Checklist · In-House / General Counsel

AI vendor due diligence questionnaire (United States)

Questions for a vendor of a generative or agentic AI tool, drawn from the confidentiality, security, retention and supervision points in Formal Opinion 512 and Model Rule 5.3. Answers are taken from the contract, not from a brochure.

Kind: Checklist. Steps or checks to work through and tick off.
Where it applies: United States
AI use: Yellow You and the tool draft together, with you directing. You check every statement you rely on.
Law stated as at: 22 October 2026
Status: Maintained. Checked on 22 October 2026 against the 6 authorities it cites, for United States.
Version: 1
Source: Written for this library

When to use it

Use when an in-house lawyer, or a firm, is deciding whether a tool may receive information relating to a representation or other confidential company information. Send it to the vendor and keep the answers with the contract. It does not approve the tool by itself.

Used for these tasks

Each task page says how far AI may help with the task and what the lawyer must review.

How AI may be used

A tool may sort the vendor's written answers against the questions and mark blanks. The lawyer decides whether the answers are good enough, and whether any company or client information may be put into the tool.

AI may

Place each vendor answer next to the question it claims to answer, and flag a question with no answer
Quote the contract clause the vendor cites, if the contract is in the file the lawyer supplies
List answers that cite a marketing page rather than a contract clause

AI must not

Must not grade the vendor as acceptable or recommend approval
Must not fill a missing answer by asking the same vendor's public chatbot
Must not send the company's or a client's documents to the vendor as part of the questionnaire
Must not treat a standard security claim as a contractual promise unless the contract says it

The lawyer checks

Every answer the decision relies on is in the contract, an order form, or a signed vendor letter, and that document is filed
Training on inputs, retention after the contract ends, and who else can see inputs are answered, even if the answer is that the vendor will not agree
Any ability of the tool to send, file or reach other systems is turned off unless a person reviews each step
Privilege and confidentiality are addressed before the tool is pointed at a legal file or a company mailbox

Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.

Authorities

Read the full text

The full text is available after you log in. It is free. When you log in you can:

read the whole precedent, with its drafting notes beside it;
copy it, or download it as a Word file or Markdown;
add it to your firm’s knowledge base, so colleagues can find it;
let the AI tools you connect read it from that knowledge base.

The summary, the law it rests on and the AI-use guidance above stay public. Privacy.

More in In-House / General Counsel

All precedents for In-House / General Counsel · Tasks and AI use in this area