AI Vendor Due Diligence: 12 Questions Before You Sign

Texas, like many states, has been paying closer attention to how organizations deploy and govern AI systems. That's on top of existing obligations — such as data privacy and security rules for healthcare and financial information — that don't disappear just because an AI vendor is doing the processing instead of a person. If your staff pastes patient notes into a chatbot or uploads a client's loan file to summarize it, the compliance exposure is yours, not the vendor's.

It's a common pattern: someone signs up for a free or low-cost AI tool to solve an immediate problem, and six months later nobody can say where that data went or whether it's still sitting in a training dataset somewhere. A short due-diligence checklist up front avoids that mess entirely.

• 1. Where is our data stored, geographically and by provider? Get the specific cloud region and hosting partner, not just "the cloud."
• 2. Is our data used to train your models? Ask for the opt-out mechanism in writing, not a verbal assurance from a sales rep.
• 3. How long do you retain inputs, outputs, and logs? Short retention windows reduce your exposure if the vendor is ever breached.
• 4. Who are your sub-processors? Many AI tools call out to other AI providers behind the scenes — you need the full chain, not just the front-end vendor.
• 5. Do you support SSO and enforce MFA? If a vendor can't integrate with your identity provider, you're stuck managing yet another standalone password.
• 6. Can we get role-based access controls and admin audit logs? You need to know who connected an integration, who exported data, and when.
• 7. What's your breach notification timeline and process? Get this in the contract, not a FAQ page — "we'll let you know" isn't a commitment.
• 8. Do you carry a SOC 2 Type II or equivalent independent audit? Ask for the actual report, not just a badge on the website.
• 9. Can we delete our data on demand, and how is deletion verified? This matters for offboarding and for responding to a data subject request.
• 10. What happens to our data if we cancel? Some vendors purge immediately; others keep backups for months without saying so upfront.
• 11. Does the tool connect to our Microsoft 365 or Google Workspace environment, and with what permissions? An AI add-in asking for full mailbox access is a different risk profile than one reading a single calendar.
• 12. Who owns the output the AI generates? For anything client-facing or regulated, get clarity on IP and liability before you rely on it.

A checklist only works if someone actually reviews the answers before the credit card gets charged. For most small and mid-sized offices, that means routing every new AI tool request through IT or a designated reviewer instead of letting individual departments self-approve software. If you already have a managed IT services provider handling procurement and vendor reviews, this slots into that existing workflow rather than becoming a brand-new process.

Pay particular attention to tools that touch Microsoft 365 — Copilot extensions, third-party add-ins, and connected AI agents all request specific permission scopes, and those scopes deserve the same scrutiny as any other vendor integration. If your organization is rolling out Copilot or similar assistants, it's worth having someone evaluate readiness and permission sprawl before broad deployment rather than after.

Access control deserves its own line item too. Any AI tool that logs in with a shared account, skips MFA, or lacks granular roles is a weak point regardless of how good its privacy policy reads. Pairing vendor due diligence with solid access and credential controls closes a gap that policy documents alone never will.

If you're in healthcare, every AI tool that touches patient information needs to satisfy the same scrutiny you'd apply to any business associate under HIPAA — a vendor's general security page isn't a substitute for a signed BAA and documented data flows. Financial services and lending businesses often face parallel obligations under rules like the FTC Safeguards Rule, which generally call for documented risk assessments of third parties handling customer financial data, AI vendors included.

None of this means you need to build a formal AI governance program before you can use any AI tool. It means the 12 questions above should be answered and documented before the tool goes live, and reviewed again any time the vendor changes its terms, adds new sub-processors, or gets acquired. Ongoing oversight — not a one-time checklist — is really what keeps this manageable, and it's a big part of what our AI oversight and policy work helps clients maintain over time.

If you'd rather not run this review solo, a broader managed IT services partnership or a focused cybersecurity review can fold AI vendor vetting into your existing security processes instead of treating it as a separate project every time a new tool comes up.

What should I ask an AI vendor before signing a contract?

Ask where your data is stored, whether it's used for model training and how to opt out, how long data is retained, who the sub-processors are, whether SSO and MFA are supported, what audit logging is available, and what the breach notification terms are. Get the answers in writing, ideally in the contract itself rather than a sales call.

Do Texas AI regulations apply to small businesses using AI tools?

Texas has been developing expectations around responsible AI use and governance, and the specifics of how any rules apply can depend on your industry and how you use AI. If you're unsure where your business falls, it's worth a conversation with your IT or compliance advisor rather than guessing.

Is a free AI tool riskier than a paid one?

Not automatically, but free tiers often have looser data handling terms, less granular admin controls, and fewer contractual protections than paid enterprise plans. Always check the specific terms rather than assuming price correlates with risk.

Who should approve new AI tools inside a small office?

Ideally, one person or team — IT, compliance, or a managed provider — reviews every new AI tool request before purchase, rather than letting individual employees or departments sign up independently.

What's the biggest mistake businesses make with AI vendors?

Treating the sign-up as a one-time decision. Vendors change their data practices, add sub-processors, and get acquired — ongoing review matters as much as the initial vetting.

If you want a second set of eyes on an AI vendor contract — or help building a repeatable review process for your whole office — start with a free IT assessment and we'll walk through it with you.