Third-party and vendor AI

Overview

Buying AI does not buy you out of responsibility. Ask vendors about data use, testing, security, incident and change notice, and exit before you sign, and keep checking after you buy because vendors change models.

Key risks

• Model changes without notice
• Vendor trains on your data
• Unclear responsibility
• Lock-in

What to do now

• Ask the sixteen due diligence questions.
• Put incident notice, change notice, data use and exit in the contract.
• Monitor after purchase.
• Plan how you would leave.

Questions to ask

• Does the vendor use our data to train its models?
• What testing and security evidence can they show?
• How and when will they tell us about incidents and model changes?
• What is our exit plan and data return process?
• Which AI features are already switched on in tools we own?

Related tools

• Vendor due diligence

Region rules: EU · US · UK · India · Global standards.

Reviewed 3 Oct 2026. Sources: European Commission: AI Act overview.