GranurGranur
Logg inn
Free checklist · 35 checks

Vendor due diligence checklist

What to check before, during and after bringing on a vendor or AI tool, with the NIS2, EU AI Act, GDPR and DORA points flagged.

  • • Seven stages, from the first request to offboarding
  • • Which checks matter for NIS2, the EU AI Act, GDPR and DORA
  • • The contract clauses teams most often regret skipping
  • • A printable PDF with tick boxes
  • • A printable PDF with tick boxes

Operating in the US? Get the US edition (SOC 2, NIST, HIPAA, state laws)

Get the PDF

We'll only use your email for what you ticked above, and to follow up on this download. See our Privacy Policy.

The checklist

NIS2
EU cybersecurity directive
AI Act
EU AI Act
GDPR
EU data protection
DORA
EU financial sector

1. Before you say yes

Decide how much scrutiny this vendor needs before anyone starts negotiating.

  • Name a business owner who is accountable for this vendor for its whole life, not just the purchase.
  • Write down what the vendor will do and why an existing vendor can't do it.
  • Classify the vendor by risk: what data it touches, which systems it connects to, and what breaks if it fails.
  • Check whether the service supports something critical or important to your operations.DORA
  • Ask whether the product uses AI, and whether it makes or supports decisions about people (hiring, credit, access).AI Act
  • Check for existing contracts with the same vendor under a different name or department.

2. Security and supply chain

Match the depth of review to the risk tier you set above.

  • Collect current security evidence: SOC 2 Type II report or ISO 27001 certificate, with dates.NIS2
  • Read the SOC 2 report's exceptions and scope, not just the cover page.
  • Confirm how and how fast the vendor will tell you about a security incident.NIS2
  • List the vendor's own critical subcontractors (their supply chain is part of yours).NIS2
  • Check access: SSO, multi-factor authentication, and how access is removed when people leave.
  • Agree on vulnerability handling and patching expectations for anything they run for you.NIS2

3. Data protection

Anything that touches personal data needs a paper trail.

  • Map what personal data the vendor will process, and where it will be stored.GDPR
  • Sign a data processing agreement if the vendor processes personal data on your behalf.GDPR
  • Check for transfers outside the EU/EEA and the safeguard used (for example, standard contractual clauses).GDPR
  • Ask whether your data is used to train the vendor's AI models, and get the answer in writing.GDPR

4. AI tools and agents

For any product that uses AI, and especially agents that act on their own.

  • Get documentation of what the AI does, its known limitations, and how it should be used.AI Act
  • Decide who reviews or can override the AI's outputs, and write it down.AI Act
  • For agents: list exactly which systems and data they can access and which actions they can take without a human.
  • Make sure staff using the tool have enough training to use it responsibly.AI Act
  • Plan to re-check permissions after major model or product updates.

5. In the contract

The clauses teams most often regret skipping.

  • Security and incident-notification obligations, with timeframes.NIS2
  • Audit and information rights, so you can verify what the vendor claims.DORA
  • Service levels and what happens when they're missed.
  • Renewal terms: auto-renewal, notice period and the exact date by which you must act.
  • Price increases: how much, how often, and with what notice.
  • Exit: data return and deletion, transition help, and termination rights.DORA

6. After signing

Due diligence isn't finished at signature.

  • Record every obligation with an owner and a date (payments, notices, reports, certificate renewals).
  • Track certificate and report expiry dates and ask for new ones before they lapse.NIS2
  • Keep a register of all ICT third-party arrangements, if you're a financial entity.DORA
  • Review higher-risk vendors at least once a year: performance, incidents, changes in scope.
  • Diary the renewal decision well before the notice deadline, not on the renewal date.

7. Offboarding

Ending a vendor safely is part of managing it.

  • Remove all user accounts, API keys and integrations.
  • Get confirmation that your data has been returned or deleted.GDPR
  • Close out open obligations and archive the contract with its history.

This checklist is general guidance, not legal advice. Which rules apply to you depends on your sector, size and country; NIS2 in particular is applied through national laws that differ between countries. Check with your legal or compliance advisers.

Slutt å holde styr på dette i et regneark

Granur tar hver leverandør og hvert AI-verktøy gjennom disse sjekkene, henter forpliktelser og fornyelsesdatoer ut av kontraktene automatisk, og tar vare på revisjonssporet for deg.