SteadyGatewayRequest production access

Procurement checklist

AI vendor due diligence checklist

An AI model vendor due diligence checklist should tie one production workload to dated evidence about the exact model, provider and region boundary, credentials, subprocessors, lifecycle changes, incidents, and contract remedies. Use the checklist below to find the evidence gap before traffic moves, then assign an owner and review date to every decision.

Method: NIST AI 600-1, Generative AI Profile · published July 2024; rechecked 2026-08-11

What should an AI model vendor due diligence checklist cover?

An AI model vendor due diligence checklist should cover six decisions: model identity, provider boundary, credential scope, subprocessor chain, lifecycle control, and operating risk. NIST AI 600-1 treats generative-AI risk as something that can appear at model, application, ecosystem, and lifecycle levels, so a vendor questionnaire that asks only for a security PDF is incomplete.

Source: NIST AI 600-1, Generative AI Profile · published July 2024; rechecked 2026-08-11

Which model identity facts should procurement record?

Procurement should record the exact model ID, release state, licence, context limit, modalities, provider route, and capture date. Moonshot’s model list, for example, names kimi-k2.7-code as a dedicated coding model with a 256K context, while kimi-k2.6 is listed as a general multimodal model; the family label alone would lose that distinction.

Source: Moonshot AI Kimi API model list · rechecked 2026-08-11

Which evidence should a buyer request from an AI model vendor?

A buyer should request a dated record for each decision, not a generic assurance statement. The table is the working handoff: the first column names the decision, the second states a fact to verify, and the third turns that fact into a concrete evidence request.

DecisionFact to verifyEvidence request
Model identityMoonshot AI Kimi API model list · rechecked 2026-08-11The provider record names the exact model ID, release state, context limit, modalities, and documented role.Moonshot AI Kimi API model list · rechecked 2026-08-11A dated model record plus the change owner, replacement path, and the test that must pass before a version change.NIST AI 600-1, Generative AI Profile · published July 2024; rechecked 2026-08-11
Provider boundaryAlibaba Cloud Model Studio overview · rechecked 2026-08-11Model Studio documents region-specific endpoints and says regions can differ in endpoints, API keys, supported models, features, and pricing.Alibaba Cloud Model Studio overview · rechecked 2026-08-11The provider, endpoint region, account or workspace boundary, and a diagram of where requests, logs, and backups are processed.Alibaba Cloud Model Studio overview · rechecked 2026-08-11
Credential scopeAlibaba Cloud Model Studio API key documentation · rechecked 2026-08-11Model Studio API keys can use an all-model permission or a custom scope with an IP allowlist and accessible-model selection.Alibaba Cloud Model Studio API key documentation · rechecked 2026-08-11The intended key scope, rotation owner, revocation procedure, and proof that a test key cannot call an unintended model or network.Alibaba Cloud Model Studio API key documentation · rechecked 2026-08-11
Subprocessor chainEuropean Commission Decision (EU) 2021/915 · adopted 2021-06-04; rechecked 2026-08-11The Commission clauses require the processing subject, duration, purpose, data types, data-subject categories, and controller obligations to be specified.European Commission Decision (EU) 2021/915 · adopted 2021-06-04; rechecked 2026-08-11The current subprocessor list, authorization method, notice and objection process, downstream obligations, and responsible contract owner.European Commission Decision (EU) 2021/915 · adopted 2021-06-04; rechecked 2026-08-11
Lifecycle controlAlibaba Cloud Model Studio model decommissioning policy · rechecked 2026-08-11Model Studio documents 30 days of notice for snapshot retirement and 3 months for mainline model retirement; limits reduce during the retirement window.Alibaba Cloud Model Studio model decommissioning policy · rechecked 2026-08-11The provider sunset channel, migration test, final cutover date, and written remedy if the replacement cannot meet the agreed scope.Alibaba Cloud Model Studio model decommissioning policy · rechecked 2026-08-11
Operating riskNIST AI 600-1, Generative AI Profile · published July 2024; rechecked 2026-08-11NIST AI 600-1 calls for approved-provider inventories, supplier risk assessments, contract review rights, and ongoing monitoring of third-party generative AI.NIST AI 600-1, Generative AI Profile · published July 2024; rechecked 2026-08-11Named owners for incidents, provider changes, evidence expiry, and the review cadence for every production model and supplier.NIST AI 600-1, Generative AI Profile · published July 2024; rechecked 2026-08-11

Operator judgment: if a vendor cannot point to a source, capture date, owner, and expiry trigger for a row, mark that row “open” rather than converting a sales statement into evidence. The missing date is itself a procurement signal.

