AI Vendor Risk Assessment: The Due Diligence Questions, Evidence, and Contract Terms Behind Each Law and Framework

How do you assess an AI vendor’s risk?

Assess an AI vendor by asking, for each legal duty you carry, what you need from the vendor to meet it, then confirm the answer in documents and contract terms you can show a regulator. The questions come from the EU AI Act, GDPR Article 28, state and city rules on hiring and automated decisions, OMB memoranda for federal buyers, bank third-party and model risk guidance, NIST AI RMF GOVERN 6, and ISO/IEC 42001. The last three are supervisory guidance or voluntary frameworks, not law.

Classify the system and your role before sending a questionnaire, because your role decides which duties apply. An EU deployer of a high-risk system needs the provider’s instructions for use. A bank’s model risk guidance expects it to understand a vendor model well enough to validate it. An employer or employment agency that uses an automated employment decision tool to screen candidates or employees for hiring or promotion in New York City must make sure an independent bias audit was done before use.

What must an AI vendor give you under the EU AI Act?

A provider of a high-risk AI system must supply instructions for use that contain at least the information listed in Article 13(3). The list includes the intended purpose; the level of accuracy, including its metrics, robustness, and cybersecurity against which the system was tested and validated and which can be expected; the human oversight measures; and, where relevant, a description of the mechanisms that let deployers collect, store, and interpret the logs.

Article 26(1) then requires the deployer to take appropriate technical and organisational measures to use the system in accordance with those instructions, and Article 26(5) requires it to monitor the system’s operation on the basis of them. A deployer that is a financial institution subject to internal governance requirements under EU financial services law meets that monitoring duty by complying with those rules. Two more provisions reach the supply chain:

• Article 25(4), as amended. The provider of a high-risk AI system and a third party that supplies an AI system, AI model, tools, services, components, or processes used or integrated in it must specify by written agreement the necessary information, capabilities, technical access, and other assistance, based on the generally acknowledged state of the art, to enable the provider of the high-risk system to fully comply with the Act’s obligations. The duty does not apply to third parties making tools, services, processes, or components other than general-purpose AI models accessible to the public under a free and open-source licence. The AI Office may develop and recommend voluntary model terms for contracts between providers of high-risk AI systems and third parties that supply tools, services, components, or processes used for or integrated into them.
• Article 53(1)(b). A provider of a general-purpose AI model must make available to providers of AI systems who intend to integrate the model information and documentation that enables them to understand its capabilities and limitations and to comply with their own obligations, and that contains at least the elements in Annex XII, without prejudice to intellectual property rights, confidential business information, and trade secrets. Under Article 53(2), this duty does not apply to providers of models released under a free and open-source licence whose parameters, including the weights, model architecture information, and model usage information, are made publicly available, unless the model is a general-purpose AI model with systemic risk.

The high-risk provider and deployer duties, including Articles 13, 25, and 26, apply from December 2, 2027 for stand-alone Annex III systems and from August 2, 2028 for AI in Annex I Section A regulated products. Article 53 has applied since August 2, 2025; providers of general-purpose AI models placed on the market before that date have until August 2, 2027.

A deployer, distributor, importer, or other third party becomes the provider of a high-risk AI system, with the Article 16 provider duties, if it puts its name or trademark on a high-risk system already placed on the market or put into service (without prejudice to contracts that allocate the obligations otherwise), makes a substantial modification after which the system remains high-risk, or changes the intended purpose of a system so that it becomes high-risk (Article 25(1)). The initial provider is then no longer considered the provider of that system, and Article 25(2) requires it to cooperate closely with the new provider and make available the necessary information, reasonably expected technical access, and other assistance, including, where relevant, technical documentation, information on known limitations and failure modes, and targeted technical access for testing and validation. That duty does not apply where the initial provider clearly specified that its system is not to be changed into a high-risk AI system. Breaches of Article 25(2), Article 25(4), and Article 26 carry fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, with the lower figure for SMEs and small mid-caps (Article 99(4), (6), and (6a)). The EU AI Act compliance guide explains the provider and deployer split.

