AI vendor due diligence

Review AI vendors before they create compliance risk.

Check data use, training rights, DPA, subprocessors, processing region, model transparency, EU AI Act, GDPR, DPDP, and security evidence signals before procurement approval.

Free output

Risk level
Documents to request
Approval next steps

Free AI vendor risk check

Answer once before approving an AI vendor.

Uses rule-based scoring plus Claude Haiku for a short risk summary when Anthropic is configured.

0/10

Vendor name

Use the product or vendor name your team wants to approve.

What does the AI tool do?

Describe the workflow, department, and output the vendor provides.

Will personal data be processed?

Include customer, employee, applicant, lead, patient, student, or user data.

Whose data may enter the tool?

Pick the closest group.

Can the vendor use your data for model training?

Check the vendor terms, DPA, privacy policy, or enterprise agreement.

Are EU or India users, customers, employees, or outputs affected?

This helps map EU AI Act, GDPR, and DPDP signals.

Does the vendor provide DPA and security documents?

Look for DPA, subprocessors list, SOC 2/ISO report, security whitepaper, and retention terms.

Where is data processed or stored?

Region evidence matters for transfers and vendor controls.

Are subprocessors disclosed?

AI vendors often use model, hosting, logging, support, and analytics subprocessors.

Could the tool affect employment, education, credit, healthcare, biometrics, law enforcement, or access to essential services?

These use cases can create higher AI governance and legal review needs.

Free result

Procurement-ready first view

The free result tells you the risk level, what to request, and what to do next. Paid workspace stores the vendor record and generates the due diligence pack.

Complete the vendor intake to see the result.

You will get documents to request, red flags, and next steps before moving into the paid vendor workspace.

Loading CompliClear

Home