Use this for one AI vendor and one intended use at a time. You get two documents per vendor in a new folder, ./ai-vendor-due-diligence/: an assessment report saying what the contract really allows the vendor to do with your data and whether to approve, approve with conditions or decline, ending with a ready-to-paste row for the supplier register (<vendor>-assessment.md), and a list of questions the documents leave open, ready for your team to send to the vendor (<vendor>-questions.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The decision to buy, and any risk accepted with it, belongs to the business owner.

Inputs to gather

Read the order form or the plan the company will actually be on, the terms of service, the data processing agreement, the vendor's privacy notice, trust or security documentation, subprocessor list, model or system documentation, and any audit reports the vendor shares. Ask the reader, in one message: what the tool will be used for, which data goes in, whether output affects decisions about people, which plan and account type will be used, and who owns the relationship.

Step 1: size the review to the use

Light: public or internal data only, no decisions about people. Check training use, retention, account type and exit; stop there.
Standard: confidential or customer data, or personal data. The full review below.
Deep: decisions about people, health or financial data, or a use that may be high-risk under the EU AI Act. The full review, plus the vendor's evaluation evidence for this use and its instructions for use.

Record the tier and why. Most AI purchases are standard; a deep review of a meeting summariser is wasted effort, and a light review of a candidate screening tool is negligence.

Step 2: read the documents before asking anything

Answer each question from the documents first, citing section and document. Draft questions only for what the documents leave open; the relationship owner sends them.