What Due Diligence Should I Carry Out on an AI Supplier?

Before you procure any AI system, the ICO's guidance on contracts and third parties makes clear that you should carry out proper due diligence on the accuracy of the system, any bias built into it, and the trade-offs the supplier made when designing it, rather than taking their marketing claims at face value. Ask the supplier directly what data their system was trained on, what steps they have taken to test for bias, and what level of accuracy you can reasonably expect in your specific use case, then document their answers.

You also need absolute clarity on the relationship between your business and the supplier. Establish whether they are acting as a data processor under your instructions, or as a separate controller in their own right, since this changes where legal responsibility sits if something goes wrong. This should be formally documented in a written contract, not just assumed or discussed informally, and the contract should set out clear responsibilities, accuracy expectations, and ideally key performance indicators or service levels relating to accuracy and bias.

Due diligence is not a one-off exercise at the point of purchase. AI systems can change and drift in performance over time, so build in a periodic review of your suppliers rather than treating the initial contract sign-off as the end of the process. Where a supplier is unwilling to answer questions about training data, testing, or their own compliance obligations, treat that reluctance as a potential red flag and continue your due diligence.