AI Vendor Due Diligence Questionnaire: 30-Minute Gate

Image: Unsplash, used under the Unsplash License.

AI Vendor Due Diligence in 30 Minutes (Questionnaire + Scoring Sheet)

TL;DR: Five pass/fail gate questions (training opt-out, DPA, subprocessors with location, SOC 2 or ISO 27001 report, audit log export). Two or more "no" answers on a use case that touches customer data means pause the pilot. Then 8 deep questions, a score of 1 to 3 across 5 areas (13-15 proceed, 9-12 add controls, 8 or below find an alternative), and a renewal check 30 days before the contract ends.

The 30-minute workflow:

Enterprise vendor questionnaires assume a security team. This version assumes a calendar slot, a notes doc and the willingness to say no to a vendor who cannot answer basic data questions in writing. The thresholds and timings are our defaults, not legal requirements. Change them to fit your risk appetite, but write down what you changed.

When to use this

• Evaluating SaaS assistants, hosted model APIs or copilots bundled into tools you already pay for
• Renewing a contract that predates your AI policy
• Comparing two vendors before you standardize a workflow

Pair this page with the AI vendor due diligence checklist so every review stores the same evidence.

The pass/fail gate (5 minutes)

Ask the vendor, or read their public docs, for these binary answers:

1. Is your content excluded from model training by default on the plan you will buy, or can you opt out?
2. Is a Data Processing Agreement (DPA) published or available to sign?
3. Are subprocessors listed, with the location of processing?
4. Is a SOC 2 Type II or ISO 27001 report available, usually under NDA?
5. Can you export prompts and outputs, or at least audit logs, on demand?

If you get two or more "no" answers for a use case that touches customer data, pause the pilot until someone with budget authority accepts the risk in writing.

To see whether the gate needs a sales call, we ran it on October 13, 2026 against the public terms of two large model vendors, OpenAI and Anthropic, using only their own documents.

Image: aipolicydesk.com chart; source: OpenAI DPA, data controls guide and sub-processor list; Anthropic DPA, privacy center and Trust Center, read October 13, 2026.

What the run showed:

• Training. OpenAI says that "as of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)." Anthropic says that "by default, we will not use your inputs or outputs from our commercial products" for training. Both pass, but only for API and business plans. Consumer plans have their own terms.
• DPA. Both publish one. OpenAI's current DPA is marked effective January 1, 2026.
• Subprocessors. OpenAI's list has a "Location of Processing" column. Anthropic's Trust Center shows a location for each entry.
• Reports. Neither SOC 2 report is public. Anthropic's Trust Center has a "Request access" button. That is normal, and it is the reason the gate says "available", not "published".
• Audit logs. OpenAI's API reference has a "List audit logs" endpoint. We did not confirm an equivalent export for Anthropic in the time box, so the sheet says "not checked" rather than "no".

Both pass the gate. The interesting differences show up in the DPA, which is where the deep questions go next.

Deep questions (15 minutes)

Data lifecycle

• What is the default retention for prompts, outputs and embeddings on your plan?
• Who at the vendor can read customer content, and under what process?
• How fast is data deleted after the contract ends, and does the DPA state a window?

Security and reliability

• How are tenants separated at the application and model layers?
• What uptime and latency commitments apply, and what are the remedies?
• How, and how fast, will you be told about an incident that affects your data?

Model behavior

• Who is liable for outputs produced with default settings?
• What safety filters exist, and can they be tuned for regulated domains?

Scoring sheet (copy into your doc)

Rate each area 1 (weak) to 3 (strong). Five areas give a total between 5 and 15.

13-15: proceed with standard contract language. 9-12: proceed with compensating controls such as logging, redaction or human review, and name an owner for each control. 8 or below: find an alternative, or limit the tool to non-production experiments with no customer data.

We changed these bands in October 2026. The earlier version used 9-15, 6-8 and 5 or below, which meant a vendor scoring 2 in every area passed without controls and the bottom band needed a 1 in all five areas.

How to document the decision

1. Store the completed sheet in your policy repository, next to the vendor record.
2. Record the URL and the date of every page you relied on. Vendor terms change without a new contract.
3. Link the vendor record from your AI governance guide.
4. Add a calendar reminder 30 days before renewal to re-run the gate.

