What is an AI vendor risk assessment?
Quick answer
An AI vendor risk assessment is a short check you run before a new AI tool is allowed at work. It asks how the vendor uses your data, how long it keeps it, what security reports and contracts it offers, and what an admin can control, then records a yes, a no or a "yes, for public data only."
Last updated
Take the free module →Module 3 of the free AI at Work: Start Here course, about 10 minutes. No account needed.
Updated · By Robert Breen
Why it matters for a small business
Every AI tool your team uses becomes a place your data lives. A note-taker records client calls, a writing tool sees your drafts, an agent connects to your inbox. Before anyone signs up, someone should spend twenty minutes on the vendor's own security and privacy pages. Most small firms skip this, and the first time they think about it is when a client's insurer asks.
The check does not need to be a long questionnaire. For a small office, a dozen plain questions cover most of the risk, and the answers go straight into your approved AI tools list. Ask about training on your data, retention, a SOC 2 report, a data processing agreement, single sign-on and who can see what.
Questions to ask before you approve an AI tool
| Question | Why it matters |
|---|---|
| Do you train models on our data, and can we turn it off? | Decides whether client text can end up in a model |
| How long do you keep our data, and can we delete it? | Sets how long a mistake stays a risk |
| Do you have a SOC 2 report or similar? | Shows an outside firm checked their security |
| Will you sign a data processing agreement? | Puts their data duties in writing |
| Can an admin control sharing, apps and who has access? | Lets you enforce your policy |
| Can we export our data and remove users? | Matters when someone leaves or you switch tools |
Check the vendor's own trust or privacy pages. For regulated data, ask a qualified adviser.
In a real lesson: ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes
The ChatGPT data controls lesson shows the same check from the other side. Hartwell Bookkeeping, a made-up firm, gets an email from its client Delgado Dental: before renewing, can Hartwell confirm whether payroll and patient billing files are ever put into ChatGPT, and what settings it uses? Their insurer now asks them to check every vendor.
That is a vendor risk assessment, with Hartwell as the vendor. Priya answers it by setting the controls and writing a one-page policy. When you assess an AI tool yourself, you are asking the vendor for the same kind of written answer.
Try this lesson free or read the step-by-step guide.
Common confusions
Vendor risk assessment vs a SOC 2 report
A SOC 2 report is one piece of evidence. The assessment is your decision, using that report and the other answers.
Vendor risk assessment vs a free trial
A trial shows whether the tool is useful. The assessment shows whether it is safe for your data. Run the assessment before real client data goes into the trial.
Tips
- Run the same questions for every new tool so the answers compare.
- Record the result and the data level allowed in your approved tools list.
- Recheck when a vendor changes its plans or privacy terms.
Related terms
More Business terms
Where you use it: free lessons
- ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes (ChatGPT, 10 min)
- Choose the AI Assistant Your Team Should Use, Tested on ChatGPT, Claude, Gemini and Copilot (ChatGPT, Claude, Gemini and Copilot, 8 min)
Frequently asked questions
- How long does an AI vendor review take for a small business?
- For most tools, about twenty minutes on the vendor's security, privacy and terms pages, plus an email to the vendor for anything you cannot find. Regulated data takes longer and may need an adviser.
- What if a vendor will not answer?
- Treat that as a no for client data. You might still allow the tool for public information only, and record that limit in your approved tools list.
- Can AI help with a vendor review?
- Yes. An assistant can summarize a vendor's privacy page against your questions and list what is missing. Check every answer against the vendor's own wording before you decide.