Purpose and use
An AI-enabled vendor cannot answer customer security, architecture, data-use, human-oversight, and change-management questions consistently.
Who should use it
Enterprise, Partner decision owners, technical owners, reviewers, and delivery partners.
Decision supported
An AI-enabled vendor cannot answer customer security, architecture, data-use, human-oversight, and change-management questions consistently.
Product and data
For each item, record the responsible owner, evidence, and whether the answer is Yes, Partly, No, Unknown, or Not applicable when the worksheet format supports it.
- Intended use and prohibited use
- Model and vendor inventory
- Data flow, storage, retention, and training-use terms
- Tenant and role access boundaries
- Subprocessors and external dependencies
Behavior and control
For each item, record the responsible owner, evidence, and whether the answer is Yes, Partly, No, Unknown, or Not applicable when the worksheet format supports it.
- Representative evaluation cases and results
- Human review and action authority
- Prompt, model, and data change control
- Logging, incident, rollback, and support boundaries
- Known limitations and refusal behavior
Response package
For each item, record the responsible owner, evidence, and whether the answer is Yes, Partly, No, Unknown, or Not applicable when the worksheet format supports it.
- System card
- Architecture and data-flow diagrams
- Technical response library
- Risk register and decision owners
- Last-reviewed dates and source owners