AI Vendor Due-Diligence Questionnaire Template

Your vendors are turning on AI features faster than your due-diligence process can keep up, and most reviews still end the same way: a rating of high, medium, or low that nobody can defend to a board or an examiner. This free checklist changes what the review produces. Work through seven sections built on the NIST AI Risk Management Framework and the questions Rivial's consultants ask in real vendor reviews, count your gaps, then turn the answers into a dollar exposure figure in about 15 minutes. Use it for new vendors, for renewals, and any time a tool you already use turns on an AI feature.

What's included

1. The seven-section review: tiering, data handling and residency, access controls, model integrity, governance and legal, incident response, and ongoing monitoring, each with an evidence column so every answer is documented, not just checked.
2. Simple risk tiering: a Tier 1/2/3 system based on confidentiality, integrity, and availability, with a review depth and cadence for each tier. No complicated scoring matrix.
3. Risk category mapping: every section tied to the AI risk category it protects (data issues, model training, vendor breach, and more), with a plain-English line on what it costs when that control fails.
4. The 15-minute dollar exposure worksheet: an eight-line calculation that turns your gap count into an expected annual loss figure, with a worked credit union example showing roughly $1.1 million per year in measured risk reduction from one review.
5. Four program metrics: review coverage, open gaps, total AI vendor exposure in dollars, and cycle time, so you can show the board the risk is going down quarter over quarter.
6. Examiner mapping: the five questions examiners actually ask about vendor AI, and exactly which part of the completed checklist answers each one.