What do bank regulators expect when the vendor supplies a model?

They expect the bank to validate the model and manage the relationship, and both expectations sit in guidance, not rules. SR 26-2’s revised model risk guidance, issued April 17, 2026 and expected to be most relevant to banking organizations with more than $30 billion in total assets, says a bank might not receive a vendor’s underlying code, data, or methodology because components may be proprietary, but “the principles of model risk management remain applicable.” Sound practice, in the guidance’s words, includes developing an understanding of the vendor model, including its conceptual soundness, design, development data, and performance, and conducting ongoing monitoring and outcome analysis. A footnote states that generative AI and agentic AI models are not within the guidance’s scope, and that a bank’s risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems the guidance does not cover.

The 2023 interagency guidance lists 17 factors a bank typically considers in contract negotiation, among them the right to audit and require remediation, subcontracting, and regulatory supervision. The OCC, Federal Reserve, FDIC, and NCUA proposed on September 11, 2026 to replace it, with comments due November 16, 2026. The proposal states that there are no generally applicable expected contract terms for third-party relationships, even for higher-risk relationships, that banking organizations typically tailor contract provisions to their size, complexity, and risk profile and the nature of the relationship, and that “the presence or absence of a specific contractual term that an examiner may believe to be contrary to best practices would not alone be a sufficient basis for an examiner to communicate an adverse finding” on a bank’s third-party risk management practices. Until the proposal is final, the 2023 guidance remains in effect for banks. The financial services guide covers SR 26-2 in full.

What do NIST AI RMF and ISO/IEC 42001 say about third parties?

Both are voluntary, and both treat vendor risk as its own topic. In NIST AI RMF 1.0, GOVERN 6.1 reads: “Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.” GOVERN 6.2 calls for contingency processes to handle failures or incidents in third-party data or AI systems deemed to be high-risk.

ISO/IEC 42001:2023 names processes for the management of suppliers, partners, and third parties that provide or develop AI systems for the organization among its crucial examples of processes the AI management system should be integrated with. The crosswalk listed on NIST’s AI Resource Center, contributed by Microsoft, maps GOVERN 6.1 and 6.2 to ISO/IEC 42001 clauses B.10.2 (Allocating responsibilities) and B.10.3 (Suppliers) in Annex B, the standard’s implementation guidance for its AI controls. A crosswalk shows where topics meet; it does not make one document satisfy the other. The NIST AI RMF guide lists every category.

What questions should you ask an AI vendor?

Ask the questions your own duties require, and accept documents, not assurances, as the answer.

Who answers for what under Colorado, California, and New York City rules?

These laws split the work between the company that builds a tool and the company that uses it. In each, the user keeps its own duty even when the builder supplies the documents or arranges the audit.

• Colorado. In an existing unlawful-discrimination suit arising from a decision that covered ADMT materially influenced, fault is allocated between developers and deployers by relative fault, and a contract clause that indemnifies a developer or deployer for its own violations of Colorado anti-discrimination law is void (6-1-1707). A federal court order in X.AI LLC v. Weiser bars the Attorney General from initiating enforcement, including an investigation, for violations occurring on or before 14 days after the court rules on xAI’s preliminary injunction motion. As of November 1, 2026, that motion had not been filed. The order does not move the January 1, 2027 application date. See the Colorado guide.
• California. Under the privacy agency’s regulations, a business that makes ADMT available to another business to make a significant decision must give the recipient all facts available to it that are necessary for the recipient to conduct its own risk assessment. The duty applies only to ADMT trained using personal information (11 CCR 7153).
• New York City. The employer or employment agency must make sure the independent bias audit was done before use. Among other tests, an auditor is not independent if it is or was involved in using, developing, or distributing the tool. In its December 2, 2025 audit report, the State Comptroller counted three of 22 employers’ audits as potentially not independent, including two where an independent auditor wrote the report but the vendor performed the testing. The employment guide covers the other hiring rules.