Contract red lines: three numbers to find in the DPA

For any AI vendor that touches customer data, production workflows or regulated information, read the DPA for three numbers. Our run found that two large vendors answer them differently.

Screenshot: OpenAI Data Processing Addendum, OpenAI.

Breach notice to you. GDPR gives the controller (you) "not later than 72 hours after having become aware of it" to notify the supervisory authority, while "the processor shall notify the controller without undue delay after becoming aware of a personal data breach." So the vendor's clock and yours are different clocks. OpenAI's DPA says it "will notify Customer without undue delay after becoming aware of any Personal Data Breach." Anthropic's says "without undue delay, but in any event within 48 hours." A fixed cap is easier to plan around. If the vendor offers only "without undue delay", write down how you will hear about an incident, for example a named security contact and a status page subscription.

Subprocessor changes. Under GDPR Article 28(2), a processor working under a general authorization must tell you about intended changes, "giving the controller the opportunity to object to such changes." OpenAI notifies changes "via blog post, notification within the Services or other reasonable means, or via email if Customer subscribes," and you "may object ... within 30 days of receiving notice." Anthropic gives "reasonable notice" and an objection window of "fifteen (15) days." Note the subscription detail: if nobody on your team subscribed to the email list, the notice may be a blog post you never saw.

Deletion after termination. Anthropic's DPA says that "within thirty (30) days of the date of termination or expiration of the Agreement," it will return data on request and delete all copies, with exceptions for legal holds, disputes and misuse. OpenAI's says it will "at Customer's instruction, return or delete Customer Data" after termination, without a stated window. Neither is wrong, but the second one needs an action from you: send the deletion instruction in writing when the contract ends and keep the reply.

If a vendor's standard terms do not cover these three points, ask whether an enterprise agreement or DPA does before you sign.

The annual renewal check

Due diligence at onboarding is a start, and renewal is where a passing vendor can quietly stop passing. AI vendors change training terms, retention and subprocessors between contract dates, and the changes are often scoped to particular plans or models.

Screenshot: Data retention practices for Covered Models, Anthropic privacy center.

Two dated examples from one vendor show why the check matters:

• In 2025 Anthropic changed its consumer terms, "giving users the choice to allow their data to be used to improve Claude." Existing users had "until October 8, 2025" to choose. The change did not apply to "services under our Commercial Terms, including Claude for Work, Claude for Government, Claude for Education, or API use." If some of your staff use personal Pro accounts for work, your business contract does not protect that data.
• Anthropic's Covered Models article, dated September 5, 2026, says "prompts submitted to, and outputs generated by, covered models are retained for 30 days," effective June 9, 2026. It applies to organizations with zero data retention. A team that negotiated zero retention in 2025 now has a 30-day window for one class of model.

At renewal, re-run the five gate questions and check three things:

1. Training and retention terms for your exact plan and models. Read the current page, not your notes from onboarding.
2. Subprocessor list. Compare it with the version you saved. New entries in new locations may need a fresh transfer assessment.
3. Security report date. Our rule of thumb: ask for a report whose period ended within the last 12 months, and ask when the next one is due. A vendor who cannot say when the next report is due tells you something.

The renewal check takes about 15 minutes.

The procurement email template

Send this before the first sales call. A complete written reply before a demo is a good sign of operational maturity.

Subject: Security and data processing questions, [Vendor Name] evaluation

Hi [Vendor contact],

We are evaluating [Vendor Name] for [use case]. Before a trial, we need written answers to a few data handling and security questions.

1. Is our content (prompts, outputs, files) used to train or improve your models on the plan we would buy? If an opt-out exists, is it on by default?
2. Do you have a Data Processing Agreement? Please send the current version or a link.
3. Where is your subprocessor list published, and does it show the location of processing? How do we subscribe to change notices?
4. Is a SOC 2 Type II or ISO 27001 report available under NDA? What period does the latest report cover?
5. Can we export prompt history and outputs, or audit logs, on demand? In what format?
6. What is the default retention for prompts and outputs, and does it differ by model?
7. What is your contractual deadline for telling us about a breach that affects our data, and within how many days of termination is our data deleted?

We aim to decide by [date]. Happy to talk once we have reviewed the answers.

