← All documentation

Vendors and AI due diligence

The vendor register is included in Premium and Enterprise, and it works on
the Free plan too. The data
processing agreement between your organization and us is separate from the
agreements you record here.

Most of the AI an organization uses is bought, not built: an AI product, a model behind an API, or an AI feature switched on inside software you already use. The Vendors area tracks each third party, what AI it supplies, whether it trains on your data, and the agreement you hold with it, so a gap does not slip past you.

A vendor record

Each vendor holds its services, data access (none / limited / full), a risk level (low → critical), a status (active / under review / terminated), and two AI due-diligence answers:

  • AI supplied: no AI, AI inside another product, an AI product, or a model.
  • Trains on your data?: does not, trains unless you opt out, trains on your data, or not yet known. Not yet known is where every vendor starts. For a vendor that supplies AI it is flagged until the vendor's terms or questionnaire answer it, because it is the question due diligence exists to settle.

Agreements

A vendor's page has tabs: Overview, Agreements, Questionnaires (for admins on a plan with questionnaires), Risk assessment, and Systems it supplies. The Agreements tab records every agreement you hold with the vendor, each with its type (a business associate agreement, a data processing agreement, or another agreement such as AI services terms), a title, the date it was signed, the date it expires (blank when it has no fixed end), notes, and a renewal reminder: admins are emailed the number of days you choose before it expires (30 unless you change it; blank for none). When you renew an agreement, record the new one: of each type, the agreement that runs longest is the one in force (an agreement with no end date counts as running longest), and the others are marked superseded.

The list flags vendors with no agreement of any type, and vendors whose agreement in force has expired or is expiring within 30 days, and shows, for each AI vendor, whether its training practice is unknown or whether it trains on your data. You can filter by what AI a vendor supplies and by its training practice.

Checking a BAA's required elements with Watney

Under a business associate agreement's Documents, link the signed agreement, then choose Check with Watney. Watney reads the file against each contract element listed in 45 CFR 164.504(e)(2) and 164.314(a)(2)(i), shown with its citation, and says for each whether the agreement has a provision that addresses it (Provision found, Not found or Unclear, or Not reviewed when Watney did not report on it), quoting the agreement's words and where they are. The elements are the regulation's own words, read from the stored text of the rule. A quote from a Word or text file is checked against the file, and when the file does not hold those words the element reads Unclear with no quote; a quote from a PDF is marked as Watney read it, so check it against the agreement.

Some elements apply only in some cases (for example 164.504(e)(2)(ii)(H), and the Security Rule elements only where electronic health information is involved), so Not found is not by itself a missing term. An arrangement between governmental entities, or one required by law (164.504(e)(3), 164.314(a)(2)(ii)), can meet the rule without these contract terms, and a business associate's agreement with its subcontractor carries the same elements (164.504(e)(5), 164.314(a)(2)(iii)): ask counsel which applies.

Watney does not say whether the agreement meets the rule, is sufficient or is enforceable: that is for your counsel. Nothing about the agreement record changes. The file's contents are sent to the AI model provider, as for every Watney feature that reads a file.

Business associates

While a HIPAA assessment is offered, and unless your organization recorded that it handles no PHI, a vendor's edit form asks whether it handles PHI for us: Yes, No, or not recorded. Yes means it creates, receives, maintains or transmits protected health information on your behalf, which generally makes it a business associate (45 CFR § 160.103) that needs a business associate agreement (BAA). Supplying software you run yourself, with no access to your PHI, does not by itself make a vendor a business associate. A vendor that supplies a system you marked as handling ePHI is listed as a possible business associate until you record whether it handles PHI for you; recording No removes it. A terminated vendor is not counted.

The list's BAA column shows each vendor's business associate agreement: current, expiring, expired, missing (a vendor that handles PHI for you, with no BAA on file), to confirm (a possible business associate with no BAA on file), or not needed. The Business associates tab lists every business associate and possible one, the worst BAA first, and the Missing BAA tile and Home count the vendors that handle PHI for you with no BAA on file. The BAA state reflects only the dates you record: Backsplice does not read the signed agreement, and a business associate agreement must contain the terms 45 CFR § 164.504(e) requires (and § 164.314(a) for ePHI).

On a vendor's Agreements tab, BAA draft (PDF) produces a draft business associate agreement naming your organization and the vendor. It is a draft for counsel, not legal advice, and preparing it does not decide whether the vendor is a business associate. It is written for a covered entity: if your organization is recorded as a business associate (or as both), a vendor that handles PHI for you may be a subcontractor, and the draft says it needs adapting; if your organization recorded a substance use disorder program under 42 CFR Part 2, the draft says the Part 2 terms need adding. Record the signed BAA on the Agreements tab.

