AI Governance

AI vendor risk assessment — DORA, EU AI Act Art. 26, APRA AI letter, NIST AI RMF, ISO 42001

36 questions·Version 1.0

AI Inventory & Scope

Does your organisation use AI or machine learning in any capacity related to the services provided to us?DORA Art. 28(3); NIST AI RMF MAP-4
Is AI embedded in any software tools, APIs, or platforms you use to deliver services to us — even if you didn't build the AI yourself?APRA AI letter; DORA concentration risk
Describe the specific functions or features in your product/service where AI is used or embedded.ISO 42001 A.10.3
Have you introduced new AI capabilities in the past 12 months that were not disclosed at the time of contracting with us?DORA Art. 28; Atlas Systems best practice
Do you maintain an internal inventory of all AI systems used in delivering services to us?ISO 42001 A.10.3; NIST AI RMF GOVERN-6

Which foundation models or AI APIs does your organisation use or depend upon?DORA concentration risk / CTPP
Do your critical sub-vendors or third-party APIs use AI in ways that could affect the services provided to us?APRA AI letter (fourth-party); DORA Art. 28
Have you assessed the AI supply chain of your critical sub-vendors (fourth-party AI exposure)?APRA AI letter explicit requirement
Have your foundation model providers confirmed that API inputs are not used to train their models?Training data provenance; GDPR Art. 28

Was data from our organisation or our customers ever used to train or fine-tune any AI model you operate?GDPR Art. 5; NY DFS Circular 7 (2024)
Do you use prompts, outputs, or interaction logs from our engagement to improve or fine-tune your AI models?GDPR; APRA AI letter
Can customers opt out of having their data used for AI training purposes?GDPR; Vanta best practice
Where is your AI training and inference data processed and stored? Include country/jurisdiction.DORA Art. 28(3) data location; GDPR
Can you provide a model card or equivalent documentation describing your training data sources?ISO 42001 A.10.3; NIST AI RMF MEASURE

Do you continuously monitor your AI systems for model drift and performance degradation?NIST AI RMF MEASURE; Vanta best practice
What is your AI model retraining or update cadence?ISO 42001 A.10.3
Can decisions or recommendations made by your AI be explained in plain language to a regulator or end-user?EU AI Act Art. 13; DORA incident classification
Do you retain audit logs of AI decisions or outputs? For how long?EU AI Act Art. 12; DORA notification
Have your AI systems been independently validated or audited in the past 24 months?ISO 42001; EU AI Act high-risk obligations

How do you classify an AI-related incident? Do you have a documented definition?DORA Art. 17
What is your process for notifying clients of AI system failures or material performance degradation? Include your notification timeline.DORA Art. 19(4) — 4h initial notification
Do you have AI-specific security controls against prompt injection, data poisoning, or adversarial attacks?NIST AI RMF MANAGE-3; CISA AI security
What is your documented process if AI outputs are found to be materially incorrect in ways that affect our operations or customers?DORA; APRA CPS 230; ISO 42001

Does your AI make autonomous decisions — without mandatory human review — that directly affect our customers or their data?EU AI Act Art. 26; DORA
What percentage of high-stakes AI outputs receive human validation before action is taken?EU AI Act Art. 26 (human oversight)
Have your AI systems been tested for bias across demographic groups relevant to the decisions they make?EU AI Act Annex III; EEOC guidance
Is there a process by which our organisation or our customers can contest or override AI-generated decisions?EU AI Act Art. 26(5); GDPR Art. 22

How would you classify your AI system(s) under the EU AI Act risk tiers?EU AI Act Art. 6 + Annex III
If High-Risk (EU AI Act Annex III): have you completed or begun a conformity assessment?EU AI Act Art. 43
Have you assessed whether your AI systems could be replaced by an alternative provider within 30 days if required?DORA Art. 28(8) — exit strategy must be operationally tested
What is your estimated time to switch to an alternative foundation model or AI provider if your primary became unavailable?DORA concentration risk; APRA CPS 230

Please provide the specific DPA clause, privacy addendum, or written commitment confirming whether customer data is or is not used for AI training. Include which product plan and geographic configuration this applies to.GDPR Art. 28; EDPB Opinion 28/2024
Are all AI sub-processors who process our data listed in the Data Processing Agreement (DPA) you have with us?GDPR Art. 28(4); EDPB Opinion 28/2024
What is the retention period for content our organisation inputs into your AI features (e.g. prompts, uploaded documents, meeting audio)?GDPR; DORA Art. 28(3)
What is the retention period for AI-generated outputs related to our content (e.g. summaries, transcripts, generated text)?GDPR; DORA Art. 28(3)
Does your most recent SOC 2 Type II report explicitly cover AI data processing controls — including training pipelines, data retention for AI features, and AI sub-processor data handling?SOC 2 Type II scope verification

VendorAuditly automatically scores responses, maps answers to framework controls, and tracks coverage over time. Free to start.