A no-training promise answers one question. A vendor whose AI acts for your firm has to answer many more.
As AI moves from holding client information to carrying out work, vendor diligence has to cover two things: access to data and authority to act.
Inside this issue
- An execution-evidence checklist: permitted action, authorization, boundary test, completion record, and how to revoke access
- Why to ask vendors to demonstrate a blocked action rather than describe one
- What a SOC 2 report shows, and what it does not (it does not show AI accuracy)
- The trade-off of consolidating vendors: simpler oversight, concentrated dependency
The chartbook is free, with no form. Read it in your browser or download the PDF for your next vendor review.
