Implementation Kit
Third-Party AI Inventory and Contract Review Checklist
The estate-wide view of external AI: every API and embedded model in use, the state of each contract against the clauses that matter, and whether the training-data opt-out is actually confirmed. Complements the per-vendor due diligence kit.
Who this is for: The third-party risk owner who needs to know the whole external AI exposure, not one vendor at a time.
1. External AI dependency inventory
SpreadsheetOne row per external AI API or vendor-embedded model. The portfolio, with contract and opt-out status visible.
Template
| Dependency | Provider | Use case | Data sent | Risk tier | Contract review status | Training-data opt-out |
|---|---|---|---|---|---|---|
| <API or embedded model> | <vendor> | <what we use it for> | <data categories> | Minimal / Limited / High | Not started / In review / Complete | Confirmed / Requested / Not available / N/A |
Worked example
| Dependency | Provider | Use case | Data sent | Risk tier | Contract review status | Training-data opt-out |
|---|---|---|---|---|---|---|
| Chat completion API | Anthropic | Contract summarization | Counterparty names, terms | Minimal | Complete | Confirmed (DPA 6.2) |
| Zendesk AI | Zendesk | Support reply drafting | Tickets, order metadata | Limited | In review | Requested 2026-08-20 |
| Embedded resume parser | Greenhouse | CV to structured fields | Candidate CVs | High | Complete | Confirmed |
| Meeting summarizer | Otter.ai | Call notes | Meeting audio, names | Limited | Not started | Not available |
Acceptance criteria
- ✓Every external AI API and every vendor-embedded AI feature is listed, drawn from the AI inventory.
- ✓Contract review status and opt-out status are tracked per row, not assumed.
- ✓High and Limited rows without a complete contract review have an owner and a date.
2. AI API contract review checklist
SpreadsheetA fast triage of one agreement against the clauses that matter for an external AI API.
Template
| Clause | Present? | Acceptable? | Note |
|---|---|---|---|
| Training-data use (our data not used to train by default, or opt-out) | Y / N | Y / N | |
| Data retention and deletion of prompts and outputs | Y / N | Y / N | |
| Data location and transfer mechanism | Y / N | Y / N | |
| Model change notification | Y / N | Y / N | |
| Liability cap and IP indemnification for AI outputs | Y / N | Y / N | |
| Incident notification window | Y / N | Y / N | |
| Sub-processor list and change notice | Y / N | Y / N | |
| Audit or evidence rights | Y / N | Y / N |
Worked example
| Clause | Present? | Acceptable? | Note |
|---|---|---|---|
| Training-data use | Y | Y | Not used for training per MSA 9.1 |
| Retention and deletion | Y | Y | 30 days, then deleted |
| Data location and transfer | Partial | N | US only; need EU option, raised with vendor |
| Model change notification | N | N | Changelog only; redline drafted |
| Liability and IP indemnity | Y | N | IP claims inside the general cap; want a carve-out |
| Incident notification | Y | Y | 24h |
| Sub-processor notice | Y | Y | 30-day notice |
| Audit rights | Y | Y | Annual questionnaire + SOC 2 |
Acceptance criteria
- ✓Each clause is checked against the signed agreement, not the vendor summary.
- ✓Every "not acceptable" has a redline in progress or an approved decision to accept.
- ✓The checklist result updates the contract review status on the inventory.
3. Training-data opt-out tracking log
SpreadsheetProof that opt-out was pursued and confirmed for every vendor where it applies.
Template
| Vendor | Opt-out available? | Default state | Requested on | Confirmed on | Evidence | Owner |
|---|---|---|---|---|---|---|
| <vendor> | Yes / No / Unknown | On / Off by default | YYYY-MM-DD | YYYY-MM-DD | <link or ref> | <name> |
Worked example
| Vendor | Opt-out available? | Default state | Requested on | Confirmed on | Evidence | Owner |
|---|---|---|---|---|---|---|
| Anthropic | N/A (not used for training) | n/a | n/a | 2026-07-02 | DPA 6.2 | Vendor Risk |
| Zendesk | Yes | Off by default | 2026-08-20 | pending | support case 44812 | Vendor Risk |
| Otter.ai | Unknown | unknown | 2026-09-01 | pending | email to support | IT |
Acceptance criteria
- ✓Every vendor that could train on your data has a row with a current status.
- ✓Confirmed opt-outs point to written evidence, not a sales assurance.
- ✓Pending items have an owner and are chased.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The dependency inventory is the shadow and third-party AI inventory for external APIs and embedded models.
The contract review checklist evidences which AI-specific clauses are in place across the estate.
The opt-out log documents whether your data feeds vendor training, per data provenance requirements.
The "model change notification" checklist row establishes the hook for ongoing vendor governance-change monitoring.
The inventory makes provider concentration visible for a concentration-risk assessment.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.
Decide what to implement next
Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.
Start the AI governance assessment →