How should a buyer run the checklist before production?

Run the checklist in the same order that a request travels: identify the model, map the provider and region, constrain the credential, inspect the supplier chain, test the change process, then record incident ownership. This order catches an identity or boundary error before a contract discussion hides it in general language.

  1. Freeze the model identity. Write the exact ID, release record, licence and supported interface into the evaluation record. Link the ID to its dated freshness row where one exists.
  2. Draw the data path. Name the request endpoint, processing region, storage and logging systems, backups, retention period and deletion path. Keep contracting entities and transfer mechanisms in separate fields.
  3. Test credential scope. Use a non-production key to verify the allowed IP range and model set. Alibaba Cloud Model Studio documents custom API-key permissions for both fields.
  4. Read the supplier terms. Compare the current subprocessor list and change-notice process with the controller-processor clauses. Ask who remains responsible when another processor performs the work.
  5. Record the change trigger. Add the provider’s retirement notice period, migration test, approval owner, and final cutover date to the production runbook.

Sources: Alibaba Cloud Model Studio API key documentation, European Commission Decision (EU) 2021/915, and Alibaba Cloud Model Studio model decommissioning policy · rechecked 2026-08-11

When does the answer change after a vendor passes review?

The answer changes when the model ID, provider, endpoint region, data scope, subprocessor chain, retention rule, incident owner, or service remedy changes. Treat a retirement notice as a new review event: Alibaba Cloud’s policy gives snapshot models 30 days and mainline models 3 months of notice, with limits reducing during the retirement window.

Source: Alibaba Cloud Model Studio model decommissioning policy · rechecked 2026-08-11

The practical trade-off is deliberate friction. A dated ledger takes longer to complete than a vendor questionnaire, but it lets an engineer and a procurement lead inspect the same model, endpoint and contract record. SteadyGateway’s compliance evaluation guide explains the evidence boundary; the production engagement model explains how a scoped access conversation starts.

For a concrete model check, compare the exact qwen3.7-max and kimi-k2.7-code records, then open the benchmark method before asking for current production numbers.

What questions belong in an AI model vendor due diligence checklist?

The questions below condense the checklist into prompts a procurement lead can send to a vendor and a platform engineer can verify against the evidence pack.

What is an AI model vendor due diligence checklist?

It is a dated evidence checklist for the exact model and workload: identity, provider and region boundaries, credential scope, subprocessors, lifecycle changes, incidents, and contract remedies.

Which model facts should a buyer verify first?

Verify the exact model ID, release state, context limit, modalities, documented role, licence, provider route, and the date each record was captured. A family name is not a version record.

What region evidence should an AI vendor provide?

Request the processing endpoint, storage and logging locations, contracting entities, backup scope, retention period, deletion path, transfer mechanism, and a review owner. A region selector alone does not answer the full data-flow question.

How should API key permissions be reviewed?

Review whether the key is all-model or custom-scoped, which IP addresses and models it can reach, who rotates it, and how it is revoked. Alibaba Cloud Model Studio documents both all and custom permission settings.

What subprocessor questions belong in vendor due diligence?

Ask who is in the chain, how each subprocessor is authorized, how additions are announced, how objections work, which obligations flow down, and which party remains responsible.

When should a model vendor review be reopened?

Reopen it when the model ID, provider, region, data scope, subprocessor chain, retention, incident process, or service terms change. A retirement notice is a change-control event, not a routine documentation update.

Turn the checklist into a production scope.

Send the intended models, data categories, region needs and review questions. We will return the access boundary and evidence path in writing.

Request production accesshello@steadygateway.com

99.9% availability commitment with tiered service credits · Reply within one business day · NDA available on request