Your AI Vendor Is Not Your Friend

Your AI vendor's sales rep remembers your name, asks about your kids, and sends holiday cards. Lovely. None of that belongs in your risk assessment.

A vendor is a business counterparty. Their job is to sell software; your job is to protect your organization. Those jobs overlap sometimes and conflict often. When their model makes a mistake with your customer data, the friendship won't determine who pays for it. The contract will.

This doesn't mean assuming bad faith. Most vendors are honest people selling a real product. It means doing diligence anyway: reading the terms, asking where your data goes, finding out what happens when things break. Trust is built on verification, not vibes.

I learned this posture in federal grants work, where even beloved long-term partners got the same monitoring as everyone else. Not because we distrusted them, but because the rules required it and the money deserved it. Your customer data deserves the same.

So be warm, be professional, and vet them like a stranger. Ask the hard questions before you sign, not after something breaks. The vendors worth keeping will respect you more for it.

I explain frameworks; I don't give legal counsel.