Documenting Your Vendors' AI

Here's something teams forget: if you use a vendor's AI tool, you're still responsible for what it does on your behalf. "The vendor built it" is not a defense — it's a description.

So document your vendors' AI like you'd document your own. For each AI tool you pay for or plug in, write down four things: what it does with your data, what data you send it, what the vendor promises in writing (their security and privacy documentation), and who on your team owns the relationship.

Then ask your vendor for their homework. Do they have a model card? Security certifications? A data processing agreement? A serious vendor will have answers; a vendor that waves you off is telling you something.

This isn't about distrust. It's about the chain of responsibility. When your customer asks how their data is handled, "our vendor handles it" ends the conversation badly. "Here's what the tool does, here's the vendor's documentation, and here's our agreement with them" ends it well.

You outsource the work, not the accountability. Write down the chain.

I explain frameworks; I don't give legal counsel.