Add-on service
AI vendor due diligence reports
Before you sign for ChatGPT Enterprise, Microsoft Copilot, Notion AI or any other AI tool, someone has to answer the supplier questions your clients and insurers will ask. We answer them for you, in a report you can file.
Best for: Businesses procuring a new AI tool, or answering a client security questionnaire about one they already use.
What's included
- Completed AI supplier due diligence questionnaire, ready to file
- Where your data goes: hosting regions, sub-processors and retention periods
- Whether your inputs can be used to train the vendor's models, and how to turn that off
- Contract red flags: liability caps, indemnities, model change rights, exit and deletion
- UK GDPR position: controller/processor roles, Article 28 terms and international transfers
- EU AI Act position: whether the vendor is a provider and what they publish about it
- A one-page summary you can hand to a client, insurer or board
Why vendor diligence is the question that stalls AI adoption
Most UK SMEs do not fail their AI compliance because of the regulation itself. They stall because a client sends a supplier questionnaire, or an insurer asks what happens to personal data pasted into an AI tool, and nobody in the business can answer with confidence. The answers exist — they are spread across the vendor's trust centre, DPA, sub-processor list and model terms — but assembling them takes hours per tool and has to be redone whenever the vendor changes their terms.
What we do
You tell us the tool, the plan you are on or considering, and roughly what data your team puts into it. We review the vendor's current published terms, data processing agreement, sub-processor list and security documentation, then produce a report written for a business reader rather than a lawyer. Where the vendor's position is genuinely unclear, we say so and give you the exact question to send them.
- Turnaround is normally three working days
- Reports are dated and reference the vendor terms in force at the time of review
- Findings drop straight into your Trestano register as notes against that tool
Tools we cover most often
ChatGPT and ChatGPT Enterprise, Microsoft 365 Copilot, Google Gemini for Workspace, Claude, Notion AI, Otter.ai and Fireflies, HireVue and other recruitment screening tools, Intercom Fin and similar support agents, and the AI features quietly added to CRM and accounting software. If your tool is not on that list, we will still cover it.
Common questions
Is this legal advice on the contract?
No. We flag the clauses that commonly cause problems and explain the practical effect in plain English so you can negotiate or brief a solicitor efficiently. Contentious or high-value contracts should still go to a qualified lawyer.
How long does a report stay valid?
Vendor terms change often, so we date every report and recommend a refresh annually, or sooner if the vendor announces a material change. Pro subscribers are alerted when a covered vendor updates terms we have reviewed.
Not sure which you need?
Run the free AI register first — it takes about ten minutes and usually makes the answer obvious. Or tell us what you're dealing with and we'll point you at the right thing.
Not legal advice. Trestano provides governance tooling, documentation and practical guidance. It isn't a substitute for advice from a qualified solicitor or your own compliance team.