What enterprise due diligence actually checks on an AI vendor

The reviewer's method

A competent reviewer facing two hundred answers does not verify two hundred facts. They pick a handful, usually one security answer, one data answer, one AI-behaviour answer, and go deep: does the cited evidence exist, is it dated, does the named owner know they are named, does the answer match the website and the trust page and the contract draft. Depth in three places tells them more than breadth across all, because vendors who survive depth are almost never hiding shallow problems. Their second instrument is time: they compare your answers to the same questions asked six months apart, and drift without explanation reads as a record nobody maintains.

The checklist, from their side of the table

What the file must show, in the order they usually build it: each AI system with a named owner; a risk tier per system with reasoning; data handling (training data categories and rights, customer data separation, retention, sub-processors); model behaviour (evaluations, known limitations, production monitoring); oversight (where a human sits, with what authority); incidents (the process, and the history answered honestly); regulatory mapping for the frameworks that apply to their use of you; and the contractual layer, where your questionnaire answers become representations and change-notice obligations. Nothing exotic; everything checkable.

What fails vendors

Five failures account for most rejections. Contradiction between surfaces, the fastest kill, because it poisons every unchecked answer. Staleness, evidence dated a year ago for a product that ships weekly. Ownerless answers, where "the team" is responsible and therefore nobody is. Over-claiming, "fully compliant", "bias-free", "no limitations", each of which a professional reviewer reads as either naivety or deceit. And evidence refusal, declining to share anything beyond marketing under any gate, which forces the reviewer to score you on what they cannot see.

What passes vendors fast

The mirror image: answers cited to sources, gaps held open with dates and interim controls, a trust page that agrees with the questionnaire because both derive from the same record, a named owner who responds inside a day, and a change-notice habit that tells the buyer when your AI materially changes before they discover it. Reviewers talk to each other more than vendors assume; the vendor who passes this way once starts the next review with a reputation.

Pass it before it is sent

The entire checklist above is self-administrable. Once a quarter, have someone play the reviewer: pick three of your own answers and follow them to evidence, date-check the record, read the trust page against the answer library. An hour of internal spot-checking finds the contradiction before the buyer does, and that is the whole difference between a review that stalls and one that closes.

Key terms

Spot-check

The reviewer's core method — pick a handful of answers, follow each to its evidence and its consistency across surfaces, infer the rest.

Consistency

The property that a claim survives being read against the website, trust page, questionnaire and contract; the first thing a reviewer tests.

Over-claiming

Absolutes — "fully compliant", "bias-free", "no limitations" — that a professional reviewer reads as either naivety or deceit.

Change notice

The habit of telling the buyer when your AI materially changes before they discover it themselves; a fast-pass signal in mature reviews.

Self-audit

The quarterly internal spot-check that plays the reviewer against your own answers; an hour of work that closes the gap the buyer would find.