The Vendor AI Risk Nobody's Checking: A Due-Diligence Checklist for Small Businesses

The vendor's pitch was strong. The platform was impressive. Nobody on the buying team asked where the training data came from, or what happened to the organization's data once it was uploaded, or whether the vendor's own AI use had been assessed against the buyer's own policies. Procurement checked the price. Legal checked the contract. Nobody checked the AI.

Why this gap keeps happening

This is rarely a lack of interest in AI governance — it's an assumption that someone else in the process already covered it. Procurement assumes legal handled the risk review. Legal assumes procurement vetted the technical details. The vendor, understandably, isn't volunteering scrutiny of their own product. The result is a gap that doesn't announce itself; it shows up quietly, embedded in a tool everyone already trusts because someone signed off on the invoice.

Three questions before any AI-enabled vendor contract is signed

Where does our data go once it enters their system, and is that specified in the contract rather than just the sales conversation? Is the vendor's AI use — training data, model behavior, data retention — documented and assessable, or simply asserted? And internally, who is actually accountable for saying yes to the AI risk specifically, beyond whoever approved the price and features?

Where this belongs in your existing process

This doesn't require a new department or a lengthy new procurement stage. It requires adding one explicit line item to whatever vendor review process already exists, with a named person responsible for answering it — the same way security review or legal review already has an owner.

A short due-diligence checklist

Confirm data handling and retention terms in writing, not verbally. Ask directly whether the vendor's AI use has been independently assessed or audited. Identify who internally is accountable for the AI-specific risk, separate from who approved the purchase. And revisit this assessment periodically — vendor AI capabilities change faster than most contract renewal cycles.

Before your next AI vendor contract is signed, who is actually assessing the AI — not just the price? If the honest answer is "nobody specifically," that's the gap worth closing first.