Skip to content
Is there an AI for this?

Field note · Compliance

Questions to ask before adopting an AI vendor

Eleven questions, in the order that saves the most time, with what a usable answer looks like. Written for the person who has to sign, and structured so that four of the eleven can be checked from the vendor’s own published pages before the first call.

Source
Written by us. 6 of 8 statements are anchored in a fetched document.
Verified
24 Aug 2026
Confidence
High

By Is There an AI for This? · Editorial guidance · Reviewed · How we use evidence

Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.

01Four you can answer before the first call

Whether a vendor *publishes* a document is a fact you can establish yourself, from the vendor’s own site, without asking anyone. It is also the fastest filter: a vendor selling to enterprises who publishes no data-processing agreement and no sub-processor list is telling you something about the stage they are at.

What the document *says* is a separate question, and a slower one. Keep the two apart — a published page is evidence that a page exists, not evidence of what is in it.

  • FACT

    OpenAI, Google, Microsoft, AWS and Mistral AI each publish a data-processing agreement at a stable URL.

  • FACT

    OpenAI, Google, GitHub and Glean each publish a sub-processor list.

  • FACT

    OpenAI, Anthropic, Google, Microsoft and AWS each publish a supported-countries page, which is where an availability question is answered rather than in a sales call.

  • FACT

    A hosted provider’s home jurisdiction is itself a published fact — DeepSeek’s is recorded as China, OpenAI’s as the United States — and it decides which government can compel disclosure.

  • ASSESSMENT

    We assess "publishes a DPA" and "offers the terms you need" as different findings, and we never present the first as the second.

    BasisRests on the evidence model used across this site: a fetched page proves the page exists at that URL on that date. A claim about its contents needs a quoted sentence from inside it, which is a separate record.

02The eleven questions

  1. 01Is our content used to train or improve your models, by default or on request?WhyThis is the question most often answered ambiguously, and the one an internal counsel will ask first.A usable answerA clause in the agreement, not a sentence on a marketing page, and a named setting we can verify.
  2. 02How long is our content retained, and can retention be set to zero?WhyRetention decides what is available to a subpoena, a breach, and a subject access request.A usable answerA stated period, a documented zero-retention option, and what changes when we enable it.
  3. 03Where is the inference performed, and where is it stored?WhyThese are two different locations and vendors often answer only the second.A usable answerBoth, per region, with the fallback behaviour when the primary region is unavailable.
  4. 04Who are your sub-processors, and how are we told when the list changes?WhyA model provider behind a product is a sub-processor. Notice of change is what makes the authorisation meaningful.A usable answerA public list, a subscription to changes, and a notice period long enough to object.
  5. 05Which model providers sit behind this product?WhyA product-shaped answer often hides a second vendor, in a second jurisdiction, with different terms.A usable answerNamed providers and the regions they serve us from.
  6. 06What logs exist, who can read them, and can we export them?WhyAudit logging is both a control you need and a second copy of the content you were protecting.A usable answerA described log schema, a retention period for the logs themselves, and an export route.
  7. 07How is tenant isolation implemented?WhySeparates a real multi-tenant architecture from a shared database with a customer column.A usable answerA description an engineer can evaluate, plus whatever independent assessment exists.
  8. 08Is the service available in our jurisdiction, contractually as well as technically?WhyAvailability and permitted use are different: a service can be reachable and still be out of scope in the terms.A usable answerThe supported-countries page, plus confirmation for our specific entity.
  9. 09What happens to our data on termination, and how long does it take?WhyExit is the part of the agreement nobody negotiates and everybody eventually uses.A usable answerAn export format, a deletion deadline, and confirmation that backups are included.
  10. 10What is your incident notification commitment?WhyOur own notification obligations start when we know, so their clock decides ours.A usable answerA stated number of hours, and what "aware" means for the purpose of starting it.
  11. 11Which of these commitments are in the contract rather than on a web page?WhyThe closing question. A commitment that only exists on a page can be edited without telling you.A usable answerA marked-up agreement, or a named clause for each answer above.

03And one thing to write before anyone signs anything

Most organisations already have staff pasting company material into consumer AI tools. That is a policy problem you can fix this month, independently of any procurement, and the Privacy Commissioner has published what such a policy should cover.

  • FACT

    The Privacy Commissioner’s checklist recommends that an internal policy specify the permitted generative AI tools and the scope of permissible use.

  • FACT

    It also recommends providing clear instructions on the types and amounts of information that may be entered into those tools.

