Talk to UsResponsible AI resourceMenuHomeModel policyDecisionsResearch & approachGet support
Leadership guide/Operations & assurance
What can the supplier demonstrate and commit to?
Download the guide↓Editable working records→
Ask for evidence specific to the product, configuration and service tier being purchased. A corporate assurance statement does not establish how your institution's information or use will be handled.
Responsible roles: Procurement with security, privacy, accessibility, counsel and the service owner.
Leave with: A documented supplier review tied to the actual product and contract.
Request a data-flow description naming processing and storage locations, subcontractors, information categories, retention, backup treatment and deletion arrangements. Establish whether inputs, outputs or feedback may be reused for training or other purposes, and which settings and contractual terms govern this.
Use the institution's established vendor assessment, such as HECVAT or an equivalent, and supplement it for the AI use. Verify product, configuration, service tier, subcontractors, assessment scope and evidence date. Examine security controls, test findings and vulnerability handling. A completed questionnaire or assurance report is not approval. Test accessibility in the actual workflow with the responsible office.
Identify notification contacts and commitments for incidents, material model or feature changes, subcontractor changes and service interruptions. Determine how the institution can investigate, export relevant records, obtain support, challenge an output and disable new capabilities.
Establish export formats, termination support, deletion evidence, treatment of backups and the ability to continue essential services. Examine dependencies on model providers and third-party components, along with rights to institutional content and outputs.
Record each requested item, supplied evidence, review finding, condition and owner. Put necessary commitments in the agreement. Time-limit permissible exceptions through the authorized process; missing mandatory protections block the affected use. Reopen review when the actual service changes.
Illustrative campus example
A supplier says customer data are not used for training. The institution checks whether that statement covers its exact subscription, feedback features and subcontractors, then records the relevant contract term and configuration. Marketing language alone does not close the question.
Use the editable companion to capture the decision in your institution’s own systems. These prompts are also available in the printable guide.
Record the product, subscription, configuration, use and accountable institutional owner.
Link the institutional vendor assessment or HECVAT, product-specific supporting evidence, scope and date, reviewer, findings and unresolved items.
Identify binding commitments, unresolved items, permitted exceptions and limits.
Record notification contacts, renewal date, transition arrangements and deletion evidence required.
Model policy: Section 4 · Section 5 · Section 10 · Section 12.
HumanSkills implementation recommendations informed by the sources below. These voluntary resources are not legal requirements or a certification. Apply current institutional requirements and specialist review to the actual use.