Working template · September 2026 · Version 1.2
AI vendor review worksheet
Review AI suppliers and AI agent permissions, total cost, activity evidence, revocation and exit before purchase.
- For
- Business owners, procurement, IT and governance teams.
- You leave with
- A documented review, unresolved questions and a clear purchase or pilot decision.
Choose your format
DOCX is editable in Word or a compatible editor. PDF is ready to print. No signup is required.
Inside this template
The full document follows these sections. The first prompts are shown below so you can check the fit before downloading.
Ada Studio · Working template
Define the proposed use
Start with the work and the people involved, before comparing product features.
Tool and proposed use
Name the supplier, product, version or service plan, intended workflow and expected benefit.
Owner and participants
Identify the business owner, users and the people reviewing security, privacy and procurement.
Scope and affected people
Describe where the output will be used, who may be affected and which uses are outside this review.
Decision and timing
Record the decision being sought, the target date and the person authorised to approve it.
Follow the data
Ask for written terms or evidence. Record the source and date of each answer.
Data entering the tool
List public, internal, confidential and personal data. Identify anything that must stay out.
Training and reuse
Can inputs or outputs be used for model training or service improvement? Record the default, settings and contractual terms.
Location and other providers
Where is data processed and stored? List relevant sub-processors and any questions for the privacy reviewer.
Retention and deletion
How long are prompts, files and outputs kept? Can the organisation delete or retrieve them, including when leaving the service?
Check control and review
Connect the supplier’s promises to the way your team will actually use the tool.
Access and security
Demonstrate allowed and denied tool/data permissions in the proposed configuration. Identify account ownership, authentication, the authorising owner and technical enforcement evidence.
Human review and traceability
Show a reviewer the sources and actual action/target before approval. Demonstrate denial without approval and exportable logs linking agent, approver, action, result and exceptions.
Changes and incidents
Demonstrate delegated-access revocation, queued/in-flight action handling and recovery. Agree change and incident notices, escalation contacts and who reauthorises operation.
Evidence still missing
List unanswered questions, the evidence needed, who will obtain it and when.
Decide and follow up
Approval should describe a specific use and its conditions, not every possible use of a product.
Pilot boundaries
Record permitted users, data, duration, success measures and conditions that would pause the pilot.
Decision and reasons
Choose: proceed, proceed with conditions, defer or decline. Record the rationale and any alternatives considered.
Actions and accountability
For each condition, record an owner, due date and evidence of completion. Add rows as needed.
Approval and review
Record approver, decision date and next review. Reassess material changes to purpose, data, tools, permissions, autonomy, model or supplier before changed operation.
Compare sourcing options
Assess business fit and the whole cost of the proposed use, with evidence for each option.
Business fit and alternatives
Compare buying, building, partnering and the manual process against the same business objective and acceptance criteria.
Total cost
Estimate setup, licences, integration, staff training, human review, support, maintenance and exit costs. Record assumptions and uncertainty.
Compatibility and support
Check data formats, integrations, capacity, support terms, escalation contacts and missing supplier evidence with your technical reviewers.
Exit arrangements
Test usable export of data and action logs, access and credential revocation, deletion evidence and manual fallback. Record migration effort, lock-in, notice periods, support and recovery arrangements.