---
title: "AI vendor confidentiality and privilege questions (short form of the vendor due-diligence questionnaire)"
url: "https://ailawframework.com/precedents/confidentiality-and-client-information/ai-vendor-due-diligence-questionnaire"
type: "precedent"
site: "AI Law Framework"
id: "a51-ai-vendor-due-diligence-questionnaire"
area_id: "A51"
kind: "checklist"
ai_level: "yellow"
version: 1
law_stated_as_at: "2026-10-17"
---

# AI vendor confidentiality and privilege questions (short form of the vendor due-diligence questionnaire)

> Short-form vendor questions on confidentiality only: training and other use of firm data, retention and deletion, location and sub-processors, matter access and information barriers, court conditions for restricted…

Canonical page: https://ailawframework.com/precedents/confidentiality-and-client-information/ai-vendor-due-diligence-questionnaire  
Law stated as at: 2026-10-17

Site index for agents: https://ailawframework.com/llms.txt

Short-form vendor questions on confidentiality only: training and other use of firm data, retention and deletion, location and sub-processors, matter access and information barriers, court conditions for restricted material, confidentiality terms and incident notice.

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Confidentiality & client information](https://ailawframework.com/precedents/confidentiality-and-client-information.md)
- Jurisdictions: Australia, New South Wales
- AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at: 2026-10-17
- Status: Maintained. Checked on 2026-10-17 against the 6 authorities it cites, for Australia and New South Wales.

## When to use it

Use for a new AI feature in an already-approved product, at renewal or on a model or terms change, or for a narrow tool where only confidentiality questions arise. For a new vendor, send the master AI vendor due-diligence questionnaire, which includes these questions.

## How AI may be used

AI may extract the vendor's terms and answers into the scoring table and flag gaps. A lawyer reads the contract, scores the risk and decides whether the tool is approved, and for which data classes.

**AI may:**

- Extract retention, training, sub-processor, location and incident terms from the vendor's documents into Part H with clause references.
- Flag inconsistencies between the vendor's questionnaire answers and its contract or online terms.
- Track vendor changes (new sub-processors, model changes) against the approved profile.

**AI must not:**

- Must not score the vendor or approve the tool.
- Must not be given client data to test the vendor's tool before approval.
- Must not rely on the vendor's security or privacy web pages as contractual commitments.

**The lawyer checks:**

- Every "yes" on training, retention and location is backed by a contract clause.
- The para 9A and GPN-AI para 4.15 conditions are met before the tool is approved for restricted material.
- Information barriers and matter permissions are enforced by the tool, and this was tested.

## Authorities

- [Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 r 9 (confidentiality) and r 10.2 (information barriers)](https://legislation.nsw.gov.au/view/html/inforce/current/sl-2015-0244)
- [Privacy Act 1988 (Cth) Sch 1 APPs 1, 6, 8 and 11, and s 16C](https://www.legislation.gov.au/C2004A03712/latest/text)
- [OAIC, Guidance on privacy and the use of commercially available AI products (October 2024)](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)
- [Supreme Court of NSW Practice Note SC Gen 23 – Use of Generative Artificial Intelligence (Gen AI) para 9A (conditions for restricted material)](https://supremecourt.nsw.gov.au/documents/Practice-and-Procedure/Practice-Notes/general/current/PN_SC_Gen_23.pdf)
- [Federal Court of Australia, Use of Generative Artificial Intelligence Practice Note (GPN-AI) (16 April 2026) paras 4.13 to 4.15](https://www.fedcourt.gov.au/law-and-practice/practice-documents/practice-notes/gpn-ai)
- [Law Society of NSW, Legal Practice Board of WA and Victorian Legal Services Board and Commissioner, Statement on the use of artificial intelligence in Australian legal practice (6 December 2024)](https://lsbc.vic.gov.au/news-updates/news/statement-use-artificial-intelligence-australian-legal-practice)

## Official form

[Official form](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/confidentiality-and-client-information/ai-vendor-due-diligence-questionnaire and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*