Field note
AI Chatbot Vendor Due Diligence Checklist
Turn vendor claims into workflow-specific questions about data, identity, tools, limits, support and exit.
Turn vendor claims into workflow-specific questions about data, identity, tools, limits, support and exit.
Start from the workflow, not the brochure
Every AI vendor's security page says the same things: encrypted in transit and at rest, SOC 2, "we do not train on your data". Those statements may all be true and still tell you nothing about whether the product is safe for the job you have in mind. Due diligence is easier and more useful when you write down the workflow first: who will use it, what data will go in, what it is allowed to do, and what happens when it is wrong.
Under UK GDPR, a chatbot vendor processing your customer or staff data is normally your processor, and you remain the controller. The ICO expects a written contract with specific terms and expects you to have checked that the processor can meet them. The NCSC's supply chain guidance says much the same for security. The checklist below turns those expectations into questions a small business can ask and a vendor can answer.
The checklist
Data
- Is our data used to train or improve models, and can we turn that off at workspace level? Consumer defaults often differ from business plans. Get the answer for the plan you are buying, in writing, and check the admin setting yourself during the trial.
- Where is data stored and processed, and does that meet our transfer requirements? Ask for the region options and how they are enforced.
- How long are prompts, files and conversations retained, and can an admin set or shorten that? Retention for "abuse monitoring" is common; find out how long and who can access it.
- Who are the subprocessors, and how are we told when they change? Ask for the current list and the notification mechanism.
- Can we export and delete all our data, including on exit, and how long does deletion take? Test the export during the trial. A vendor that cannot show you the export is telling you something.
Identity and access
- Does it support single sign-on and SCIM or equivalent provisioning on our plan? Shared logins and manual off-boarding are where leaks start.
- What roles exist, and can we separate admin, billing and user? One person with every right is fine in a five-person firm and a problem in a fifty-person one.
- Can an admin see and control which connectors, tools and integrations users may enable? This is the difference between a chatbot and an agent with access to your file store.
Tools and actions
- What can the product do, not only say? List every action it can take in connected systems. For each, ask whether an admin can disable it and whether it can require human approval.
- How does the vendor handle prompt injection from documents, web pages and email? Expect a real answer about isolation and permissions, not "our model is trained to be safe".
Limits and reliability
- What are the usage limits, rate limits and fair-use rules for our plan, and where are they published? They change often; at the time of writing, the vendor's plan page is the only reliable source.
- Is there a status page, an SLA, and a documented incident-notification process with timescales? Ask when they last notified customers of an incident and how.
Support and exit
- What support do we get, at what hours, and in what language? UK business hours matter for a UK team.
- What are the notice period, price-change terms and exit rights? Watch for auto-renewal and for terms that let the vendor change the model or features without notice.
- What happens to our configuration, prompts and knowledge base if we leave? Ask whether they can be exported in a usable form.
Verify, do not just ask
A questionnaire is a starting point. During the trial, check three things yourself: the training and retention settings in the admin console, the export, and one deliberate attempt to make the bot do something it should not, such as reading a document that tells it to email data out. Record what you found and who checked it.
Where a vendor publishes a trust portal or compliance documentation, read the actual reports rather than the badges. If they will only share under NDA, that is normal; sign it and read them.
Score by workflow
Not every answer needs to be perfect. Score each item as pass, pass with a control, or fail, and decide against the workflow. A vendor with weak SSO may be fine for a marketing drafting tool used by three people and unacceptable for a customer-facing bot connected to your CRM. Write the decision down with the date, so the next person to ask "why did we pick this?" has an answer.
Our note on ChatGPT retention and delete versus archive is an example of the level of detail worth checking on a single vendor setting. If you want the checklist turned into a repeatable procurement standard with an owner and a review cycle, that is part of an AI governance review.