AI vendor due diligence is the process of researching and questioning an AI supplier before committing, to understand the risks of using their product with your data and customers.
Typical questions cover where data is stored and processed, whether your data is used to train their models, who can access it, security certifications and testing, what happens in an outage, how errors and complaints are handled, how the model is monitored and updated, which sub-processors are involved, and how you can export or delete your data if you leave.
Retailers and hospitality businesses can use a simple checklist, request a security and privacy summary, read the terms of service and privacy policy, ask for references from similar businesses, run a small pilot and involve whoever manages IT. The OAIC publishes a checklist for privacy and commercial AI products.
Pitfalls include relying on a slick demo, not reading terms about data use, ignoring where the vendor's own sub-suppliers operate, and having no exit plan. Beware claims of "100% accurate" or "fully compliant"; compliance is shared and depends on how you use the tool.
It matters because you remain responsible to customers for how their data is handled. A few hours of questions up front is cheaper than a breach or a failed rollout.