Free AI Vendor Due Diligence Questionnaire
Questions to send an AI vendor before signature, with the obligation each answer supports and the evidence to request.
What it is for
Most AI in a company arrives through vendors, and the deployer stays accountable. This questionnaire covers provider identity and role, model provenance and training data, intended purpose and limits, testing and robustness, human oversight controls, logging, security, data protection, incident reporting commitments and contractual allocation of obligations, each tied to the EU AI Act, ISO/IEC 42001 and NIST AI RMF expectations.
Preview: fields in the checklist
| Field | What to record |
|---|---|
| Section | Identity, purpose, data, testing, oversight, security, incidents, contract. |
| Question | What to ask the vendor. |
| Why it matters | Obligation or risk behind the question. |
| Evidence to request | Document or artefact. |
| Vendor answer | Free text. |
| Rating | Acceptable, conditional, unacceptable. |
| Follow-up owner | Person responsible. |
How to use it
- Send before contract signature; require written answers with evidence links.
- Rate every row; a single "unacceptable" blocks signature until resolved.
- File the completed questionnaire in the evidence pack next to the inventory row.
Framework and policy mapping
Create a free account to download
Get instant access to this free checklist and receive updates when related AI policy requirements change.
By downloading, you agree to the template licence and acknowledge that AIPolicyTracker provides informational resources, not legal advice.
Frequently asked questions
- Is the AI Vendor Due Diligence Questionnaire free?
- Yes. Preview every field online; download the XLSX, CSV, Markdown, DOCX with a free account under a CC BY 4.0 licence.
- Which frameworks does it map to?
- EU AI Act, ISO/IEC 42001, NIST AI RMF. The mapping section links the recorded policy instruments and guides it draws on.
- Does completing it make us compliant?
- No. It is an informational resource, not legal advice; it helps produce the evidence that regulators, customers and auditors ask for.
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.