---
title: "AI vendor due-diligence questionnaire for law firms (master version)"
url: "https://ailawframework.com/precedents/ai-decision-systems/ai-vendor-due-diligence-questionnaire"
type: "precedent"
site: "AI Law Framework"
id: "a45-ai-vendor-due-diligence-questionnaire"
area_id: "A45"
kind: "checklist"
ai_level: "yellow"
version: 1
law_stated_as_at: "2026-10-17"
---

# AI vendor due-diligence questionnaire for law firms (master version)

> Master questionnaire to send to AI vendors before approval: model and hosting, use of firm data, confidentiality, privilege, matter access and court-order fit, security, privacy and cross-border transfers, accuracy,…

Canonical page: https://ailawframework.com/precedents/ai-decision-systems/ai-vendor-due-diligence-questionnaire  
Law stated as at: 2026-10-17

Site index for agents: https://ailawframework.com/llms.txt

Master questionnaire to send to AI vendors before approval: model and hosting, use of firm data, confidentiality, privilege, matter access and court-order fit, security, privacy and cross-border transfers, accuracy, bias, human oversight, agentic features, IP and contract terms.

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [AI decision systems](https://ailawframework.com/precedents/ai-decision-systems.md)
- Jurisdictions: Australia, European Union
- AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at: 2026-10-17
- Status: Maintained. Checked on 2026-10-17 against the 7 authorities it cites, for Australia and European Union.

## When to use it

Send before piloting any AI tool that will receive client or firm confidential information, and again at renewal or when the vendor materially changes its model or terms. Score the answers and attach them to the register entry.

## How AI may be used

AI can compare vendor answers with the vendor's contract and documentation and flag gaps and inconsistencies, but the firm's reviewers score the answers and decide whether the tool is acceptable.

**AI may:**

- Compare questionnaire answers with the contract, data processing terms and security reports and list inconsistencies.
- Flag unanswered questions and answers that are vague ("industry standard", "where appropriate").
- Draft follow-up questions for the reviewer to approve.

**AI must not:**

- Must not score or approve the vendor.
- Must not accept vendor statements that are not reflected in the contract as verified.
- Must not be given the vendor's confidential security reports in a tool not approved for that information.

**The lawyer checks:**

- Every critical answer (training, retention, location, breach notification, vendor access) is backed by a contract clause.
- Security assurance reports are current and cover the product used.
- Residual risks and conditions are recorded on the register.

## Authorities

- [Privacy Act 1988 (Cth) Sch 1 APPs 1, 6, 8 and 11](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) Pt IIIC (notifiable data breaches)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 r 9 (confidentiality)](https://legislation.nsw.gov.au/view/html/inforce/current/sl-2015-0244#rule.9)
- [OAIC, Guidance on privacy and the use of commercially available AI products (October 2024)](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)
- [Statement on the use of artificial intelligence in Australian legal practice (Law Society of NSW, Legal Practice Board of WA and Victorian Legal Services Board + Commissioner, 6 December 2024)](https://lsbc.vic.gov.au/news-updates/news/statement-use-artificial-intelligence-australian-legal-practice)
- [National AI Centre, Planning tools and templates (including "Questions to ask AI suppliers", April 2026)](https://www.ai.gov.au/practical-guides-and-learning/planning-tools-and-templates)
- ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 27001:2022 (information security management) (cited only)

## Official form

[Official form](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/ai-decision-systems/ai-vendor-due-diligence-questionnaire and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*