Best AI for AdvisorsWhat is vendor due diligence?
Also called: AI vendor due diligence.
Short answer
Reviewing an AI vendor's security, data use, contracts and controls before your firm buys, and checking again over time.
Definition
Vendor due diligence is how a firm checks a vendor before trusting it with client data or a business function: security controls, data retention and training, sub-processors, SOC 2 scope, access, breach notice and exit terms. It continues after signing, through periodic reviews.
For AI vendors it's tied to two obligations: service-provider oversight under amended Regulation S-P, and, for broker-dealers, FINRA's reminder in Regulatory Notice 21-29 that outsourcing doesn't relieve a firm of its supervisory obligations.
Why it matters for advisors
AI vendors need extra questions that older software reviews skip: whether your data trains their models, which AI providers sit behind the product, and how AI features are turned on or off.
Our vendor due diligence guide has the full question list and a checklist, and there's a due diligence prompt to help organize a review.
Related terms
- SOC 2An independent CPA's report on a service provider's controls for security and related areas, used in vendor due diligence.
- Sub-processorA third party your vendor uses to handle your data, such as the AI model provider behind a notetaker or CRM assistant.
- Data processing agreementThe contract terms that set how a vendor may use, protect, share, keep and delete the data you give it.
- Regulation S-PThe SEC's privacy rule for client data at advisers and broker-dealers, amended in 2024 to require incident response and vendor oversight.
- Model training on customer dataWhen a vendor uses the data you put into its tool to improve or train its AI models, which may expose client information.
Learn more
Sources
Not legal or compliance advice. This is a plain-English summary for general education. Rules change and depend on your firm's facts, so check the primary source and talk to your CCO or counsel before relying on it.
Last updated .