⚙ Technical Capability Assessment

Evaluate the vendor's technical capabilities, AI/ML expertise, and solution maturity.

AI/ML Maturity

Model Development Process
Vendor has documented ML development lifecycle with proper versioning and testing
High
Model Explainability
AI models provide interpretable outputs and decision explanations
High
Performance Benchmarks
Vendor provides documented accuracy, latency, and reliability metrics
Medium

Infrastructure & Scalability

High Availability Architecture
System designed for 99.9%+ uptime with failover mechanisms
High
Scalability Documentation
Clear documentation on scaling capabilities and limitations
Medium
Disaster Recovery Plan
Documented DR procedures with defined RTOs and RPOs
High

Integration & Support

API Documentation
Comprehensive API documentation with SDKs and examples
Medium
Technical Support SLA
Defined support tiers with response time guarantees
Medium
No Vendor Lock-in ⚠ Red Flag if Unchecked
Data portability and exit strategy documented; no proprietary format lock-in
Critical
Reference Customers
Vendor provides referenceable enterprise customers in similar industry
Medium

Technical Assessment Notes

🔒 Security Posture Assessment

Evaluate the vendor's security controls, certifications, and incident response capabilities.

Certifications & Standards

SOC 2 Type II Certification
Current SOC 2 Type II report available for review
High
ISO 27001 Certification
Valid ISO 27001 certification with current scope
High
Penetration Testing
Annual third-party penetration testing with remediation evidence
High

Data Security Controls

Encryption at Rest
AES-256 or equivalent encryption for stored data
Critical
Encryption in Transit
TLS 1.2+ for all data transmission
Critical
Key Management
Secure key management with customer-managed key options
High
Access Controls ⚠ Red Flag if Unchecked
Role-based access control with MFA enforcement
Critical

Incident Response

Incident Response Plan ⚠ Red Flag if Unchecked
Documented incident response procedures with customer notification SLAs
Critical
Breach History Disclosure
Vendor discloses any historical security incidents
High
Security Monitoring
24/7 security monitoring and logging capabilities
High
Vulnerability Management
Regular vulnerability scanning with defined remediation timelines
Medium
Sub-processor Security
Security requirements flow down to all sub-processors
Medium

Security Assessment Notes

⚖ Compliance Status Assessment

Evaluate the vendor's regulatory compliance posture across relevant jurisdictions.

AI-Specific Regulations

EU AI Act Readiness ⚠ Red Flag if Unchecked
Vendor demonstrates EU AI Act compliance roadmap for applicable risk categories
Critical
AI Risk Classification
Vendor has classified AI systems per EU AI Act risk categories
High
Bias & Fairness Testing
Regular bias audits and fairness testing documented
High

Data Protection

GDPR Compliance ⚠ Red Flag if Unchecked
Documented GDPR compliance with DPA available
Critical
Data Processing Agreement
Compliant DPA with appropriate SCCs for international transfers
High
Data Subject Rights
Processes in place to support data subject access, deletion, and portability requests
High
Privacy Impact Assessment
DPIA/PIA conducted for AI processing activities
Medium

Industry-Specific Compliance

Sector Regulations
Compliance with relevant sector regulations (HIPAA, PCI-DSS, financial regulations)
High
Regulatory Audit Trail
Comprehensive audit logging for regulatory evidence
Medium
Third-Party Audits
Regular independent compliance audits conducted
Medium

Compliance Assessment Notes

💰 Financial Stability Assessment

Evaluate the vendor's financial health and business continuity capabilities.

Financial Health

Financial Statements
Audited financial statements available for review
High
Funding & Runway ⚠ Red Flag if Unchecked
Adequate funding with 18+ months runway or profitability
Critical
Revenue Diversification
No single customer represents >25% of revenue
Medium

Business Continuity

Business Continuity Plan
Documented BCP with regular testing
High
Insurance Coverage
Appropriate cyber and E&O insurance coverage
Medium
Key Person Risk
No critical dependency on single individuals
Medium

Market Position

Market Presence
Established market presence with growing customer base
Medium
Exit/Transition Plan
Data portability and transition assistance provisions
High

Financial Assessment Notes

📊 Data Practices Assessment

Evaluate the vendor's data handling, training data practices, and AI-specific data governance.

Training Data Governance

Training Data Provenance ⚠ Red Flag if Unchecked
Clear documentation of training data sources and licensing
Critical
Customer Data Usage ⚠ Red Flag if Unchecked
Clear policy that customer data is NOT used for training without explicit consent
Critical
Data Quality Assurance
Documented data quality processes for training data
High

Data Handling

Data Residency Options
Ability to specify data storage location/jurisdiction
High
Data Retention Policy
Clear data retention and deletion policies
High
Data Segregation
Logical or physical segregation of customer data
High

AI-Specific Data Controls

Input/Output Logging
Appropriate logging of AI inputs and outputs for audit
Medium
Model Versioning
Model version control with rollback capabilities
Medium
Data Lineage
Traceability from input data through model outputs
Medium
Synthetic Data Options
Ability to use synthetic or anonymized data for testing
Low

Data Practices Assessment Notes