  • RECOMMENDATION

    We recommend writing that policy before the procurement rather than after it, because the procurement takes months and the exposure is happening now.

    BasisDepends on staff already having access to consumer AI tools. Rests on the two Privacy Commissioner recommendations cited above, which describe a policy that needs no vendor relationship to implement.

04Related

Use cases

Stacks

Tools

Jurisdictions

Deployment reports

More field notes

Ask this as a question

  1. 01What should we ask an AI vendor before we sign?

05Evidence

18 records
  1. 01
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Licensing Documents

    https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

    AgeingRetrieved 20 Sep 2026sha256:7bcef261059f

    1 record

  2. 02
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Subprocessors | Glean

    https://www.glean.com/legal/subprocessors

    AgeingRetrieved 20 Sep 2026sha256:ce1fa8a9ceb7

    1 record

  3. 03
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Supported countries and regions \ Anthropic

    https://www.anthropic.com/supported-countries

    AgeingRetrieved 20 Sep 2026sha256:244321265770

    1 record

  4. 04
    Tier 2official vendor legal documentationVendor legal and technical documentation

    OpenAI Sub-processor list | OpenAI

    https://openai.com/policies/sub-processor-list

    AgeingRetrieved 20 Sep 2026sha256:f21e612c2a7a

    1 record

  5. 05
    Tier 2official vendor legal documentationVendor legal and technical documentation

    OpenAI Data Processing Addendum | OpenAI

    https://openai.com/policies/data-processing-addendum

    AgeingRetrieved 20 Sep 2026sha256:ce5d6a759cde

    1 record

  6. 06
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Welcome to our Legal Center

    https://legal.mistral.ai/terms/get-started

    AgeingRetrieved 20 Sep 2026sha256:231f60d47684

    1 record

  7. 07
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Region availability for Foundry Models sold by Azure - Microsoft Foundry

    https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure-region-availability

    AgeingRetrieved 20 Sep 2026sha256:006f84ba9ea6

    1 record

  8. 08
    Tier 2official vendor legal documentationVendor legal and technical documentation

    GitHub Subprocessors - GitHub Docs

    https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors

    AgeingRetrieved 20 Sep 2026sha256:c0d305dd02d5

    1 record

  9. 09
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Google Cloud Platform Subprocessors | Google Cloud

    https://cloud.google.com/terms/subprocessors

    AgeingRetrieved 20 Sep 2026sha256:1549c29f3f77

    1 record

  10. 10
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Cloud Data Processing Addendum  |  Google Cloud

    https://cloud.google.com/terms/data-processing-addendum

    AgeingRetrieved 20 Sep 2026sha256:eedabd6f9ca1

    1 record

  11. 11
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Global Locations - Regions & Zones  |  Google Cloud

    https://cloud.google.com/about/locations

    AgeingRetrieved 20 Sep 2026sha256:54edd9a1f866

    1 record

  12. 12
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Supported countries and territories | OpenAI API

    https://developers.openai.com/api/docs/supported-countries

    AgeingRetrieved 20 Sep 2026sha256:52cefcfd7a66

    1 record

  13. 13
    Tier 2official vendor legal documentationVendor legal and technical documentation

    GDPR - Amazon Web Services (AWS)

    https://aws.amazon.com/compliance/gdpr-center

    AgeingRetrieved 19 Sep 2026sha256:5fd5e4b75098

    1 record

  14. 14
    Tier 2official vendor legal documentationVendor legal and technical documentation

    Global Infrastructure Regions & AZs

    https://aws.amazon.com/about-aws/global-infrastructure/regions_az

    AgeingRetrieved 19 Sep 2026sha256:a5d63a92cf60

    1 record

  15. 15–16
    Tier 1legislation / regulatorLegislation and regulators

    Privacy Commissioner’s Office Publishes (1) Checklist on Guidelines for the Use of Generative AI by Employees and (2) Investigation Findings on the Data Breach Incident of ImagineX Management Company Limited

    https://www.pcpd.org.hk/english/news_events/media_statements/press_20250331.html

    FreshRetrieved 19 Sep 2026sha256:53afd5791f2f

    2 records ·

  16. 17–18
    Tier 4official repository / model cardOpenRouter

    OpenRouter — inference providers

    https://openrouter.ai/api/v1/providers

    AgeingRetrieved 19 Sep 2026sha256:6e6ffb79aaad

    2 records ·