# AI Vendor Monitoring Schedule and Contract Checklist Managing an AI vendor from map to requalification. A vendor map with risk classification, the five contract clauses that matter with negotiation notes, and a risk-based monitoring schedule with requalification triggers. **Who this is for:** The vendor manager who owns AI vendors across their whole life, not just onboarding. Source playbook: https://aigovernance.com/playbook/managing-third-party-ai-vendors-safely --- ## AI vendor map _Every external AI dependency, classified by what it touches and what it decides._ ### Template | Vendor | Dependency type | Decisions influenced | Data shared | Risk tier | Contract status | Last review | |---|---|---|---|---|---|---| | | API / embedded SaaS AI / hosted fine-tune | | | Minimal / Limited / High | Draft / Signed / Renewal due | YYYY-MM-DD | ### Worked example | Vendor | Dependency type | Decisions influenced | Data shared | Risk tier | Contract status | Last review | |---|---|---|---|---|---|---| | Greenhouse | Embedded SaaS AI | Applicant ranking | Candidate CVs | High | Signed | 2026-08-30 | | Anthropic | API | None (summaries only) | Contract text | Minimal | Signed | 2026-07-02 | | FraudCo | Hosted fine-tune | Transaction hold / release | Transaction + KYC data | High | Renewal due 2026-11 | 2026-06-15 | ### Acceptance criteria - The map covers APIs, embedded SaaS AI, and vendor-hosted fine-tuned models. - Risk tier reflects both the data shared and the decisions the vendor influences. - Every High-tier vendor has a review date within the last 12 months. --- ## Five key clauses library _The five AI vendor clauses, why each matters, and the position to hold in negotiation._ ### Template | Clause | Why it matters | Negotiation note | Fallback | |---|---|---|---| | Training-data opt-out | Stops your data improving the vendor model | Ask for contractual, not a UI toggle | Documented opt-out + deletion right | | Output ownership | Confirms you own generated outputs and inputs | Vendors usually concede | You own inputs and outputs; vendor gets a service-improvement licence only if de-identified | | Change notification | Time to re-test before a model shifts | Vendors resist advance notice | 30 days for material model or safety changes | | Indemnification | Allocates IP and harmful-output risk | Tie to the vendor's control of training data | IP-infringement carve-out from the liability cap | | Audit rights | Lets you verify claims | On-site is rare; accept evidence-based | Annual questionnaire + third-party report + records on request | ### Worked example | Clause | Status with FraudCo | Note | |---|---|---| | Training-data opt-out | Secured | Contractual, MSA 9.1 | | Output ownership | Secured | We own model outputs and case data | | Change notification | Open | Vendor offered 10 days; holding for 30 for model changes | | Indemnification | Open | Negotiating IP carve-out from the cap | | Audit rights | Secured | Annual questionnaire + SOC 2 + right to records | ### Acceptance criteria - All five clauses are assessed against the current contract for every material vendor. - Negotiation positions are agreed with Legal before talks start. - Open clauses have an owner and a target close date tied to the renewal calendar. --- ## Vendor monitoring schedule _Review cadence by risk tier, plus the events that force an out-of-cycle requalification._ ### Template | Vendor | Risk tier | Review cadence | Next review | Requalification triggers | |---|---|---|---|---| | | High | Every 6 months | YYYY-MM-DD | major model update; safety-posture change; incident; ownership change | | | Limited | Annual | YYYY-MM-DD | material model update; contract renewal | | | Minimal | At renewal | YYYY-MM-DD | contract renewal | ### Worked example | Vendor | Risk tier | Review cadence | Next review | Requalification triggers | |---|---|---|---|---| | Greenhouse | High | Every 6 months | 2027-02-28 | model swap; new sub-processor; bias-audit failure | | FraudCo | High | Every 6 months | 2026-12-15 | model update; SOC 2 lapse; funding event | | Anthropic | Minimal | At renewal | 2027-07-02 | model deprecation affecting our integration | ### Acceptance criteria - Cadence scales with risk tier and is on someone's calendar. - Requalification triggers are specific events, and firing one starts a review regardless of the schedule. - A completed review updates the vendor map's last-review date. --- ## Governance controls this kit produces evidence for - **PRC-001**: The vendor map and its review history are the due diligence record across the vendor lifecycle. - **PRC-002**: The five-clauses library is the contractual requirements standard with negotiation positions. - **PRC-007**: The monitoring schedule and requalification triggers are the vendor governance-change monitoring process. - **PRC-008**: "Major model update" as a requalification trigger implements the vendor model-update disclosure and re-assessment protocol. - **PRC-004**: "Incident" as a trigger plus the review cadence support vendor incident notification handling.