AI Vendor Due Diligence Process and Evidence Areas
Updated
AI vendor due diligence is a process for testing supplier claims against evidence before award and after material change. It should start with intended use and data, then collect proportionate evidence on identity, architecture, privacy, security, oversight and dependencies. A completed bespoke questionnaire or scoring matrix is professional work; this page explains the process and evidence categories buyers should insist on.
How should the process start?
Define the buying problem before sending a vendor pack:
- intended outcome and users;
- data classes and locations;
- whether the decision is consequential;
- whether the service is a tool, a model API, an agent or a managed outcome;
- who will own residual risk.
Then use the AI Procurement Route Finder if the workstream is still unclear.
What evidence areas should the process cover?
Walk through identity, purpose, architecture, training and retrieval data where relevant, privacy, security, testing, human oversight, accessibility, model/provider change, incidents, monitoring, IP and exit. The checklist lists the compact set. This process page is about order and discipline, not a scored matrix.
What is AI vendor due diligence evidence?
AI vendor due diligence evidence is the dated source behind a supplier statement: a document, configuration, test record or independent check, with its scope written down. A questionnaire answer or marketing claim is not evidence until it is tied to that source. Buyers can reuse a current evidence pack across questionnaires when the scope still matches; that reuse is not an AI procurement certification. AI TrustMark does not invent reviews, assurance scores, Bronze, Silver or Gold outcomes, or a procurement verification the record does not contain. Payment does not change whether a listing is indexed.
How should buyers treat supplier answers?
For each material statement, distinguish:
- claim only;
- documented;
- demonstrated in operation;
- independently verified.
Do not give a marketing PDF the same weight as a dated, scoped, independently checked control.
When is deeper work needed?
Increase depth where personal data, consequential decisions, privileged tools, public-sector duties, EU AI Act exposure, safety-critical use or weak supplier transparency are present. See human oversight and agentic AI procurement.
What should stay with the buyer?
Eligibility, evaluation scores, legal advice, framework admission, contract award and risk acceptance. Independent verification can shorten baseline due diligence; it cannot take those decisions. Bronze, Silver and Gold describe how deeply evidence was examined. An Assurance Score and an Impact rating are separate from that depth, and customer evidence stays on V0–V4 until it is genuine.
Which primary sources should the process use?
Use the buyer's own duties first, then the supplier's evidence. Useful primary references are the ICO's guidance on AI and data protection, the NCSC principles for the security of machine learning, PPN 017 for UK public procurement, the NIST AI Risk Management Framework, and the EU AI Act where that regulation applies. ISO publishes the ISO/IEC 42001 management-system standard separately from an AI TrustMark assessment.
How AI TrustMark fits
AI TrustMark is an independent verification layer. This public guide explains what good looks like, what questions to ask and which evidence categories matter. It is guidance, not a legal opinion, government endorsement, UKAS accreditation or ISO certification.
Fact: primary-source frameworks set expectations for buyers and suppliers. Guidance: the questions and evidence categories below help a buyer apply those frameworks. AI TrustMark methodology: published TrustMark records state what was independently checked, the depth of investigation and when. They do not replace the buyer's award decision.
Free public tools include the AI Procurement Route Finder, this knowledge base and the published methodology. Tailored RFI/RFP/ITT documents, evaluation matrices, organisation-specific crosswalks, completed evidence packs, contract schedules, supplier assessments, deployment assurance and monitoring frameworks remain professional services.
Related guidance
- AI Procurement Knowledge Base
- Evaluate AI suppliers
- AI Procurement Route Finder
- Procurement evidence packs
- Independent assurance
- Methodology
- Independent supplier verification
- AI security due diligence
- ICO AI and data protection
FAQ
Is this a free evaluation matrix?
No. It explains the process and evidence categories. A tailored scoring matrix, RFI or completed evidence pack is professional work.
Can one due-diligence pack cover every tender?
Only where the product, scope and evidence remain current. Contract-specific requirements, higher-risk uses and expired evidence still need a fresh look.