An AI vendor risk assessment is a review of an AI tool’s data use, retention, security evidence, admin controls and contract terms before employees use it with company data. When you switch AI tools, the assessment covers two vendors: the one you’re adding and the one you’re leaving. This guide gives you the checklist, what four vendors document today and the exit steps.
The stakes are rising. Third parties were involved in 48% of breaches, up 60% in a year, according to Verizon’s 2026 Data Breach Investigations Report. More than 20% of organizations reported a breach that targeted AI models or applications (IBM, 2026). The most common causes were compromised APIs, applications or plug-ins and cloud misconfigurations, at 27% each, according to IBM’s Cost of a Data Breach 2026 release.
This guide is for IT, security and procurement owners who approve a new AI assistant or coding tool. It doesn’t repeat the migration inventory; for that, see the company ChatGPT-to-Claude migration assessment and the coding agent migration readiness assessment.
Last verified: October 25, 2026, against each vendor’s own trust and privacy pages linked below.
Key Takeaways
- A tool switch is two reviews: approve the new vendor and close out the old one.
- Certification scope is set per product and deployment route, not per company. Check that the exact plan you’re buying is in scope.
- Data retention can change with the model you pick, even under the same contract.
- The exit has a clock. Some compliance logs are kept for only 30 days, so export them before cutover.
Disclosure: ASCENDING Inc publishes this blog and builds Jarvis Crosswalk to support AI tool migration assessments. The checklist works without it; vendor facts come from each vendor’s public pages.
Why is switching AI tools a different vendor review?
A standard vendor review looks at one supplier at a time. A tool switch changes two data relationships at once. Prompts, code, files and logs start flowing to the new vendor, while the old vendor still holds history, logs and connector grants.
Three things make AI tools harder to assess than most software:
- The model can change under the product. Many tools route requests to several model providers, and each provider may handle data differently.
- Agents reach further than chat. Coding agents and connectors can read repositories, tickets and drives with the user’s or a service’s permissions.
- Old data doesn’t leave with the users. Conversation history, custom assistants and compliance logs stay with the old vendor until you export or delete them.
NIST’s Generative AI Profile (NIST AI 600-1) names this risk “Value Chain and Component Integration.” Its definition includes improper supplier vetting across the AI lifecycle.
Sources: Verizon 2025 DBIR release (April 23, 2025; 30%, doubled from 15%) and Verizon 2026 DBIR release (May 19, 2026; 48%).
The AI vendor risk assessment checklist
Use this table as the core of your review. Ask the vendor for evidence, not answers alone. A sales deck isn’t evidence; a trust portal document, a contract clause or an admin setting you can test is.
| Area | Question to ask | Evidence to request | Red flag |
|---|---|---|---|
| Training use | Is our data used to train or improve models? | Commercial terms, DPA, trust center FAQ | Training is opt-out, or terms differ by product |
| Retention and deletion | How long are prompts, outputs, files and logs kept for our plan? | Retention table per product surface | One number for every surface, or no deletion timeline |
| Zero or short retention | Is zero data retention available, and for which features? | Eligibility rules, enabled-by-whom process | Promised in sales, absent from the contract |
| Model providers | Which model providers and subprocessors see our data? | Subprocessor list, change-notice process | No notice of new subprocessors |
| Certification scope | Is our plan and deployment route inside the audit scope? | SOC 2 Type 2 system description, ISO certificates, bridge letters | Report covers a different product or route |
| Identity | Do SSO and SCIM work on the tier we’re buying? | Admin docs for our plan | SSO only on a higher tier |
| Audit and compliance APIs | Can we export user activity and content to our SIEM or eDiscovery tools? | API docs, log retention period | Logs kept briefly with no export path |
| Agents and connectors | What can agents and MCP servers reach, and who approves them? | Admin policy settings, connector list | Users can add any connector |
| Model changes | Do data terms change when we enable another model? | Per-model data notes | Retention differs by model with no admin control |
| Exit and export | What can we export, and how is deletion confirmed? | Export docs, deletion certificate process | No written deletion confirmation |
| Contract terms | DPA, BAA if needed, IP indemnity conditions, breach notice period | Signed terms | Indemnity depends on settings nobody owns |
| Price per seat | What does the plan cost with the controls above? | Vendor pricing page and quote | Required controls only on a custom tier |
Zero data retention (ZDR) is a vendor commitment not to store your prompts and outputs after it returns a response, usually with narrow exceptions such as abuse checks. Confirm which products and features it covers before you count on it.
