Review Due Diligence

Due diligence is a structured investigation of a proposed vendor, system, transaction, or use before commitment, using evidence proportionate to the decision and risk.

The team checks claims about capability, security, privacy, governance, finances, contracts, dependencies, support, and fit rather than relying on a demonstration or sales statement.

AI products can hide shared infrastructure, uncertain data practices, fast-changing features, and unclear responsibility. A disciplined review makes assumptions and residual risk visible.

Before signing, a company reviews the vendor's architecture, terms, data use, evaluations, incidents, subcontractors, service commitments, exit path, and references.

Due diligence is not a questionnaire completed once. Evidence quality, unresolved findings, changed conditions, and decision ownership matter.

Verify the claims before accepting the dependency.

* [[verification|Verification]] * [[independent-verification|Independent Verification]] * [[evidence-selection|Evidence Selection]] * [[vendor-lock-in|Vendor Lock-In]] * [[service-level-agreement|Service-Level Agreement]]

* [OECD, Due Diligence Guidance for Responsible Business Conduct](https://www.oecd.org/en/topics/sub-issues/due-diligence-guidance-for-responsible-business-conduct.html) — authoritative risk-based due-diligence process guidance. * [NIST AI 100-1, Artificial Intelligence Risk Management Framework](https://doi.org/10.6028/NIST.AI.100-1) — AI-specific governance, measurement, and risk-management context.

* Use [[independent-verification|Independent Verification]] for claims whose source shares the vendor's incentives.