Checklist · AI decision systems
AI vendor due-diligence questionnaire for law firms (master version)
Master questionnaire to send to AI vendors before approval: model and hosting, use of firm data, confidentiality, privilege, matter access and court-order fit, security, privacy and cross-border transfers, accuracy, bias, human oversight, agentic features, IP and contract terms.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia, European Union
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Send before piloting any AI tool that will receive client or firm confidential information, and again at renewal or when the vendor materially changes its model or terms. Score the answers and attach them to the register entry.
How AI may be used
AI can compare vendor answers with the vendor's contract and documentation and flag gaps and inconsistencies, but the firm's reviewers score the answers and decide whether the tool is acceptable.
AI may
- Compare questionnaire answers with the contract, data processing terms and security reports and list inconsistencies.
- Flag unanswered questions and answers that are vague ("industry standard", "where appropriate").
- Draft follow-up questions for the reviewer to approve.
AI must not
- Must not score or approve the vendor.
- Must not accept vendor statements that are not reflected in the contract as verified.
- Must not be given the vendor's confidential security reports in a tool not approved for that information.
The lawyer checks
- Every critical answer (training, retention, location, breach notification, vendor access) is backed by a contract clause.
- Security assurance reports are current and cover the product used.
- Residual risks and conditions are recorded on the register.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in AI decision systems
- Law firm AI use policy (master firm policy)
- Approved AI tools register (template with field guide)
- AI incident response procedure for law firms (master procedure for all AI incidents)
- AI decision system impact and fairness assessment (firm or client systems)
- Privacy policy clause on automated decisions (APP 1.7 to 1.9, from 10 December 2026)
All precedents for AI decision systems · Tasks and AI use in this area