- What do we actually need before signing a contract with an AI vendor?
- Two documents: a vendor assessment (a scored evaluation against ISO/IEC 42001 or NIST AI RMF, with evidence requests you can put directly to the vendor) and a Data Processing Agreement covering the vendor’s AI-specific obligations. Signing on the vendor’s standard terms without either is a common gap that surfaces later, usually during a customer’s own vendor-risk review of you.
- Our AI vendor won't answer our security or AI questionnaire — what now?
- A structured, scored assessment (the Vendor Assessment’s 30-question workbook) turns a vague ask into specific evidence requests the vendor has to respond to point by point, rather than a general "please describe your AI practices" the vendor can deflect. A Procurement Checklist companion documents exactly which questions were asked and what response was received, which is itself useful evidence if the vendor never fully answers.
- Do we need a DPA even if the vendor says they don’t train on our data?
- Yes — GDPR Article 28 processor obligations apply whenever the vendor processes personal data on your behalf, regardless of whether that data is also used for model training. A "we don’t train on your data" assurance addresses one specific concern; it doesn’t satisfy the separate, mandatory processor-contract terms (subprocessor authorisation, security measures, deletion or return of data, audit rights, breach notification) that apply either way.
- Is a generic vendor NDA enough, or do we need something AI-specific?
- A generic NDA or SaaS DPA is typically missing AI-specific terms — a sub-processor schedule naming any AI sub-processing, an international-transfer mechanism appropriate to where the AI vendor actually processes data, and clauses addressing model-training use of your data specifically. The DPA Generator’s 12-clause output is built with those AI-specific schedules from the start, rather than a general template with "AI" inserted after the fact.