AI VENDOR RISK ASSESSMENT
One per tool, answered for the plan you’d actually buy.

Tool: [name] · Plan: [plan] · Assessed by: [name] · Date: [date]

### Data use

1. Does the vendor use our content to train its models on this plan? [Yes / No / Opt-out / Unclear]
2. Is that written in the terms or a data agreement we can keep? [Link]
3. Do any people at the vendor review our content, and when? [Answer]

### Retention and location

1. How long is our content kept, and can we shorten that? [Answer]
2. Where is it stored? [Country or region]
3. Can we delete it, and does deletion cover backups? [Answer]

### Access

1. If we connect it to email or files, what can it see? [Answer]
2. Can it act, or only read? [Answer]
3. Does it follow the permissions people already have? [Answer]

### Controls

1. Do we get single sign-on and central user management? [Answer]
2. Is there an audit log we can read? [Answer]
3. Can an admin turn features and connectors off? [Answer]

### Leaving

1. Can we export our content? [Answer]
2. What happens to our content when we cancel? [Answer]

### Decision

[Approved / Approved with limits / Not approved]. Approved for: [uses]. Not for: [uses]. Review again on: [date].

---
From Milo Works: https://www.miloworks.ai/templates/ai-vendor-risk-assessment
Reviewed October 10, 2026. A starting point, not legal advice.