What This Form Does

This two-part document serves as both a due-diligence tool and a contractual supplement for procuring AI-powered services. The questionnaire systematically evaluates an AI vendor’s model architecture, training-data provenance, bias testing, security posture, data handling, output accuracy, and regulatory compliance. The contract addendum then converts the vendor’s responses into binding obligations that attach to your existing service agreement.

Together, they cover model transparency and explainability, training-data sourcing and rights, input-data processing and retention, output ownership and IP allocation, bias and fairness testing, security and access controls, performance monitoring and drift detection, incident response for AI failures, subprocessor and model-provider chain, and regulatory compliance including the EU AI Act.

Why Startups Need This

AI vendors present risks that traditional vendor assessments do not cover. Standard security questionnaires ask about encryption and access controls but not about whether the vendor trains on your data, who owns AI-generated outputs, how the model was tested for bias, or what happens when the model produces harmful or inaccurate results. Without AI-specific diligence, you may be exposing customer data to model training, deploying biased algorithms in regulated decisions, or building on technology with unresolved IP provenance.

The regulatory landscape is accelerating rapidly. The EU AI Act imposes specific obligations on deployers of AI systems, and US state laws are increasingly regulating automated decision-making. A structured AI vendor assessment positions your startup to meet these obligations and demonstrates responsible AI governance to customers, investors, and regulators.

2025–2026 Emerging Provisions

EU AI Act Supplier Obligations. Maps questionnaire and addendum requirements to the EU AI Act’s obligations for providers and deployers of AI systems, including risk classification, conformity assessment, technical documentation, and post-market monitoring requirements that flow down through the vendor chain.

Foundation-Model Supply-Chain Risk. Addresses the layered risk when your AI vendor itself depends on a foundation-model provider, requiring transparency about the underlying model, flow-down of data-use restrictions, and contingency planning for model discontinuation or terms changes.

Automated Decision-Making Accountability. Covers the growing body of US state and federal requirements for transparency, human oversight, and impact assessments when AI is used in decisions affecting consumers, employees, or regulated activities — including CCPA/CPRA profiling rights and state-specific algorithmic accountability laws.

How to Use This Template

Download the .docx file and complete all bracketed fields. Start with the questionnaire — send it to your AI vendor before contract negotiations so their responses inform the addendum terms. The Matter Control Sheet captures your use case, data sensitivity, regulatory environment, and risk tolerance, which determine which questionnaire sections are mandatory versus optional for your procurement.

Use the vendor’s questionnaire responses to populate the addendum’s binding commitments. If the vendor claims they do not train on customer data, the addendum should contractually prohibit it. If they report specific bias-testing methodologies, the addendum should require continued testing at defined intervals. The addendum is designed to attach to your existing MSA or SaaS agreement — it supplements rather than replaces your base contract.

---

This template is provided for informational and educational purposes only and does not constitute legal advice. Consult a qualified attorney licensed in your jurisdiction before using any legal document. Montague Law provides this resource as part of the largest free open-source startup legal template library.