# Third-Party AI Inventory and Contract Review Checklist The estate-wide view of external AI: every API and embedded model in use, the state of each contract against the clauses that matter, and whether the training-data opt-out is actually confirmed. Complements the per-vendor due diligence kit. **Who this is for:** The third-party risk owner who needs to know the whole external AI exposure, not one vendor at a time. Source playbook: https://aigovernance.com/playbook/managing-third-party-ai-risk --- ## External AI dependency inventory _One row per external AI API or vendor-embedded model. The portfolio, with contract and opt-out status visible._ ### Template | Dependency | Provider | Use case | Data sent | Risk tier | Contract review status | Training-data opt-out | |---|---|---|---|---|---|---| | | | | | Minimal / Limited / High | Not started / In review / Complete | Confirmed / Requested / Not available / N/A | ### Worked example | Dependency | Provider | Use case | Data sent | Risk tier | Contract review status | Training-data opt-out | |---|---|---|---|---|---|---| | Chat completion API | Anthropic | Contract summarization | Counterparty names, terms | Minimal | Complete | Confirmed (DPA 6.2) | | Zendesk AI | Zendesk | Support reply drafting | Tickets, order metadata | Limited | In review | Requested 2026-08-20 | | Embedded resume parser | Greenhouse | CV to structured fields | Candidate CVs | High | Complete | Confirmed | | Meeting summarizer | Otter.ai | Call notes | Meeting audio, names | Limited | Not started | Not available | ### Acceptance criteria - Every external AI API and every vendor-embedded AI feature is listed, drawn from the AI inventory. - Contract review status and opt-out status are tracked per row, not assumed. - High and Limited rows without a complete contract review have an owner and a date. --- ## AI API contract review checklist _A fast triage of one agreement against the clauses that matter for an external AI API._ ### Template | Clause | Present? | Acceptable? | Note | |---|---|---|---| | Training-data use (our data not used to train by default, or opt-out) | Y / N | Y / N | | | Data retention and deletion of prompts and outputs | Y / N | Y / N | | | Data location and transfer mechanism | Y / N | Y / N | | | Model change notification | Y / N | Y / N | | | Liability cap and IP indemnification for AI outputs | Y / N | Y / N | | | Incident notification window | Y / N | Y / N | | | Sub-processor list and change notice | Y / N | Y / N | | | Audit or evidence rights | Y / N | Y / N | | ### Worked example | Clause | Present? | Acceptable? | Note | |---|---|---|---| | Training-data use | Y | Y | Not used for training per MSA 9.1 | | Retention and deletion | Y | Y | 30 days, then deleted | | Data location and transfer | Partial | N | US only; need EU option, raised with vendor | | Model change notification | N | N | Changelog only; redline drafted | | Liability and IP indemnity | Y | N | IP claims inside the general cap; want a carve-out | | Incident notification | Y | Y | 24h | | Sub-processor notice | Y | Y | 30-day notice | | Audit rights | Y | Y | Annual questionnaire + SOC 2 | ### Acceptance criteria - Each clause is checked against the signed agreement, not the vendor summary. - Every "not acceptable" has a redline in progress or an approved decision to accept. - The checklist result updates the contract review status on the inventory. --- ## Training-data opt-out tracking log _Proof that opt-out was pursued and confirmed for every vendor where it applies._ ### Template | Vendor | Opt-out available? | Default state | Requested on | Confirmed on | Evidence | Owner | |---|---|---|---|---|---|---| | | Yes / No / Unknown | On / Off by default | YYYY-MM-DD | YYYY-MM-DD | | | ### Worked example | Vendor | Opt-out available? | Default state | Requested on | Confirmed on | Evidence | Owner | |---|---|---|---|---|---|---| | Anthropic | N/A (not used for training) | n/a | n/a | 2026-07-02 | DPA 6.2 | Vendor Risk | | Zendesk | Yes | Off by default | 2026-08-20 | pending | support case 44812 | Vendor Risk | | Otter.ai | Unknown | unknown | 2026-09-01 | pending | email to support | IT | ### Acceptance criteria - Every vendor that could train on your data has a row with a current status. - Confirmed opt-outs point to written evidence, not a sales assurance. - Pending items have an owner and are chased. --- ## Governance controls this kit produces evidence for - **PRC-014**: The dependency inventory is the shadow and third-party AI inventory for external APIs and embedded models. - **PRC-002**: The contract review checklist evidences which AI-specific clauses are in place across the estate. - **DGC-001**: The opt-out log documents whether your data feeds vendor training, per data provenance requirements. - **PRC-007**: The "model change notification" checklist row establishes the hook for ongoing vendor governance-change monitoring. - **PRC-009**: The inventory makes provider concentration visible for a concentration-risk assessment.