Supplier due diligence checklist for AI and software partners
A free checklist for the stage after shortlisting: a record of the evidence you request, receive and review from a software or AI supplier, with an owner for every item and a signed decision at the end. Built for buyers in healthcare and medtech, banks, insurers and fintech, and robotics.
What the checklist covers
The checklist has 11 sections. D0 explains how to use it. D1 to D9 cover supplier identity, regulatory and quality fit, data protection, information security, AI-specific controls, engineering evidence, resilience, subcontracting, and contract, IP, audit and exit. D10 is the sign-off and decision record. Every row has an item, evidence to request, owner, status and evidence ID.
You get three files:
- XLSX (primary): one row per item with status and owner drop-downs, notes and related links, a progress summary by section and owner, the decision record and the contract requirements R1 to R10.
- PDF: the same checklist to print or share with reviewers.
- DOCX (editable): for teams that keep their supplier files in Word.
When to use it: after shortlisting, before the contract
Use it after you have a shortlist and RFP responses, and before you sign. The shortlisting scorecard and the RFP template tell you which vendors deserve a close look; the checklist records what you asked each one for, what arrived, who reviewed it and what is still open. A paid pilot can run alongside it.
Start with the shortlisting scorecard and the RFP template for regulated software partners. Section D2 confirms gate G1, D3 confirms G2, and D9 confirms G3 and G4 before signature.
Who owns each part
Each section has a default owner. QA/RA owns quality fit, vendor risk owns corporate basics, continuity, subcontracting and the register entry, the DPO owns data protection, the CISO owns security, engineering owns AI controls and engineering evidence, and legal owns contract terms. One named person owns the final decision record.
| Owner | Sections |
|---|---|
| QA/RA | D2 regulatory and quality fit, release evidence, AI intake evidence for health systems |
| Vendor risk | D1 corporate basics, DORA contract terms, D7 continuity, D8 subcontracting |
| DPO | D3 data protection and data use |
| CISO | D4 information security, incident response |
| Engineering | D5 AI-specific controls, D6 engineering evidence, support model |
| Legal | D9 contract, IP, audit and exit; insurance; BAA |
| Decision owner | D10 sign-off and decision record |
How it connects to the due diligence questions
The checklist is the record; the due diligence FAQ holds the answers. Where a topic such as data deletion, encryption, incident response or model drift is covered on the Areusdev question pages, the checklist row links to that page instead of repeating the question, so your team can read the background and track the evidence in one place.
Related question pages: AI and software partner due diligence FAQ, fintech partner questions, robotics partner questions, CRA vs MDR for health software and EU Data Act access by design. For security-by-design work, see cybersecurity for regulated software; for health products, see healthcare software development.
What the checklist does not do
Completing the checklist does not make a supplier compliant, and it is not legal advice. It documents your own assessment. Areusdev does not certify suppliers, products or conformity with any standard. Your legal, quality and compliance teams own the contract wording, the risk rating and the decision.
This template is provided by Areusdev for general information only. It is not legal, regulatory or compliance advice and does not certify conformity with any standard or regulation. Adapt it to your organisation and have your legal, quality and compliance teams review it before use.
About this template
Areusdev is an engineering partner for regulated industries, building and integrating software since 2004. We are 72 people, 17 of them in healthtech engineering. We work under our clients’ quality and control frameworks, and we do not certify conformity or give legal advice. At Areusdev, client data is never used to train shared models without a written agreement. Custom software for regulated products | Talk to an architect
Frequently asked questions
What is supplier due diligence for a software or AI partner?
It is the structured collection and review of evidence about a shortlisted supplier before you sign. For a software or AI partner it covers quality fit, data protection, security, AI controls, engineering evidence, continuity, subcontracting, contract terms and exit, and it ends with a recorded decision that names who reviewed what and which gaps remain open.
When in vendor selection should due diligence happen?
After you have a shortlist from the scorecard and responses to your RFP, and before the contract is signed. Running it earlier spends effort on vendors you will not choose; running it after signature removes your leverage. A paid pilot with the leading vendor can run alongside due diligence and feed evidence into it.
Who should own each part of supplier due diligence?
QA/RA owns quality fit, vendor risk owns the contract register entry and continuity, the DPO owns data protection, the CISO owns security, engineering owns technical and AI evidence, and legal owns the contract clauses. One named person owns the decision record, so the final call is made and signed by someone accountable for it.
How is the checklist different from a vendor security questionnaire?
A security questionnaire covers one reviewer’s area. This checklist is wider: it also covers quality fit, data use, AI controls, engineering evidence, IP and exit, and it tracks the status and evidence ID of every item rather than collecting answers. You can attach your existing security questionnaire as another tab and reference it from section D4.
Does completing the checklist make a supplier compliant?
No. The checklist documents your assessment of a supplier; it does not certify the supplier or your product. Compliance stays with your organisation, under your quality system and your regulatory obligations, and your legal and compliance teams decide what evidence is enough. Use the checklist to show reviewers and auditors how you reached your decision.
Download the checklist
Get the XLSX checklist, the PDF and the editable DOCX. The files open on the next page.