Free template

AI vendor risk assessment template

An AI vendor risk assessment answers 5 things before a firm approves a tool: what the vendor does with your content, how long it is kept, who can see it, what controls you get, and what happens when you leave. This one asks 14 questions under those headings. Answer them for the specific plan you would buy.

Open the templateDownload as text
A desk with a laptop and stationery, seen from above
AI vendor risk assessmentFilled in as an exampleSection 1Section 2Section 3

Before you start

How to use it

AI vendor risk assessment

One per tool, answered for the plan you’d actually buy.

Download as text

Tool: [name] · Plan: [plan] · Assessed by: [name] · Date: [date]

Data use

  1. Does the vendor use our content to train its models on this plan? [Yes / No / Opt-out / Unclear]
  2. Is that written in the terms or a data agreement we can keep? [Link]
  3. Do any people at the vendor review our content, and when? [Answer]

Retention and location

  1. How long is our content kept, and can we shorten that? [Answer]
  2. Where is it stored? [Country or region]
  3. Can we delete it, and does deletion cover backups? [Answer]

Access

  1. If we connect it to email or files, what can it see? [Answer]
  2. Can it act, or only read? [Answer]
  3. Does it follow the permissions people already have? [Answer]

Controls

  1. Do we get single sign-on and central user management? [Answer]
  2. Is there an audit log we can read? [Answer]
  3. Can an admin turn features and connectors off? [Answer]

Leaving

  1. Can we export our content? [Answer]
  2. What happens to our content when we cancel? [Answer]

Decision

[Approved / Approved with limits / Not approved]. Approved for: [uses]. Not for: [uses]. Review again on: [date].

Yours to fill in

Reviewed October 10, 2026 · not legal advice

Questions we get asked

Ask us something else
Do we need this for every tool?

For any tool that will see client or staff information. A tool used only on public material needs less.

Where do we find the answers?

In the vendor’s privacy policy, trust page and data agreement. If you can’t find an answer, ask the vendor in writing.

Is this the same as a security questionnaire?

It is shorter and written for a firm without a security team. A larger organization will want more.

Ask us something else

Goes with this

Your brief · 1 of 3

What brings you here?

See what we’d build first at a firm like yours.

Start with one process.

A working session on how your firm actually runs. You leave knowing the first process worth fixing.

Book with usStart your brief