Template 08 of 8
Vendor agent due-diligence questions
Ask before enabling agent features in any licensed product.
Data and models
- Is institutional data used to train or improve vendor models?
- Where is data processed and stored, and for how long?
- Which third-party models are used, and can they change without notice?
Control and transparency
- Can each agent feature be enabled per role or population?
- What actions can the agent take, and can they be restricted?
- What logs and audit data are available to the institution?
- How are new agent features announced before release?
Accountability and exit
- What testing for accuracy and bias has the vendor done, and will it share results?
- How are incidents reported to the institution?
- Can data and configurations be exported if the contract ends?
- Are accessibility conformance reports available?