Implementation Kit
Third-Party AI Inventory and Contract Review Checklist
The estate-wide view of external AI: every AI service your systems connect to directly (through an API, a software connection) and every model built into vendor software, the state of each contract against the clauses that matter, and whether the training-data opt-out is actually confirmed. Complements the per-vendor due diligence kit.
Who this is for: The third-party risk owner who needs to know the whole external AI exposure, not one vendor at a time.
1. External AI dependency inventory
SpreadsheetOne row per external AI API or vendor-embedded model. The portfolio, with contract and opt-out status visible.
Template
| Dependency | Provider | Use case | Data sent | Risk tier | Contract review status | Training-data opt-out |
|---|---|---|---|---|---|---|
| <API or embedded model> | <vendor> | <what we use it for> | <data categories> | Minimal / Limited / High | Not started / In review / Complete | Confirmed / Requested / Not available / N/A |
Worked example
| Dependency | Provider | Use case | Data sent | Risk tier | Contract review status | Training-data opt-out |
|---|---|---|---|---|---|---|
| Chat completion API | Anthropic | Contract summarization | Counterparty names, terms | Minimal | Complete | Confirmed (DPA 6.2) |
| Zendesk AI | Zendesk | Support reply drafting | Tickets, order metadata | Limited | In review | Requested 2026-08-20 |
| Embedded resume parser | Greenhouse | CV to structured fields | Candidate CVs | High | Complete | Confirmed |
| Meeting summarizer | Otter.ai | Call notes | Meeting audio, names | Limited | Not started | Not available |
Acceptance criteria
- ✓Every external AI API and every vendor-embedded AI feature is listed, drawn from the AI inventory.
- ✓Contract review status and opt-out status are tracked per row, not assumed.
- ✓High and Limited rows without a complete contract review have an owner and a date.
2. AI API contract review checklist
SpreadsheetA fast triage of one agreement against the clauses that matter for an external AI API.
Template
| Clause | Present? | Acceptable? | Note |
|---|---|---|---|
| Training-data use (our data not used to train by default, or opt-out) | Y / N | Y / N | |
| Data retention and deletion of prompts and outputs | Y / N | Y / N | |
| Data location and transfer mechanism | Y / N | Y / N | |
| Model change notification | Y / N | Y / N | |
| Liability cap and IP indemnification for AI outputs | Y / N | Y / N | |
| Incident notification window | Y / N | Y / N | |
| Sub-processor list and change notice | Y / N | Y / N | |
| Audit or evidence rights | Y / N | Y / N |
Worked example
| Clause | Present? | Acceptable? | Note |
|---|---|---|---|
| Training-data use | Y | Y | Not used for training per MSA 9.1 |
| Retention and deletion | Y | Y | 30 days, then deleted |
| Data location and transfer | Partial | N | US only; need EU option, raised with vendor |
| Model change notification | N | N | Changelog only; redline drafted |
| Liability and IP indemnity | Y | N | IP claims inside the general cap; want a carve-out |
| Incident notification | Y | Y | 24h |
| Sub-processor notice | Y | Y | 30-day notice |
| Audit rights | Y | Y | Annual questionnaire + SOC 2 |
Acceptance criteria
- ✓Each clause is checked against the signed agreement, not the vendor summary.
- ✓Every "not acceptable" has a redline in progress or an approved decision to accept.
- ✓The checklist result updates the contract review status on the inventory.
3. Training-data opt-out tracking log
SpreadsheetProof that opt-out was pursued and confirmed for every vendor where it applies.
Template
| Vendor | Opt-out available? | Default state | Requested on | Confirmed on | Evidence | Owner |
|---|---|---|---|---|---|---|
| <vendor> | Yes / No / Unknown | On / Off by default | YYYY-MM-DD | YYYY-MM-DD | <link or ref> | <name> |
Worked example
| Vendor | Opt-out available? | Default state | Requested on | Confirmed on | Evidence | Owner |
|---|---|---|---|---|---|---|
| Anthropic | N/A (not used for training) | n/a | n/a | 2026-07-02 | DPA 6.2 | Vendor Risk |
| Zendesk | Yes | Off by default | 2026-08-20 | pending | support case 44812 | Vendor Risk |
| Otter.ai | Unknown | unknown | 2026-09-01 | pending | email to support | IT |
Acceptance criteria
- ✓Every vendor that could train on your data has a row with a current status.
- ✓Confirmed opt-outs point to written evidence, not a sales assurance.
- ✓Pending items have an owner and are chased.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The dependency inventory is the shadow and third-party AI inventory for external APIs and embedded models.
The contract review checklist evidences which AI-specific clauses are in place across the estate.
The opt-out log documents whether your data feeds vendor training, per data provenance requirements.
The "model change notification" checklist row establishes the hook for ongoing vendor governance-change monitoring.
The inventory makes provider concentration visible for a concentration-risk assessment.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.