AI vendor contract and due-diligence checklist for generative AI

Overview

Questions and contract terms for evaluating model providers, API vendors, copilots, and embedded AI before purchase or deployment.

What to review

1. Identify the model, provider, subprocessors, hosting regions, intended uses, prohibited uses, customer role, regulatory classification, and material downstream dependencies.
2. Define whether prompts, uploads, outputs, feedback, logs, and metadata may be retained, reviewed, used for training, disclosed, or transferred—and for how long.
3. Allocate confidentiality, privacy, security, access, deletion, breach, incident, audit, regulatory cooperation, and evidence duties.
4. Address input rights, output usage, third-party claims, copyright, indemnity, defense control, liability caps, and exclusions based on risk.
5. Require documentation on capabilities, limitations, evaluations, bias, safety, human oversight, AI-content marking, model changes, and known incidents.
6. Set service levels, suspension rights, price/model changes, portability, export, deletion certification, transition help, termination, and survival.

What to do next

Attach the intended-use and data-flow description to the contract so technical reality and legal terms stay aligned. Do not rely solely on a vendor badge or model card; test the system for your use and require notice before material model, policy, subprocessor, or data-use changes.

Official sources and further reading

• Artificial Intelligence Risk Management Framework: Generative AI Profile — National Institute of Standards and Technology
• Guidelines on obligations for General-Purpose AI providers — European Commission
• Transparency obligations under Article 50 of the AI Act — European Commission