Tiered Due Diligence & Contract Requirements Library
A practitioner reference mapping due diligence depth and contract clauses across the four vendor tiers. Designed for the AI governance lead operationalising Steps 4 and 5 of the vendor governance architecture playbook — calibrating proportionate scrutiny and codifying non-negotiable versus tier-dependent terms before procurement sprawl sets in.
- Format
- DOC
- Access
- Pro
Reference document
Tiered Due Diligence & Contract Requirements Library
A practitioner reference mapping due diligence depth and contract clauses across the four vendor tiers. Designed for the AI governance lead operationalising Steps 4 and 5 of the vendor governance architecture playbook — calibrating proportionate scrutiny and codifying non-negotiable versus tier-dependent terms before procurement sprawl sets in.
Document ID
DOC-0018
Category
General
Access tier
PRO
Date
13 August 2026
Step 4: Tiered Due Diligence Protocols — Proportionate Scrutiny, Not Blanket Friction
The four-tier classification from Step 2 determines how deep due diligence goes. The guiding principle is proportionate scrutiny: match evidentiary burden to actual risk exposure. A Tier 1 vendor adding a summarisation feature to existing SaaS should clear diligence in days. A Tier 4 foundation model provider with access to your training data warrants weeks of structured assessment. Over-burdening Tier 1 creates procurement friction that drives business units to shadow IT. Under-scrutinising Tier 4 creates existential risk.
Due Diligence Calibration by Tier
| Domain | Tier 1: Embedded AI in SaaS | Tier 2: AI-Enabled Tools | Tier 3: AI Platforms & Infrastructure | Tier 4: Foundation Models / Custom Training |
|---|---|---|---|---|
| Data handling | Attestation: no customer data used for model training | Structured questionnaire: data flows, retention, deletion | Data processing impact assessment; architecture review | Full data lineage audit; training data provenance; deletion verification |
| Model transparency | Vendor discloses AI feature exists and what it does | Model card or equivalent; input/output logging capabilities | Architecture documentation; model versioning policy; update notification terms | Full model documentation; evaluation results; known limitations; update impact assessment |
| Bias testing | Vendor attestation that testing occurs | Summary of methodology and results | Independent bias audit or contractual right to conduct one | Mandatory independent bias audit; ongoing monitoring commitments; remediation SLAs |
| IP indemnification | Standard IP indemnity in master agreement | IP indemnity covering AI-generated outputs | IP indemnity with carve-outs for customer-provided training data | Full IP indemnity; training data IP warranties; output ownership clarity |
| Sub-processor chain mapping | Vendor lists sub-processors in DPA | Current sub-processor list with notification rights | Sub-processor chain mapping with change notification; right to object | Full chain mapping including infrastructure providers; prior approval rights |
Continue with a free account
This document is part of our Pro client library. A free account gives you access to all free resources only — to unlock the full library, become a client.
Free accounts unlock free resources only.
Get this document
Available to Pro clients. A free account covers free resources only.
Become a clientDocument info
- Format
- DOCPDF export
- Access tier
- Pro
- Category
- General
- Published
- 13 August 2026