Vendor decisions
Questions to resolve before choosing an AI vendor
Connect the intended use, information flow and contractual review before selecting a tool.
Describe the proposed use
Vendor review starts with your intended process. Describe what information enters the service, who can access it, what the output is used for and whether it leaves the organization. A generic product description does not answer these questions. Include integrations, extensions, support access and any planned use of a personal account.
Map the information flow
List inputs, uploaded documents, metadata, output and logs. Identify the people and organizations involved in each step. Distinguish information that can be used from information that needs to be excluded or transformed. An advertised processing region should be checked against the actual service configuration and the relevant contractual terms.
Review the relevant contractual framework
Where a provider acts as a processor for personal data, Article 28 GDPR sets requirements for the processing arrangement. Review the actual roles and services rather than assuming one standard agreement fits every use. Questions for review include permitted purposes, instructions, sub-processors, security assistance and deletion or return of data. International data transfers require separate attention where applicable.
Turn promises into review questions
Ask whether inputs or output may be used for training or other provider purposes; how retention and deletion work; which settings affect that behavior; and what changes when a feature is enabled. Request documentation that relates to the product and plan you intend to use. A public security page is useful context but is not a substitute for examining the agreement and configuration.
Record the decision and its limits
Document the approved service, account type, permitted information, responsible owner and review date. State which changes trigger a new review—for example, a new integration or a materially different use. Make that decision accessible to the people using the tool. Legal classification depends on the actual circumstances; this checklist is a starting point for the assessment.
General information and practical frameworks. The legal requirements for a particular organization or use case require individual assessment.
The AI Workflow Playbook