AI Vendor Risk Assessment: Legal Review of New Features

A new approved vendor adds an AI feature, and your company wants to use it. Before you say yes, you need to know which data reaches the model, what the governing terms allow, and whether IT can keep the use within the company's approved limits.

Use this AI vendor risk assessment guide to decide whether the feature can go live, needs different terms, or should stay off. As you review the contract, use GC AI, turnkey legal AI software purpose-built for in-house teams, to compare the vendor's terms with your company's approved limits. Used by 2,100 customers, GC AI can flag conflicting data-use permissions, cite the contract language behind each finding, and draft proposed redlines and a decision memo. That gives you a focused set of issues to review and a clear recommendation to take back to the business before the feature goes live.

What Should an AI Vendor Risk Assessment Cover?

Cover these six areas before approving the feature:

• Data use and training: What inputs, outputs, and feedback may the provider use to deliver the service, train a model, or improve services for other customers?
• Model providers and subprocessors: Which third parties process the data, and what access and use restrictions bind them?
• Retention and human review: How long are inputs and outputs retained, and who may examine them?
• Security evidence: What security controls, assessments, incident obligations, and configuration evidence support the proposed use?
• Outputs and liability: Who can use or own generated content, and what warranties, indemnities, or liability limits apply?
• Changes and approvals: What notice, consent, and approval rights apply when models, providers, purposes, or settings change?

Example: AI Summaries in the Help Desk

In this example, your help-desk vendor announces an AI-generated ticket-summary feature, and the support lead wants to enable it for the whole department. Some tickets contain customer contact details, contract disputes, and sensitive attachments. The vendor's notice points to an AI addendum Procurement can't find.

The support lead proposes starting with routine tickets, excluding contract disputes and sensitive attachments. Legal needs to check whether that limit fits both the terms and the feature's controls.

IT maps which ticket text, attachments, prompts, summaries, and feedback reach each provider, and which support users have access. IT also checks whether disabling summaries stops the feature from sending ticket data to the provider.

Which Contract Terms Govern the AI Feature?

Read the signed order, master agreement, amendments, and data processing agreement (DPA) as one vendor agreement packet. Compare its data-protection provisions with the proposed AI terms, feature documentation, current subprocessor list, and change notice. Check which terms the agreement incorporates, how amendments take effect, and which document controls a conflict.

Give GC AI that packet, IT's description of the data flow, and the company's approved limits. Ask it to compare the proposed use with the definitions, exceptions, and precedence clauses, quoting the supporting passages and flagging missing terms. Counsel can then separate supported findings from questions that remain open until Procurement obtains the AI addendum.

Where the Notice and the Contract Collide

The signed agreement and the feature notice describe different uses of ticket data.

In this example, the signed agreement says:

Vendor may process Customer Data solely to provide the Services to Customer.

The feature notice says:

AI Inputs and Outputs may be used to improve AI Services.

The feature notice leaves two questions open: whether “improve AI Services” permits cross-customer use and which document controls. The Federal Trade Commission has also warned AI providers to honor privacy and confidentiality commitments, including promises about how customer data will be used.

For this example, Legal and the business agree on three positions:

• Permitted purpose: Generate summaries for this company's approved support use.
• Prohibited use: Training a shared model or improving services for other customers with company ticket content, prompts, or outputs.
• Approval condition: Legal must review the controlling terms, and IT must verify the feature's data path and restrictions before activation.

To limit processing to the approved summaries and exclude shared-model training and improvement for other customers, counsel could propose this wording:

For the AI ticket-summary feature, Vendor may process Customer Data, including AI Inputs and Outputs, solely to generate summaries for Customer's approved support use. Vendor will not use, or permit its model providers to use, that data to train shared models or improve services for other customers.

Ask GC AI to compare the proposed restriction with the DPA, subprocessor obligations, retention terms, and precedence clause. Counsel reviews the conflicts it identifies, and Privacy checks which ticket data the feature may process. The restriction needs the vendor's agreement before the company relies on it.

At Helix, Chief Privacy Officer and Associate General Counsel KT Farley describes using GC AI to test arguments in privacy and product risk analysis:

I use it for risk analyses and point/counterpoint back and forth to test where I'm landing.

From Contract Language to a Redline and a Decision

For the ticket-summary review, give GC AI the source documents, approved company limits, and proposed restriction. Ask it to test the arguments for and against cross-customer use, then draft a redline and a short activation memo for your review.

Example Prompt

Review the ticket-summary feature against the supplied agreement, DPA, notice, and IT's data-flow description. Use the company's approved limits, and ask me for any missing limits. Test the arguments for and against cross-customer use under “improve AI Services,” citing the supporting clauses. Flag the missing AI addendum and any conflicts with those limits. Check the proposed restriction, suggest changes for my review, and draft an activation memo with open questions and next actions for Legal, Procurement, Privacy, IT, and Support.

Once GC AI returns the draft, check the passages behind its findings. Its Exact Quote feature provides clickable citations that open the source document and highlight the quoted words. Read the definitions and exceptions around each passage before deciding whether it supports the proposed use.

If a privacy-law question remains, give GC AI's Research feature the jurisdiction, ticket categories, and intended use. It finds relevant statutes, cases, and other legal sources. Check the authorities and how they apply before changing the recommendation.

Then open the Word draft in Easy Edit, GC AI's browser-based Word-document editor. Compare the original and proposed wording, edit or dismiss suggestions, and apply the changes you want as tracked edits. Check that the reviewed redline and activation memo state the same limits and open conditions before sharing them.

What the Support Lead Hears

The summaries stay off while Procurement obtains the addendum and Legal reviews the proposed use. The existing help desk can keep running if Legal confirms the governing terms allow it and IT verifies that no ticket data reaches the disabled AI feature. Privacy reviews the proposed ticket categories. Once Legal approves the terms and use, IT must verify that the configuration enforces the approved data flow, access, and retention limits before Support enables summaries for routine tickets. Contract disputes and sensitive attachments wait for a separate approval.

If Legal or IT cannot confirm continued use of the existing service, the business owner needs a continuity decision with both teams. For an approved rollout, Support tells staff which tickets qualify and checks summaries against the source tickets before use.

Keep the reviewed contract version, configuration evidence, decision, and accountable owners in the vendor record. A change in the feature, data scope, provider, or terms reopens the review. Use your AI governance intake process to route that review.

Bring a vendor's AI change notice, contract, and approved company limits to a GC AI demo. See how to prepare cited findings, a proposed redline, and an activation memo for Legal's review.