Most vendors publish pre-filled questionnaires. Anthropic’s Trust Center lists a SIG Lite, a full CAIQ, a VSA Core and a HECVAT dated June 2026. Start from those instead of sending a 200-question custom form.
What do four AI tools document today?
The four vendors below publish clear terms, but the terms differ in ways that matter for a switch. We checked each vendor’s own pages on October 25, 2026.
| What we checked | ChatGPT Enterprise | Anthropic (Claude Enterprise, Claude Code) | GitHub Copilot Business and Enterprise | Cursor with Privacy Mode |
|---|---|---|---|---|
| Training on business data | Not by default | Not for Claude Code under commercial terms | Not used to train | Not used for training |
| Default retention | Admins set it; deleted chats removed within 30 days | Claude Code: 30 days standard | IDE chat, completions and CLI: not retained; other surfaces: up to 28 days; engagement data: two years | Zero data retention agreements with model providers |
| Shorter retention option | Admin-set retention; zero data retention applies to eligible API endpoints | Zero data retention for Claude Code, enabled per organization by the account team | Built into IDE use | Admins can enforce Privacy Mode |
| Certifications listed | SOC 2 Type 2 | SOC 2 Type 2, ISO 27001, ISO 42001 (scope varies by product) | SOC 2 Type 2 and ISO 27001 scope include Copilot Business and Enterprise | SOC 2 Type II, ISO 27001, ISO 42001, AIUC-1 |
| Audit and compliance logs | Compliance Platform for Enterprise and Edu; logs kept 30 days | Check per product | Check GitHub admin docs | Check the trust portal |
| Model-provider note | Not applicable | Partner clouds have separate scope | Claude Fable 5 data is retained by Anthropic for safety classifiers | Providers may keep data flagged by abuse classifiers |
Methodology. We read OpenAI’s enterprise privacy page and Compliance Platform article, Anthropic’s Claude Code data usage page and Trust Center, GitHub’s Copilot Trust Center FAQ, and Cursor’s security and data use pages. “Check” means the page we read didn’t state it. Terms change often, so repeat the check on the day you sign.
For a deeper platform comparison, see ChatGPT Enterprise vs Claude Enterprise. For the Claude Code HIPAA route, see governing Claude Code for IT.
Check certification scope, not the logo
Certification scope is the set of products, locations and processes an audit actually covered. A vendor can hold SOC 2 for one product and not another, so check the plan and route you’re buying.
Anthropic’s Trust Center shows why. It lists certifications separately for the API, Claude Enterprise, Claude Team and partner clouds. Claude Team shows N/A for HIPAA, and Claude in Microsoft Foundry hosted on Azure shows SOC 2 and ISO as “In-Process Q4 2026.” For Claude on Amazon Bedrock and Google Cloud, HIPAA is partner-managed and Anthropic’s certifications cover only the model and the containers it supplies.
GitHub states that Copilot Business and Copilot Enterprise are in its SOC 2 Type 2 report and its ISO 27001 scope. That’s the level of detail to ask every vendor for.
When you get the report, check four things:
- System description. Is your product named, and is the feature you’ll use inside it?
- Period. Does the audit period end recently? If not, ask for a bridge letter. A bridge letter is the vendor’s statement covering the gap between the end of the last audit period and today; Anthropic’s Trust Center lists two for 2026.
- Carve-outs. Which subservice organizations, such as cloud hosts, are excluded?
- Your controls. Which complementary user entity controls must you run, such as SSO and access reviews?
Ask what changes when the model changes
Many AI tools let admins or users pick from several models. Data terms can change with that choice, even under one contract.
GitHub’s Trust Center says Copilot’s third-party model providers don’t train on or retain customer code. It names one exception: when Claude Fable 5 is used, Anthropic keeps prompts and outputs to run safety classifiers. Cursor’s data use page says its providers have zero data retention agreements, but providers may keep data that their abuse classifiers flag.
