AI Vendor Due-Diligence Questionnaire
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The AI Vendor Due-Diligence Questionnaire is a free XLSX and DOCX checklist for EU AI Act, ISO/IEC 42001 and NIST AI RMF. Questions to put to an AI vendor, grouped by governance, data, model, security, transparency, incidents, and insurance and indemnity, scored automatically. It is written for provider / developer, deployer / user organisation and importer.
- Format
- XLSX and DOCX · Checklist
- Version
- v4, built 12 Nov 2026
- Duties cited
- 3 from 2 instruments
- Rows from the records
- 23
- Frameworks
- EU AI Act, ISO/IEC 42001, NIST AI RMF
- Written for
- Provider / developer, Deployer / user organisation, Importer
- Price and licence
- Free · CC BY 4.0
What's inside
- Questionnaire sheet: seven sections, response dropdowns, evidence requested, weighted score
- Insurance and indemnity section: cover, AI exclusions, IP indemnity, sub-processor flow-down, audit rights
- Duties sheet: the vendor-governance duties on record that the questions serve
Preview
The sheets and sections of version v4, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Questionnaire
| # | Section | Question | Evidence requested | Response ▾ | Score ƒ | Vendor notes / our assessment |
|---|---|---|---|---|---|---|
| 1 | Governance | Do you maintain an AI governance policy with named accountable roles? | Policy document; org chart | = | ||
| 2 | Governance | Is your AI management system certified or assessed against ISO/IEC 42001 or an equivalent? | Certificate or assessment report | = | ||
| 3 | Governance | Which AI laws and regulations do you consider yourself subject to, and in what role? | Written statement | = | ||
| 4 | Data | What data was used to train, tune and evaluate the model, and what rights do you hold to it? | Data provenance summary | = | ||
| 5 | Data | Do you process our data to train or improve models? Can we opt out contractually? | Contract terms | = | ||
| 6 | Data | Where is data stored and processed, and which sub-processors are involved? | Sub-processor list | = |
Total score: sum the Score column; the maximum is twice the number of applicable questions.
Sheet: Vendor-governance duties
| Duty | Category | Instrument | Jurisdiction | Who it binds | Nature | Source reference | Applies from | What it requires | Evidence a reviewer expects | ISO/IEC 42001 | NIST AI RMF | Verification | Record |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Provide contestability, supply-chain transparency and records (guardrails 7 to 9) | Vendor and supply-chain governance | Australian Voluntary AI Safety Standard | Australia | Deployer / user organisation, Provider / developer | Voluntary | Guardrails 7, 8 and 9 | Establish processes for people impacted by AI to challenge use or outcomes; be transparent with other organisations across the AI supply chain about data, model | AI system register and supplier disclosures | GOVERN 6.x | Pending review · source-linked | https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records | ||
| Verify conformity before importing or distributing high-risk AI | Vendor and supply-chain governance | EU AI Act | European Union | Importer, Distributor | Legal requirement | Articles 23 and 24 | 2027-12-02 | Importers must verify that the provider completed conformity assessment, drew up technical documentation, affixed CE marking and appointed an authorised represe | Supplier due-diligence checklist | Annex A controls on third parties and suppliers | GOVERN 6.1, GOVERN 6.2 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations |
| Providers of high-risk AI must have written agreements with suppliers of components, tools and services | Vendor and supply-chain governance | EU AI Act | European Union | Provider / developer | Legal requirement | Article 25(4) | 2027-12-02 | A provider of a high-risk AI system and any third party that supplies AI systems, tools, services, components or processes used in or integrated into it must se | Supplier agreement with AI Act information and access clauses; Supplier register with agreement status | Annex A.10.3 | GOVERN 6.1 | Verified against the official source 26 Sep 2026 | https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers |
Document outline (DOCX)
- How to use this questionnaire
- Insurance and indemnity
- Duties this questionnaire serves
- Provide contestability, supply-chain transparency and records (guardrails 7 to 9)
- Verify conformity before importing or distributing high-risk AI
- Providers of high-risk AI must have written agreements with suppliers of components, tools and services
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The XLSX and DOCX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v4), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Check the duties against your situation. The "Questionnaire" and "Vendor-governance duties" sheets list the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 4Complete the document. Work through the DOCX sections (How to use this questionnaire, Insurance and indemnity, Duties this questionnaire serves) and replace each placeholder with your organisation's answer.
- 5Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (3)
Each is cited in the file with its source reference and a link back to the record.
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v4 | ef1018b7a6a2 | Dataset 52bd836b1d6b → ef1018b7a6a2. | |
| v3 | 52bd836b1d6b | Dataset 3335c39da4b7 → 52bd836b1d6b. | |
| v2 | 3335c39da4b7 | Dataset 914895c3103e → 3335c39da4b7. | |
| v1 | 914895c3103e | First version, built from dataset 914895c3103e. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the AI Vendor Due-Diligence Questionnaire?
Questionnaire sheet: seven sections, response dropdowns, evidence requested, weighted score. Insurance and indemnity section: cover, AI exclusions, IP indemnity, sub-processor flow-down, audit rights. Duties sheet: the vendor-governance duties on record that the questions serve.
Which duties does it cite?
3 recorded duties from Australian Voluntary AI Safety Standard and EU AI Act, including Guardrails 7, 8 and 9, Articles 23 and 24 and Article 25(4). Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on provider / developer, deployer / user organisation and importer. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the XLSX and DOCX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v4 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Is there a self-assessment that goes with it?
Yes: the AI Supply Chain Security Assessment (21 questions, about 6 minutes) and the AI Procurement Controls Assessment (23 questions, about 6 minutes). They are free and run on Certifyi, a related product. A score is a self-check, not an audit; this template is where the work it points to gets written down.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.