intermediate·Security & Risk·1-2 hours

AI Vendor Safety & Governance Due Diligence Checklist

A one-page vendor risk summary with specific gaps flagged as dealbreaker vs. mitigable, ready for procurement or legal review.

⬡

Recommended modelClaude Sonnet 4.6

Strong at structured triage and checklist-driven analysis

What you need to fill in

[use case: e.g., customer support agent, code generation, data analysis][name][paste links or 'none found'][regulated industry / consumer-facing / internal tool only]

Tools used

ClaudeChatGPTPerplexity AI

The prompt

"I'm evaluating an AI vendor/model provider for [use case: e.g., customer support agent, code generation, data analysis]. Help me build a due-diligence checklist that goes beyond capability benchmarks. Vendor: [name] Public safety/transparency reports available: [paste links or 'none found'] Our risk tolerance: [regulated industry / consumer-facing / internal tool only] Please: 1. List the specific questions to ask about their safety framework, red-teaming process, and incident disclosure history 2. Flag what an independent report card (like FLI's AI Safety Index) actually measures vs. what it doesn't cover 3. Draft a one-page vendor risk summary I can bring to procurement/legal 4. Note which gaps are dealbreakers for our risk tolerance vs. acceptable with mitigations"

Open in Claude

Sample output

**Vendor Risk Summary — [Vendor]** | Domain | Evidence found | Gap | Verdict | |---|---|---|---| | Red-teaming | Public system card, 3rd-party eval cited | No incident-disclosure history published | Mitigable — require SLA on disclosure | | Pause commitments | Referenced in 2024 pledge | Not reaffirmed in 2026 policy update | Dealbreaker for regulated use case | | Data handling | SOC 2 Type II | No model-training opt-out documented | Mitigable — contractual clause needed | **Recommendation:** Proceed with contractual mitigations on data handling; escalate pause-commitment gap to legal before regulated-industry rollout.

Try with these tools

claude chatgpt perplexity

securitygovernancesafetyvendor-risk

More in Security & Risk

Agentic AI Incident Response Triage

A triage assessment distinguishing agentic from human-operated attack patterns, immediate containment steps, and a leadership-ready incident summary.

advanced

AI Agent Least-Privilege & Blast-Radius Review

A least-privilege permission set for the agent, a worst-case blast-radius comparison, and specific monitoring recommendations.

advanced