{"data":{"slug":"ai-vendor-due-diligence-questionnaire","title":"AI Vendor Due-Diligence Questionnaire","type":"checklist","formats":["xlsx","docx"],"topics":["vendors","governance","evidence"],"frameworks":["eu-ai-act","iso-42001","nist-ai-rmf"],"short":"Questions to put to an AI vendor, grouped by governance, data, model, security, transparency, incidents, and insurance and indemnity, scored automatically.","covers":{"categories":["vendor_governance"]},"version":4,"dataset_version":"ef1018b7a6a2","generated_at":"2026-11-12T05:14:17+00:00","citations":6,"downloads":8,"files":[{"format":"xlsx","filename":"ai-vendor-due-diligence-questionnaire-v4.xlsx","bytes":15370,"url":"https://aipolicytracker.org/templates/ai-vendor-due-diligence-questionnaire#download"},{"format":"docx","filename":"ai-vendor-due-diligence-questionnaire-v4.docx","bytes":11307,"url":"https://aipolicytracker.org/templates/ai-vendor-due-diligence-questionnaire#download"}],"url":"https://aipolicytracker.org/templates/ai-vendor-due-diligence-questionnaire","inside":["Questionnaire sheet: seven sections, response dropdowns, evidence requested, weighted score","Insurance and indemnity section: cover, AI exclusions, IP indemnity, sub-processor flow-down, audit rights","Duties sheet: the vendor-governance duties on record that the questions serve"],"legal_basis":["eu-ai-act","iso-42001"],"caveat":null,"covered_obligations":[{"slug":"australia-vaiss-contestability-supply-chain-records","title":"Provide contestability, supply-chain transparency and records (guardrails 7 to 9)","policy":"australia-voluntary-ai-safety-standard","source_reference":"Guardrails 7, 8 and 9","url":"https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records"},{"slug":"eu-ai-act-importer-distributor-obligations","title":"Verify conformity before importing or distributing high-risk AI","policy":"eu-ai-act","source_reference":"Articles 23 and 24","url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations"},{"slug":"eu-ai-act-art-25-4-written-agreements-with-component-suppliers","title":"Providers of high-risk AI must have written agreements with suppliers of components, tools and services","policy":"eu-ai-act","source_reference":"Article 25(4)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers"}],"versions":[{"version":4,"generated_at":"2026-11-12T05:14:17+00:00","dataset_version":"ef1018b7a6a2","changelog":"Dataset 52bd836b1d6b → ef1018b7a6a2.","stats":{"sheets":{"Questionnaire":20,"Vendor-governance duties":3},"blocks":23,"headings":6,"citations":6}},{"version":3,"generated_at":"2026-10-08T05:30:01+00:00","dataset_version":"52bd836b1d6b","changelog":"Dataset 3335c39da4b7 → 52bd836b1d6b.","stats":{"sheets":{"Questionnaire":20,"Vendor-governance duties":3},"blocks":23,"headings":6,"citations":6}},{"version":2,"generated_at":"2026-09-27T05:30:01+00:00","dataset_version":"3335c39da4b7","changelog":"Dataset 914895c3103e → 3335c39da4b7.","stats":{"sheets":{"Questionnaire":20,"Vendor-governance duties":3},"blocks":23,"headings":6,"citations":6}},{"version":1,"generated_at":"2026-09-26T13:05:04+00:00","dataset_version":"914895c3103e","changelog":"First version, built from dataset 914895c3103e.","stats":{"sheets":{"Questionnaire":20,"Vendor-governance duties":3},"blocks":23,"headings":6,"citations":6}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}