A recorded BAA is HIPAA documentation your organization keeps, so it is never deleted: the Agreements tab offers no Delete on it (edit it to correct its dates or title), and a vendor with a BAA on record cannot be deleted either, by itself or in a bulk delete. Mark the vendor terminated instead.

The AI systems a vendor supplies

When you register an AI system you bought, choose its vendor on the system's page. The vendor's page then lists the systems it supplies, and the system's Approval page shows the vendor's AI supplied, training practice and agreement status to anyone reviewing it. A vendor that supplies a system cannot be deleted while a system names it: change the vendor on the system first, or mark the vendor terminated.

AI due-diligence questionnaires

Questionnaires send a vendor a set of questions through a secure link that needs no account. Start from a template. The AI templates:

  • AI Vendor Due Diligence, for any vendor whose product uses AI on your behalf.
  • Generative AI Provider Assessment, for providers of generative models, assistants or APIs, following the risks in NIST AI 600-1.
  • AI Features in SaaS Products, a short review for software that has added AI.

The security and HIPAA templates cover a vendor's general security, cloud hosting, payment processing, subcontractors, data destruction, a SOC 2 report, and a business associate's safeguards under the HIPAA Security Rule.

Each AI template also asks the vendor to state, in its own words, the role it considers it holds under the EU AI Act and how it has classified the system, and then to pick those roles and classifications from a list, so you can compare vendors' answers. The two longer templates ask whether the vendor has assessed the system against the Act's prohibited practices and whether a provider established outside the Union has appointed an authorized representative in the Union. The generative AI template also asks a model provider about its EU AI Act model documentation and copyright policy, and asks whether the service marks the synthetic content it generates. These questions record what the vendor says; they do not decide whether the Act applies to the vendor or to you.

You can edit the questions before sending. The vendor's answers are scored against the answer you prefer for each question, and you review and note the result. Some template questions also give credit for another answer: one as low-risk as the preferred answer earns full credit, the next step on an ordered scale earns half, and on the re-evaluation question the step after that earns a quarter. No question counts for more than its weight, however many answers are ticked. On the EU AI Act role and classification lists, a choice such as "Not yet assessed", "Neither" or "None: we consider the Act does not apply" is chosen on its own: the vendor's form refuses it beside another choice. Rating questions (1 to 5) are always scored. Any other question with no preferred answer, including the EU AI Act questions and every free-text question, is recorded for your review but not scored.

When AI is available to your organization, an admin reviewing a returned questionnaire can choose Review the answers with Watney. Watney reads every answer and names the ones that are weak, evasive, contradicted by another answer, left blank, or claim a control without the detail the question asks for, each with a follow-up question you could send, and suggests a score on the same scale with its reasoning. It only fills the score and notes of the review form; the review is yours when you mark it reviewed. The vendor's answers are sent to the AI model provider to produce the review.

The link works for 30 days. While the questionnaire waits for an answer you can Resend it, which emails a fresh link (to the same or a corrected address) and stops the earlier one working, or Revoke the link, after which the vendor's page shows an invalid link and accepts nothing. A revoked questionnaire can be resent later.

The vendor's answers never change the vendor record by themselves. When a submitted answer settles one of the record's fields (today, whether the vendor trains on your data), the questionnaire shows the record's current value beside what the answer means, and you tick the answer and apply it to record it. An answer that does not settle the field (for example, "not excluded from training by default", which does not say whether you can opt out) is shown with a note, and you set the field by hand. The vendor's page lists its questionnaires, with their status and the date each was sent or submitted, and says when the latest answers differ from the record.

Security assessment

Assess records your own security review of a vendor: fifteen questions on access control, encryption, incident response, audit logging, business continuity and third-party audits. Answers are scored 0–100, and the score sets the vendor's risk level (80 and above low, 60 medium, 40 high, below that critical). Running an assessment stamps the vendor's last review date.

Reviews and reminders

Set a next review date to schedule the next look; the list flags overdue reviews, and the compliance calendar surfaces upcoming vendor review dates alongside your other deadlines. An agreement's own renewal reminder is emailed to admins (above).

Who can do what

Anyone can view vendors. Contributors and admins can add, edit, and assess them. Only org admins can send, resend or revoke questionnaires, apply their answers to a vendor record (and see them on the vendor's page), bulk-import vendors, bulk-archive them, or delete a vendor, from its page or in bulk. The BAA draft (PDF) is for admins on a paid plan, on a vendor that is or may be a business associate. Auditors are read-only.