The AI Vendor & Licensing Risk Review
Checklist
A checklist for reviewing an AI vendor or licensing agreement before buying or building an AI system, including RAG and agentic AI tools.
Data and intellectual property
- Does the contract address data use, training on customer data and data retention?
- Is output ownership clear?
- Are confidentiality and subprocessor terms defined?
Security and incident response
- Are security obligations and audit rights included?
- Is there an incident notification commitment?
- What happens if the vendor changes the underlying model?
Commercial and exit terms
- Are performance claims, indemnity and liability limits reasonable?
- Are termination rights and export or localisation restrictions clear?
- Will the vendor provide compliance evidence on request?
Start a conversation
Have a product or AI decision to make?
Useful first calls usually start with one unclear decision, a deadline and a team that needs a practical next move.
Tell us about it