AI Vendor Monitoring Schedule and Contract Checklist

Managing an AI vendor from map to requalification. A vendor map with risk classification, the five contract clauses that matter with negotiation notes, and a risk-based monitoring schedule with requalification triggers.

Who this is for: The vendor manager who owns AI vendors across their whole life, not just onboarding.

Download the kit (Markdown) ↓3 artifacts. Every table also copies as CSV.

1. AI vendor map

Spreadsheet

Every external AI dependency, classified by what it touches and what it decides.

Template

Vendor	Dependency type	Decisions influenced	Data shared	Risk tier	Contract status	Last review
<vendor>	API / embedded SaaS AI / hosted fine-tune	<what it affects>	<data categories>	Minimal / Limited / High	Draft / Signed / Renewal due	YYYY-MM-DD

Worked example

Vendor	Dependency type	Decisions influenced	Data shared	Risk tier	Contract status	Last review
Greenhouse	Embedded SaaS AI	Applicant ranking	Candidate CVs	High	Signed	2026-08-30
Anthropic	API	None (summaries only)	Contract text	Minimal	Signed	2026-07-02
FraudCo	Hosted fine-tune	Transaction hold / release	Transaction + KYC data	High	Renewal due 2026-11	2026-06-15

Acceptance criteria

✓The map covers APIs, embedded SaaS AI, and vendor-hosted fine-tuned models.
✓Risk tier reflects both the data shared and the decisions the vendor influences.
✓Every High-tier vendor has a review date within the last 12 months.

2. Five key clauses library

Spreadsheet

The five AI vendor clauses, why each matters, and the position to hold in negotiation.

Template

Clause	Why it matters	Negotiation note	Fallback
Training-data opt-out	Stops your data improving the vendor model	Ask for contractual, not a UI toggle	Documented opt-out + deletion right
Output ownership	Confirms you own generated outputs and inputs	Vendors usually concede	You own inputs and outputs; vendor gets a service-improvement licence only if de-identified
Change notification	Time to re-test before a model shifts	Vendors resist advance notice	30 days for material model or safety changes
Indemnification	Allocates IP and harmful-output risk	Tie to the vendor's control of training data	IP-infringement carve-out from the liability cap
Audit rights	Lets you verify claims	On-site is rare; accept evidence-based	Annual questionnaire + third-party report + records on request

Worked example

Clause	Status with FraudCo	Note
Training-data opt-out	Secured	Contractual, MSA 9.1
Output ownership	Secured	We own model outputs and case data
Change notification	Open	Vendor offered 10 days; holding for 30 for model changes
Indemnification	Open	Negotiating IP carve-out from the cap
Audit rights	Secured	Annual questionnaire + SOC 2 + right to records

Acceptance criteria

✓All five clauses are assessed against the current contract for every material vendor.
✓Negotiation positions are agreed with Legal before talks start.
✓Open clauses have an owner and a target close date tied to the renewal calendar.

3. Vendor monitoring schedule

Spreadsheet

Review cadence by risk tier, plus the events that force an out-of-cycle requalification.

Template

Vendor	Risk tier	Review cadence	Next review	Requalification triggers
<vendor>	High	Every 6 months	YYYY-MM-DD	major model update; safety-posture change; incident; ownership change
<vendor>	Limited	Annual	YYYY-MM-DD	material model update; contract renewal
<vendor>	Minimal	At renewal	YYYY-MM-DD	contract renewal

Worked example

Vendor	Risk tier	Review cadence	Next review	Requalification triggers
Greenhouse	High	Every 6 months	2027-02-28	model swap; new sub-processor; bias-audit failure
FraudCo	High	Every 6 months	2026-12-15	model update; SOC 2 lapse; funding event
Anthropic	Minimal	At renewal	2027-07-02	model deprecation affecting our integration

Acceptance criteria

✓Cadence scales with risk tier and is on someone's calendar.
✓Requalification triggers are specific events, and firing one starts a review regardless of the schedule.
✓A completed review updates the vendor map's last-review date.

Governance controls this kit produces evidence for

Completing the artifacts above gives you a head start on the evidence requirements for these controls.

PRC-001

The vendor map and its review history are the due diligence record across the vendor lifecycle.

PRC-002

The five-clauses library is the contractual requirements standard with negotiation positions.

PRC-007

The monitoring schedule and requalification triggers are the vendor governance-change monitoring process.

PRC-008

"Major model update" as a requalification trigger implements the vendor model-update disclosure and re-assessment protocol.

PRC-004

"Incident" as a trigger plus the review cadence support vendor incident notification handling.

This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.

Decide what to implement next

Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.

Start the AI governance assessment →