Prepare an AI supplier due-diligence question pack

Purpose and fit

Use this before a supplier selection, renewal or material expansion of an AI service. Follow the organisation’s purchasing process. Evaluate the exact product, account tier and proposed arrangement; evidence about another offering may not apply. This is organisational guidance, not legal advice or a recommendation to accept contractual terms.

Before you start

Start with the actual use-case description and supplier materials you are authorised to share. Adapt the pack to the named product and tier; no complete supplier dataset is needed. Omit irrelevant topics and retain document dates and scope.

If your available data uses different fields or terminology, adjust the prompt to match it. State the intended decision, audience and acceptance criteria; ask for essential missing information, and label any non-essential working assumptions. Do not fill factual gaps with invented information.

Required inputs

• The intended tasks, users, operating locations, expected volumes and consequences of service failure.
• The product/tier, integrations, commercial offer and authorised supplier documents.
• Internal purchasing, technical, data, security and legal review requirements.
• A named service owner, relevant specialists and the decision date allowing time to resolve questions.

Practical workflow

1. Write the use-case brief and separate mandatory requirements from preferences. Explain the operating assumptions behind each requirement so the supplier can answer for the intended use rather than provide generic marketing material.
2. Review available documents first. Record source, date, product scope and missing detail. Treat supplier assertions, contractual commitments and observed test results as different evidence types.
3. Build a short question pack around unresolved requirements. Request a specific document, demonstration or bounded answer for each question, and explain why it matters. Avoid asking for customer data, credentials or confidential information you do not need.
4. Route answers to the relevant internal owners. Technical staff check integration and operational claims; procurement checks commercial dependencies; qualified legal, privacy or security reviewers examine matters within their remit.
5. Reconcile conflicting or qualified answers. Record what remains unanswered and the consequence for the proposed use. Where permitted, plan a safe evaluation to test relevant behaviour without sending unapproved organisational data.
6. Prepare a decision packet with evidence, gaps and available options, including a narrower scope or deferral. Keep the authorised selection, contracting and purchase decisions separate from the questionnaire. Set review triggers for renewal, service changes and material new uses.

Expected output

Expect tailored unresolved questions and a response tracker, not supplier certification, a contract interpretation or a purchase decision.

A question pack and response tracker. Use these topic questions as a starting point, selecting relevant topics:

Product fit: Which capabilities and usage limits apply to this tier, and what cannot be configured? Operations: How are outages, incidents, support requests and material service changes communicated? Control: Which identity, access, logging and integration controls are available for this setup? Data: Which applicable documents explain processing, retention, provider access and service partners? Commercial: What charges, minimum commitments, usage overages and renewal conditions apply? Exit: What can be exported, in which usable format, at what cost, and what happens when the service ends?

Tracker fields: Requirement/question: [ ]. Why it matters: [ ]. Supplier answer: [ ]. Source/date/product scope: [ ]. Evidence type: [ ]. Qualification or gap: [ ]. Internal reviewer: [ ]. Follow-up needed: [ ]. Decision dependency: [ ]. Next owner/date: [ ].

Ask the appropriate reviewer to interpret applicable terms; do not turn a supplier’s “yes” into a blanket approval.

Human checks

The business owner confirms fit and service-failure consequences. Specialists verify that documents cover the actual arrangement and resolve material inconsistencies. Procurement checks the complete price basis and exit dependencies. Share only information authorised for the supplier and intended recipients; sanitise internal notes before preparing external questions.

Limitations

A completed questionnaire cannot establish security, legal compliance or future service reliability. Supplier evidence can become outdated and demonstrations may not represent production conditions. This proposed process does not replace qualified contract review, required assurance work or the organisation’s purchasing authority.

Responsible use

Use relevant data that exists or that you provide, with accuracy and completeness sufficient for the task. Different AI models and versions may produce different results, and responses may vary between runs. You are responsible for checking and validating the output against your own requirements, source information and acceptance criteria before relying on it.