Thanks, [Your name]

Vendors who cannot answer questions 1 to 5 in writing before a trial should not handle customer data. File the reply with the vendor record.

Video: "The New Rules of Vendor Due Diligence in the AI Era", TrustArc, on YouTube.

What vendor responses reveal

The content of the answers matters. So does how they arrive.

Response time. A vendor who answers within 48 hours has security and legal people who can answer questions. A vendor who routes every question through sales, or takes two weeks, is showing you how an incident conversation might go.

Specificity. "We take security seriously" answers nothing. "API inputs and outputs are deleted within 30 days, and our DPA commits to breach notice within 48 hours" answers the question and points to a document you can check.

What they flag first. A vendor who mentions that their subprocessor list changed last quarter, or that a new report is due next month, has a security team that communicates.

What they deflect. Pricing is reasonable to deflect. Retention, training use and DPA availability should not need an enterprise sales conversation, because large vendors publish them.

Image: Unsplash, used under the Unsplash License.

When to escalate beyond 30 minutes

The 30-minute gate is a triage step. Three situations need more time and usually a specialist:

1. Health data. If the tool will handle protected health information for a HIPAA covered entity, you need a business associate agreement, not just a DPA. HHS says a written contract between a covered entity and a business associate "must ... establish the permitted and required uses and disclosures of protected health information." Ask whether the agreement covers the specific AI features you plan to use, and get the answer in writing.
2. Credit and financial reporting. Tools that score credit, screen applicants or feed financial reporting raise FCRA and internal control questions that need counsel, not a checklist.
3. EU AI Act high-risk uses. If the system will be used for hiring, credit, education or access to essential services affecting people in the EU, you may be a deployer of a high-risk system. Article 26(1) requires deployers to use such systems "in accordance with the instructions for use," so you need the vendor's instructions and documentation before go-live. After the 2026 Digital Omnibus, the Annex III obligations apply from 2 December 2027.

For these three, the gate still helps: it removes vendors who cannot answer basic questions. It is the start of due diligence, not the end.

Our take

I expected the gate to be the hard part and it was the easy part. Both vendors passed all five questions from public pages in under ten minutes. The differences that would matter in a bad week (48 hours versus "without undue delay", 15 days versus 30 to object, a 30-day deletion window versus "at your instruction") were only in the DPAs. I would now tell any small team to spend the saved time reading the DPA's breach, subprocessor and deletion clauses, and to subscribe to the subprocessor notices on the day the contract is signed.

How we checked this: we read OpenAI's data controls guide, DPA, sub-processor list and audit log API reference; Anthropic's DPA, Trust Center, privacy center articles and its 2025 consumer terms post; GDPR Articles 28 and 33; HHS business associate guidance; and the AI Act and Digital Omnibus on EUR-Lex. We took the two screenshots and built the comparison table ourselves. Scores, bands and timings are our template defaults. Last reviewed: October 13, 2026.

Related reading

• AI vendor due diligence checklist, the longer version with evidence fields
• AI vendor contract red flags, clauses that shift liability to you
• Governing embedded AI in third-party tools, for AI features that arrive inside tools you already use
• AI tool register template, where the vendor record lives
• Free AI register template, a lighter register format
• GDPR-compliant AI assistants comparison, DPA, training opt-out and EU data residency side by side
• VC AI governance due diligence checklist, what investors ask about your vendors
• AI risk decisioning governance checklist, for vendors used in credit and financial decisions
• California AI Transparency Act checklist, questions on AI content detection features
• EU AI Act guide for small teams, turning vendor gaps into tracked risks
• AI compliance checklist by team size
• AI governance Q3 review template

References

1. OpenAI, Data controls in the OpenAI platform
2. OpenAI, Data Processing Addendum and Sub-processor list
3. Anthropic, Data Processing Addendum and Trust Center subprocessors
4. Anthropic privacy center, Is my data used for model training?, How long do you store my organization's data? and Data retention practices for Covered Models
5. Anthropic, Updates to our Consumer Terms
6. General Data Protection Regulation, Articles 28 and 33
7. U.S. Department of Health and Human Services, Business Associate Contracts
8. EU AI Act, Article 26, and the Digital Omnibus on AI