What should an AI vendor contract include?

Start with the terms a law requires. Where the vendor processes personal data on your behalf and the GDPR applies, Article 28(3) requires a contract or other legal act that sets out the subject matter, duration, nature, and purpose of the processing, the type of personal data, the categories of data subjects, and the controller’s obligations and rights, and that stipulates the processor duties in points (a) to (h). Those include processing only on documented instructions, unless Union or Member State law requires otherwise; deleting or returning the data at the end of the services, at the controller’s choice, unless law requires storage; and allowing for audits. A processor that infringes the GDPR by determining the purposes and means of processing is considered a controller in respect of that processing, without prejudice to the liability and penalty provisions in Articles 82 to 84 (Article 28(10)).

Federal agencies work from OMB’s list. M-25-22, issued April 3, 2025, applies to contracts awarded under solicitations issued on or after the date 180 days after its issuance, and to options to renew or extend existing contracts exercised after that date. Among other limits, it does not apply to elements of the Intelligence Community or to AI acquired as a component of a National Security System, and the AI systems it covers exclude any common commercial product within which AI is embedded, such as a word processor or map navigation system. Consistent with law and government-wide policy, where applicable, agencies must include terms that address intellectual property rights and use of government data, privacy, vendor lock-in protections, M-25-21’s minimum risk management practices for high-impact use cases, and ongoing testing and monitoring. The memorandum says each agency’s data and intellectual property process should address ensuring that contracts permanently prohibit the use of non-public inputted agency data and outputted results to further train publicly or commercially available AI algorithms, consistent with applicable law, absent explicit agency consent.

M-26-04, issued December 11, 2025, requires agencies to include contractual requirements addressing compliance with its Unbiased AI Principles in any solicitation or order for procurement of a large language model issued after that date. It does not apply to national security systems, and it states that it ceases to have effect two years after issuance unless the OMB Director provides otherwise. Both memoranda bind agencies, which pass the terms to vendors by contract.

Then add the terms your own duties depend on:

• Permitted uses of your data, including whether the vendor may train on inputs or outputs
• The documents the vendor will deliver and keep current: Article 13 instructions, Annex XII model documentation, or Colorado 6-1-1702 materials, as applicable
• Change and incident notice, with version identifiers and timing that fits your own reporting deadlines
• Audit rights, or receipt of independent audit reports, and cooperation with regulator inquiries
• Access to the data and results you need for your own bias and performance testing
• Subcontractor and subprocessor approval, with the same obligations flowing down
• Exit terms: data return or deletion, transition assistance, and portability
• No indemnity that a statute voids, such as a Colorado clause indemnifying a developer or deployer for its own anti-discrimination violations

What belongs on an AI vendor risk checklist?

• Record your role for each vendor system under each law that reaches it, such as deployer or provider under the EU AI Act
• Obtain the provider’s instructions for use before a high-risk system goes live, and file them with the system’s inventory entry
• Ask for the vendor’s validation and testing documentation, and record what the vendor withheld as proprietary
• Confirm who performed any bias audit and that the auditor meets Local Law 144’s independence tests
• Sign a GDPR Article 28 processing contract and a CCPA service provider contract where they apply
• Put training-data use, change notice, incident notice, audit, and exit terms in writing
• Remove indemnity clauses that Colorado’s 6-1-1707 would void
• Write a contingency plan for failures or incidents in any vendor data or AI system you rate high-risk (NIST GOVERN 6.2)
• Banks: read the third-party proposal before the November 16, 2026 comment deadline, and keep working to the 2023 guidance until a final version issues

How this fits the other guides: this page sits under the governance frameworks guide. The financial services guide covers bank model risk, the EU AI Act compliance checklist lists every deployer duty by article, and the NYC Local Law 144 guide explains the bias audit.

This guide is general information as of November 2, 2026, not legal advice; confirm requirements with counsel or the regulator.

By industry: all 8 industry pages