# Third-Party AI Vendor Scenario

Read this file for procurement, diligence, or review of vendors that provide AI capabilities, AI infrastructure, models, embedded AI features, or AI-enabled services.

## Typical Examples

- SaaS vendors with AI features
- Foundation-model or API providers
- Legal, HR, support, or analytics vendors using AI
- Vendors that process company or customer data with AI

## Typical Risk Areas

- Vendor prompt or data reuse
- Unclear subprocessors or data-transfer paths
- Unclear allocation of responsibilities
- Model or feature changes without notice
- Weak audit rights or weak incident notice commitments
- No continuous improvement

## Required Questions

- What data will the vendor receive, store, or process?
- Does the vendor claim rights to retain prompts, outputs, or training data?
- What subprocessors, hosting regions, and transfer mechanisms are involved?
- What documentation exists for security, privacy, testing, and model governance?
- What notice is given for model updates, incidents, or material control changes?
- What contractual owners inside the company must review or approve the arrangement?
- Is there a DPA, privacy addendum, or equivalent contract language?
- Is there a current subprocessor list?
- What audit rights, audit reports, certifications, or control attestations exist?
- What testing, red-team, monitoring, and incident response documentation has the vendor provided?
- What disclosures or instructions will end users receive if the vendor AI is embedded in a workflow or product?
- Has an AI impact assessment or vendor risk assessment been completed?

## First Intake Set

Use this grouped intake set first when facts are missing:
- What vendor and AI capability are being reviewed?
- What data will the vendor receive, retain, or use for training?
- Is there a DPA, subprocessor list, and transfer or hosting information?
- What audit rights, certifications, or control materials exist?
- What incident, model-change, and notification commitments exist?
- What internal owners, approvals, and assessments exist today?

## Review Focus

- Data-use rights and retention
- Security, privacy, and transfer controls
- Vendor testing and monitoring representations
- Contract allocation of responsibilities
- Incident, audit, and change-notification rights