Free vendor assessment
AI Vendor Review
Answer eight questions from an AI vendor's own terms and get a clear verdict — approve, approve with conditions, or hold — along with the conditions to attach and the questions still worth asking.
Generated review
Vendor verdict
Your review will appear here
Enter the vendor name and select at least one data category to see a verdict, conditions, and the questions still worth asking.
How to use this result
Verify the vendor’s actual tier and terms. Resolve conditions and open questions before recording approval.
Copy keeps the text on your clipboard. Download PDF opens your browser’s print dialog; choose Save as PDF. Export before leaving: answers are not saved or transferred.
Your answers, prompt text, and generated documents stay in your browser and are not included in site analytics.
Fictional example
Illustrative scenario only. Dates are fixed examples, not current deadlines. This is separate from your answers and is not a certification or approval.
Fictional Cedar Studio wants to draft public product descriptions with an AI assistant. Vendor retention is unresolved, so the human approval remains pending. Monitoring shows a possible routine after the team resolves the gaps.
AI Vendor Review — Fictional Draft Assistant
Verdict: Do not approve yet
Do not approve Fictional Draft Assistant yet. One finding below should be resolved before this vendor handles the data described. This is not a rejection of the vendor — it usually means a question is unanswered, or the intended data is wrong for this tier.
What was reviewed
- Vendor / tool: Fictional Draft Assistant
- Intended use: Drafting and editing internal documents
- Data in scope: Public information or internal drafts only
- Trains on your data: Opt-out available, but nobody has verified the setting
- Retention: The terms do not state a retention period
- Published security: Independent certification published (SOC 2, ISO 27001)
- Subprocessors disclosed: Yes — subprocessors are listed
- Human review of output: Yes — every output is reviewed before it is used
Findings
- Blocking — Retention: No retention period is stated. Indefinite-by-omission is the most common quiet risk in AI vendor terms — ask the vendor directly before approving, rather than assuming prompt deletion.
- Concern — Model training: An opt-out exists but nobody has confirmed it is set. A contractual right to opt out changes nothing until someone actually disables the setting, on every account.
Conditions to attach to an approval
- Approved for drafting and editing internal documents only — not for other purposes without a new review.
- Company accounts only. Personal logins are not covered by this review.
- No passwords, API keys, or access tokens, under any circumstances.
- Training on your data must be disabled in settings, on every account, and confirmed by whoever set it up.
- Public information and internal drafts only. Customer, employee, financial, and health data are out of scope for this approval.
- Re-review annually, or sooner if the vendor changes its terms.
- These conditions apply only if the blocking findings above are resolved first — they do not substitute for resolving them.
Questions to ask the vendor
- How long do you retain our inputs, and can we delete them on request?
- Where is our data processed and stored geographically?
- How will you notify us of a security incident affecting our data, and how quickly?
Record the decision
- Reviewed by: ______________
- Date: ______________
- Next review due: ______________ (annually, or sooner if terms change)
This report provides practical operational guidance for reviewing AI vendors. It is not legal advice and does not guarantee regulatory compliance. It reflects only the answers entered above — it does not verify any vendor's actual practices. Review vendor agreements involving personal, financial, or health data with qualified professionals.
What this report is and is not
This report reflects only the answers you enter. It does not contact the vendor, read their terms, or verify their actual practices — it applies a consistent set of rules to what you found so that two people reviewing two tools reach comparable conclusions. It is not legal advice and does not guarantee regulatory compliance. Review agreements involving personal, financial, or health data with qualified professionals.
Keep going
Related resources
AI Use Approval Generator
Record a human decision with assessment results, conditions, a reviewer, and a review date.
AI Inventory Builder
Record the tools you assess, their owners, approval status, and next review dates in an exportable register.
AI Risk Checklist
Assess a specific planned use case rather than the vendor behind it — five dimensions, with tailored safeguards.
AI Vendor Review Checklist
The six questions this tool scores, explained — including which answers are disqualifying and why.
What AI Vendor Terms Actually Mean
Where to find the training, retention, and subprocessor answers this tool asks you for.
The AI Tool Approval Process
The workflow around this report: who requests a tool, who decides, and where the answer is recorded.
AI Risk Management for Small Businesses
The five risk dimensions that decide how tight your controls need to be, including vendor transparency.
AI Governance Starter Pack
Includes a vendor review form, tool approval checklist, incident log, and employee guidance.