Pre-Contract Due Diligence: AI Risk Assessment Before You Sign

For AI vendors, this means the pre-contract phase is where you must do your most thorough AI risk due diligence.

Starting with the IRA

The Inherent Risk Assessment (IRA) is the trigger mechanism for the entire due diligence process. Adding a single question: "Does this vendor use or produce AI or AI-enabled products?” is a simple but critical step. A "yes" answer triggers the AI risk domain, which in turn determines the scope and depth of AI-specific due diligence.

Risk-Tiered Due Diligence

Not all AI vendors pose the same level of risk. A risk-based approach means calibrating your due diligence effort to the vendor's inherent risk level.

Low-risk vendors require only minimal AI-specific review. Key checks include confirmation of encryption at rest and in transit, existence of an AI policy, logging and monitoring practices, and access control governance. A simple attestation from the vendor may be sufficient.

Medium-risk vendors receive everything in the low-risk assessment plus inquiry into whether they operate a Secure Development Life Cycle (SDLC) that incorporates security considerations into AI development.

High-risk vendors receive a comprehensive AI assessment questionnaire aligned to the NIST AI RMF. This includes questions spanning all four core functions: Govern, Map, Measure, and Manage, covering everything from legal and regulatory compliance to incident response, post-deployment monitoring, and model decommissioning.

Critical vendors: those whose failure would materially impair your ability to operate, should receive everything in the high-risk assessment plus a physical validation, whether conducted on-site or virtually through collaboration tools.

Coming up next: AI-specific contract language: what every AI vendor agreement needs.