How a law firm supervises an AI vendor: the 10-item checklist

Running AI on your own premises does not end your supervision duties. This checklist tells you which 10 documents to ask any AI vendor for, including us.

What is inside

1. 01Description of security measures: encryption, MFA, role-based access, separation by matter, access logs
2. 02Data retention and deletion policy, log retention period, and a media sanitization certificate when hardware is replaced
3. 03Written statement that client data is not used for training and that nothing leaves the system, with a way to verify it
4. 04Enforceable confidentiality and incident notice
5. 05Vendor remote-access description
6. 06Register of model and software licenses
7. 07Limits of liability and the reasons
8. 08Engagement-letter language on AI use
9. 09Template acceptable-use policy
10. 10Security questionnaire and right to audit

Plus 7 more items in the checklist