# AI supplier assessment

## Service

- Supplier / product / version:
- Authorized use cases:
- Prohibited use cases:
- Internal owner:
- Review / renewal date:

## Data and privacy

- accepted and prohibited data;
- processing and storage regions;
- retention, deletion, and export;
- use for training or improvement;
- subprocessors and change notification;
- international transfers and safeguards;
- audit rights and evidence of deletion.

## Security and operations

- authentication, SSO, roles, and service accounts;
- encryption, logging, and administrative access;
- tenant isolation;
- incident notification and cooperation;
- availability, limits, backup, and recovery;
- model changes, deprecation, and compatibility;
- available tests, certifications, and reports.

## Commercial and exit

- total cost and consumption limits;
- ownership of inputs, outputs, and configurations;
- portability of data and evaluations;
- technical dependencies;
- exit time and cost;
- replacement solution;
- liability, caps, and critical clauses.

## Decision

- Unresolved risks:
- Compensating controls:
- Approved / conditional / rejected use:
- Decision-maker and date: