AI Vendor Due Diligence

Most organizations acquire AI through vendors rather than building it in-house. This creates a governance gap: buyers assume providers have handled compliance, but deployers bear their own obligations under the EU AI Act, GDPR, and sector-specific rules. Lexara closes this gap with structured vendor due diligence.

Vendor risk assessment framework: Lexara's vendor risk assessment framework evaluates AI suppliers across risk tier, data exposure, decision impact, geographic reach, and regulatory maturity. The framework identifies which vendors trigger high-risk obligations, which operate in scope of the EU AI Act, and which require enhanced contract terms or ongoing monitoring.

Contract terms for AI procurement: AI procurement contracts should address liability allocation, model update obligations, transparency deliverables, data processing roles, exit rights, and audit access. Standard SaaS terms rarely cover these items adequately. Lexara reviews draft contracts and proposes amendments that reflect the regulatory obligations specific to each AI use case.

EU AI Act provider obligations: Under the EU AI Act, providers bear primary responsibility for conformity assessments, technical documentation, and CE marking for high-risk AI systems. Deployers must verify that providers have fulfilled these obligations, follow provider instructions, implement human oversight, and monitor performance. Lexara helps buyers build verification checklists and acceptance criteria.

GDPR data processing considerations: AI vendor contracts should address data processing roles (controller/processor), lawful basis for processing, data minimization, retention limits, subprocessor governance, security measures, breach notification, audit rights, and cross-border transfer safeguards. These provisions are especially critical for HR AI, financial AI, and health AI systems.

Documentation requirements: Buyers should request technical documentation, risk management system records, data governance descriptions, transparency information, human oversight instructions, and conformity assessment evidence. For high-risk AI under the EU AI Act, this documentation is essential for the deployer's own compliance obligations. Lexara provides request templates and review criteria.

Ongoing monitoring and change management: Ongoing monitoring should include periodic review of vendor updates, model change notifications, incident reports, performance drift, bias audit results, and compliance with evolving regulatory requirements. Contracts should specify the vendor's obligation to notify buyers of material changes that affect risk classification or compliance. Lexara designs monitoring workflows and escalation procedures.