Neither exception is unusual, but both belong in your assessment. Ask three questions:
- Which models are enabled by default, and can admins limit the list?
- Does any model carry different retention or review terms?
- How are we told when a new model provider or subprocessor is added?
Subprocessor lists change. Anthropic’s Trust Center posted an update on October 14, 2026 that added a web search provider and a bot detection provider. Subscribe to these notices and give someone the job of reading them.
Plan the exit from the tool you’re leaving
The old vendor still holds your data after users move. Plan the exit as part of the same assessment, with dates and owners.
- Export what you must keep. OpenAI’s Compliance Logs Platform keeps data for 30 days. If you need longer records, set up a continuous export before cutover.
- Decide what you won’t move. Chat history, personal memories and custom assistants rarely transfer as working assets. Archive what policy requires and rebuild the rest on purpose.
- Revoke access. Remove connector grants, API keys, service accounts and MCP server tokens the old tool used.
- Confirm deletion in writing. OpenAI says deleted Enterprise conversations are removed within 30 days unless the law requires otherwise. Ask every vendor for its timeline and a written confirmation.
- Keep a rollback window. Keep the old workspace under its retention policy until the new tool passes its pilot.
The company ChatGPT-to-Claude migration assessment covers the inventory for workspace assets. For coding tools, the Codex to Claude Code team assessment covers config and workflow checks.
Decide: approve, approve with conditions, or block
End the assessment with a decision and an owner for each open item. Three outcomes cover most cases:
| Decision | When to use it | What happens next |
|---|---|---|
| Approve | Every checklist row has evidence and no red flags remain | Roll out with the admin settings you tested |
| Approve with conditions | Gaps exist, but a setting, contract change or data limit closes them | Pilot with limited data; track each condition to a date |
| Block | Training use, retention or scope can’t meet your policy | Stay on the current tool or assess another vendor |
Don’t let real company data into a pilot until the training, retention and scope rows pass. The AI readiness checklist covers the gates for the pilot itself.
Where ASCENDING fits
ASCENDING Inc builds Jarvis Crosswalk to support AI tool migration assessments. If you’re evaluating it, confirm its current collection coverage, outputs and delivery scope with our team. Don’t assume an available automated scanner or a tested migration path.
The checklist above works with or without us. To review one vendor switch, use our contact page.
References
- Verizon: 2026 Data Breach Investigations Report findings
- Verizon: 2025 Data Breach Investigations Report findings
- IBM: Cost of a Data Breach 2026 press release
- NIST AI 600-1: Generative AI Profile
- OpenAI: Enterprise privacy
- OpenAI: Compliance Platform for Enterprise and Edu
- Anthropic: Claude Code data usage
- Anthropic Trust Center
- GitHub Copilot Trust Center FAQ
- Cursor: Security
- Cursor: Data use
AI vendor risk assessment questions
What is an AI vendor risk assessment?
It's a review of an AI tool's data use, retention, security evidence, admin controls and contract terms before employees use it with company data. When you switch tools, it covers both the vendor you're adding and the one you're leaving. Frameworks such as NIST AI 600-1 list improper supplier vetting as a generative AI risk.
What should we ask an AI vendor about data retention?
Ask how long prompts, outputs, files and logs are kept for your plan and for each product surface, whether retention changes with the model you pick, and whether zero data retention is available. GitHub Copilot, for example, keeps no IDE inputs by default but retains other surfaces for up to 28 days, according to its Trust Center.
Does a SOC 2 report cover every product a vendor sells?
Not necessarily. Scope is set per product and deployment route. Anthropic's Trust Center lists certifications separately for its API, Claude Enterprise, Claude Team and partner clouds, and some routes are still in process. Read the report's system description and period before relying on it.
What should we do with data in the AI tool we're leaving?
Export the records you must keep, such as compliance logs and approved workspace content, then revoke connectors and API keys and get written confirmation of deletion. OpenAI's Compliance Logs Platform keeps data for 30 days, so start a continuous export before cutover, as its help article advises.
