputes and unexpected bills.

This check helps you assess whether your AI supplier vetting covers data protection, contract terms, security and accountability, with practical steps to tighten any weak spots.