Modern software products increasingly depend on external AI services. A SaaS application might integrate a large language model through an API, use an external computer vision service or rely on a third-party AI platform for automated decision-making.
These integrations can accelerate development, but they also introduce dependencies that engineering, security and compliance teams need to understand.
What happens to customer data sent to an external model? Who is responsible for maintaining the AI system? How are model updates communicated? What happens if the vendor changes its data processing practices?
These are not just procurement questions. They are important parts of AI vendor risk management.
A structured AI vendor due diligence questionnaire helps organisations collect the information needed to evaluate these dependencies before adopting an AI solution.
1. Start by Understanding the AI Vendor's Role
Before evaluating an AI supplier, identify what the supplier actually provides.
For example, a vendor might:
- Develop and supply its own AI model.
- Provide access to a third-party foundation model.
- Integrate AI capabilities into an existing SaaS application.
- Host or operate an AI system for customers.
- Provide infrastructure used to develop or deploy AI applications.
These distinctions matter because the supplier's responsibilities depend on its actual role and activities.
Under the EU AI Act, the definitions of provider and deployer are particularly important.
A business using an external AI service may have responsibilities as a deployer. However, the contractual label assigned to a party does not by itself determine its regulatory role.
Teams should therefore document the AI supply chain, intended purpose and responsibilities of the relevant actors.
2. Evaluate the AI System Before Integration
An AI vendor assessment should begin with the technology itself.
Engineering and procurement teams should ask:
- What is the intended purpose of the AI system?
- Which models and external APIs does it use?
- Does it rely on other third-party providers?
- What are its known technical limitations?
- How frequently are models updated?
- Can the vendor explain significant changes to system functionality?
This information helps teams understand whether the proposed solution is appropriate for the intended use case.
It also creates a starting point for assessing the system under applicable regulatory requirements.
3. Review EU AI Act Requirements
For organisations operating in the European market, the EU AI Act should be considered during AI supplier assessments.
Regulatory responsibilities depend on factors such as the system's classification, intended purpose and the activities performed by each organisation.
A useful assessment should examine:
Risk classification: Has the system been assessed against the applicable EU AI Act classification rules?
Provider and deployer responsibilities: Which obligations apply to the supplier, and which apply to the organisation using the system?
Technical documentation: Can the vendor provide relevant information about the system and its operation?
Changes to the system: Could modifications to the system or its intended purpose affect regulatory responsibilities?
Human oversight: What mechanisms are available to support appropriate human involvement?
For high-risk AI systems, the applicable requirements can be more extensive. Businesses should assess their actual regulatory position rather than relying on a supplier's general compliance statement.
4. Examine Data Protection and GDPR Responsibilities
AI applications frequently process information supplied by users, employees, customers or business partners.
Before integration, establish what information the vendor collects and how it is handled.
Some important questions include:
- Does the system process personal data?
- Is customer information used to train or improve models?
- Where is the information stored?
- Which subprocessors have access to the data?
- Are international data transfers involved?
- How long is the information retained?
GDPR responsibilities should also be reviewed.
For example, GDPR Article 28 establishes requirements for controller-processor relationships. Article 32 addresses appropriate technical and organisational security measures.
Where relevant, businesses should review Data Processing Agreements, subprocessor arrangements and applicable transfer safeguards.
A good AI vendor data protection assessment should examine actual processing activities rather than relying only on statements in a vendor's privacy policy.
5. Assess Technical Security Before Connecting External AI Services
AI integrations introduce security considerations that development teams should evaluate before production deployment.
Consider the following areas:
API security: How are API credentials stored, rotated and protected?
Access management: Which users and services can access the AI integration?
Data transmission: Is sensitive information protected during transmission?
Logging: What information is recorded in application and model logs?
Vulnerability management: How does the vendor identify and address security weaknesses?
Incident response: How quickly will customers be informed about relevant security incidents?
For SaaS companies, these questions should also be connected to existing security and vendor management processes.
6. Check Model Transparency and Change Management
An AI system is not necessarily static after procurement.
The vendor may change the underlying model, introduce new features, modify data processing practices or discontinue an existing model version.
These changes can affect application behaviour and operational risk.
Ask vendors:
- How are model updates communicated?
- Are customers informed about material changes?
- Is technical documentation maintained?
- Can the organisation test significant changes before deployment?
- Are model limitations and known risks documented?
Development teams should also maintain internal records of the AI components used in their applications.
This makes it easier to understand dependencies and assess the impact of changes.
7. Build an Evidence-Based Vendor Assessment Process
A questionnaire is useful, but collecting answers alone does not complete due diligence.
Organisations should verify important responses using supporting documentation.
A practical AI vendor assessment checklist can include:
- Vendor and AI system information.
- Intended purpose and technical functionality.
- EU AI Act roles and risk classification.
- GDPR and data processing arrangements.
- Security controls and incident procedures.
- Model transparency and human oversight.
- Contracts and supporting documentation.
After collecting the information, teams should identify missing evidence, evaluate potential risks and document approval decisions.
The assessment should also be revisited when a vendor changes its model, processing activities or service capabilities.
How Can Teams Organise AI Vendor Due Diligence?
As organisations adopt more AI tools, maintaining vendor information across spreadsheets, emails and separate document repositories becomes difficult.
This is where AI compliance software can support the process.
A structured compliance workflow can help teams:
Maintain a central AI inventory.
Record AI system classifications.
Map relevant regulatory obligations.
Organise technical and compliance documentation.
Track supporting evidence.
Maintain visibility into AI governance activities.
AnnexOps supports these AI governance workflows by helping organisations organise AI inventories, risk classification, regulatory obligation mapping and compliance evidence.
For a practical set of assessment questions, see the AI Vendor Due Diligence Questionnaire: What to Ask.
The guide includes 35 questions covering AI system background, EU AI Act responsibilities, GDPR, security, training data, human oversight, incident management and supplier governance.
Final Thoughts
Integrating an external AI service is also a decision about trust, data handling, security and regulatory responsibilities.
Engineering teams should understand the models and APIs they depend on. Security teams should evaluate technical safeguards. Legal and compliance teams should assess applicable obligations and contractual responsibilities.
A structured AI vendor due diligence process brings these activities together.
The objective is not simply to approve a supplier. It is to maintain visibility into third-party AI dependencies and manage the risks throughout the vendor relationship.
Top comments (0)