AI Vendor Risk Assessment

A checklist for evaluating any AI vendor before you commit. Work through it with the vendor's answers in front of you, and count an item only when the answer is specific and the vendor will put it in writing.

Data Handling and Residency

0/4

Subprocessors and Model Supply Chain

0/4

Security and Access

0/4

Evidence of Accuracy

0/5

Change, Support and Escalation

0/4

Exit, Pricing and Dependence

0/4

Risk Score

0%

High risk

Too much is unanswered

0 to 40%, High risk
40 to 70%, Medium risk
70 to 100%, Low risk

Need help evaluating vendors?

Our AI consulting team can guide you through the assessment process.

Request a consultation

What Your Result Means

A percentage is not a verdict. A single unanswered item can end the conversation on its own: no export path, no position on training with your data, no way to run a pilot. Read the unchecked items, not the number.

High risk

0 to 40%

Most of the assessment is unanswered. That is not proof the vendor is bad, it means you cannot price the risk yet, and signing now moves that risk onto you.

Next steps

  • Send the unchecked items as written questions with a date for the answers.
  • Renegotiate before signing: data location, training on your data, notice before model changes, export on demand.
  • Walk away if the vendor will not commit to data handling and exit terms in writing at all.

Medium risk

40 to 70%

The basics are usually in place and the gaps sit in the specific parts: subprocessors, evidence of accuracy, notice before change, and the exit.

Next steps

  • Split the unchecked items into terms you need in the contract and gaps you can accept.
  • Ask in writing for the audit report or summary, the subprocessor list, and the evaluation method.
  • Run a limited pilot on your own data before you widen the scope or the spend.
  • Walk away if accuracy claims cannot be explained or a pilot is refused.

Low risk

70 to 100%

The vendor answers the hard questions. The risk that remains is the ordinary kind you manage rather than avoid, and it moves as the vendor's own suppliers move.

Next steps

  • Get the answers into the agreement. A good answer in a meeting is not a term.
  • Re-run this assessment at renewal, because model supply chains and pricing change inside a term.
  • Exercise the exit once during the term: export your data and check that it is usable without the vendor.

About This Assessment

Synapse Technologies is an AI vendor. We sell AI consulting and implementation, and we ship our own products. Publishing a vendor assessment is a conflict of interest and it is worth naming rather than hiding.

The criteria above are written to be applied to anyone selling an AI system, us included. None of them ask whether a vendor is local, whether it offers consulting alongside software, or anything else that would quietly tilt the result our way. Several of them, an independent audit report, a subprocessor list, a published incident history, are easier for a large platform to produce than for a small firm.

If you are evaluating us, use the same list and hold us to the same answers. If we cannot give you one of them in writing, that is information about us too.