--- title: "AI vendor due diligence questionnaire (United States)" url: "https://ailawframework.com/precedents/in-house-general-counsel/us-ai-vendor-due-diligence-questionnaire" type: "precedent" site: "AI Law Framework" id: "a40-us-ai-vendor-due-diligence-questionnaire" area_id: "A40" kind: "checklist" ai_level: "yellow" version: 1 task_ids: ["A40-B7-1", "A40-T1-R12", "A40-B8-2"] law_stated_as_at: "2026-10-22" --- # AI vendor due diligence questionnaire (United States) > Questions for a vendor of a generative or agentic AI tool, drawn from the confidentiality, security, retention and supervision points in Formal Opinion 512 and Model Rule 5.3.… Canonical page: https://ailawframework.com/precedents/in-house-general-counsel/us-ai-vendor-due-diligence-questionnaire Law stated as at: 2026-10-22 Site index for agents: https://ailawframework.com/llms.txt Questions for a vendor of a generative or agentic AI tool, drawn from the confidentiality, security, retention and supervision points in Formal Opinion 512 and Model Rule 5.3. Answers are taken from the contract, not from a brochure. ## Key facts - Kind: Checklist. Steps or checks to work through and tick off. - Practice area: [In-House / General Counsel](https://ailawframework.com/precedents/in-house-general-counsel.md) - Jurisdictions: United States - AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on. - Law stated as at: 2026-10-22 - Status: Maintained. Checked on 2026-10-22 against the 6 authorities it cites, for United States. ## When to use it Use when an in-house lawyer, or a firm, is deciding whether a tool may receive information relating to a representation or other confidential company information. Send it to the vendor and keep the answers with the contract. It does not approve the tool by itself. ## Used for these tasks - [Evaluate a legal AI tool for the in-house team](https://ailawframework.com/practice/in-house-general-counsel/evaluate-a-legal-ai-tool-for-the-in-house-team.md) - [Draft the organisation's AI-use policy and review an AI-vendor contract](https://ailawframework.com/practice/in-house-general-counsel/draft-the-organisation-s-ai-use-policy-and-review-an-ai-vendor-contract.md) - [Build a legal-team GenAI playbook](https://ailawframework.com/practice/in-house-general-counsel/build-a-legal-team-genai-playbook.md) ## How AI may be used A tool may sort the vendor's written answers against the questions and mark blanks. The lawyer decides whether the answers are good enough, and whether any company or client information may be put into the tool. **AI may:** - Place each vendor answer next to the question it claims to answer, and flag a question with no answer - Quote the contract clause the vendor cites, if the contract is in the file the lawyer supplies - List answers that cite a marketing page rather than a contract clause **AI must not:** - Must not grade the vendor as acceptable or recommend approval - Must not fill a missing answer by asking the same vendor's public chatbot - Must not send the company's or a client's documents to the vendor as part of the questionnaire - Must not treat a standard security claim as a contractual promise unless the contract says it **The lawyer checks:** - Every answer the decision relies on is in the contract, an order form, or a signed vendor letter, and that document is filed - Training on inputs, retention after the contract ends, and who else can see inputs are answered, even if the answer is that the vendor will not agree - Any ability of the tool to send, file or reach other systems is turned off unless a person reviews each step - Privilege and confidentiality are addressed before the tool is pointed at a legal file or a company mailbox ## Authorities - [ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) - [ABA Model Rules of Professional Conduct, Rule 5.3 (Responsibilities Regarding Nonlawyer Assistants)](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_5_3_responsibilities_regarding_nonlawyer_assistant/) - [ABA Model Rules of Professional Conduct, Rule 5.3, Comments 1 to 4](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_5_3_responsibilities_regarding_nonlawyer_assistant/comment_on_rule_5_3/) - [ABA Model Rules of Professional Conduct, Rule 1.6 (Confidentiality of Information)](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) - [ABA Model Rules of Professional Conduct, Rule 1.1 (Competence)](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/) - [State Bar of California, Standing Committee on Professional Responsibility and Conduct, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026 revision, replacing the November 2023 guidance)](https://www.calbar.ca.gov/Portals/0/documents/ethics/Generative-AI-Practical-Guidance.pdf) ## Full text and drafting notes The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/in-house-general-counsel/us-ai-vendor-due-diligence-questionnaire and through the signed-in MCP connector https://ailawframework.com/mcp/firm. *Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*