Turn vendor due diligence into an evidence decision

Identify the entity and the service boundary

Confirm which legal entity signs the agreement, operates the service, invoices the buyer and owns or controls the relevant licensing permissions. A familiar brand may cover several entities with different responsibilities. Record the model package, delivery route and proposed use under review. Without that boundary, evidence about one service can be mistakenly used to approve another service with different infrastructure or data dependencies.

Ask the business sponsor why the service is needed and what would happen if it stopped. Distinguish optional research assistance from a dependency that supports time-sensitive decisions. That distinction should drive the depth of review and continuity planning. Do not require every small research supplier to answer an unrelated enterprise questionnaire while overlooking the few questions that determine the actual purchasing risk.

• Match the reviewed entity, product and intended use to the proposed order.

Use a risk-based evidence request

NIST SP 800-161 Revision 1 addresses cybersecurity risk across technology supply chains. Apply that perspective by identifying the upstream services and components that matter to this delivery. Request evidence proportionate to the dependency: a recent recovery exercise, an access-control demonstration or a documented correction process may answer more than a generic assurance statement copied from a marketing page.

For each request, record what claim it tests and how old the evidence may be before review is needed. Distinguish a supplier assertion, an observed demonstration and an independently assessed report. None is universally sufficient for every question. A report can be credible yet irrelevant if its scope excludes the hosted model endpoint, the relevant region or the subcontractor that processes the buyer's information.

• Record evidence scope, date and limitations beside each material claim.

Work through a fictional evidence gap

In a hypothetical procurement, a fictional supplier offers a hosted model service for USD 16,000 annually. The buyer requests twelve evidence items: five about delivery, four about security and three about rights. Ten arrive. The missing items are a completed recovery-test record and written confirmation that an upstream dataset permits the intended internal distribution. The supplier's ten-out-of-twelve completion rate is 83.33% rounded.

The buyer does not average those omissions away. It permits only a synthetic-data sandbox while the missing rights confirmation prevents real-data distribution and the recovery gap prevents operational reliance. This decision is not a conclusion that the supplier is incapable or dishonest. It records that two necessary claims remain unverified. A commercial discount would not resolve either missing piece of evidence.

• Treat material evidence gaps as gates, not merely deductions from a score.

Check the rights chain without inventing ownership

Ask what the supplier created, what it licensed and what it receives from another source. The response should distinguish model logic, underlying data, documentation and delivered outputs. A statement that the supplier owns its model does not establish that every embedded dataset can be redistributed. Request the relevant permission or an appropriately reviewed representation for the precise proposed recipient and use.

WIPO's technology-transfer overview describes licence scope through the terms of the agreement. Use that framing to keep rights questions specific rather than assuming purchase transfers ownership. Where the supplier cannot disclose an upstream contract, the responsible legal reviewer can consider alternative evidence and the remaining uncertainty. Procurement should record the conclusion and any use restriction without pretending to resolve intellectual-property law itself.

• Separate permissions for model logic, inputs and delivered outputs.

Assess operating capability and concentration

Ask who maintains the service, who handles incidents and what happens when a key operator is unavailable. Review the recovery evidence for the actual delivery route rather than accepting a backup policy as proof that restoration works. Identify concentrated dependencies such as a single upstream feed or unsupported package. The aim is to understand failure consequences and response options, not demand that every supplier eliminate all dependencies.

Commercial continuity evidence may include an explanation of funding, staffing and support capacity appropriate to the purchase. Do not infer solvency from an attractive website, a corporate registration or a customer logo. Likewise, confidential financial statements require authorized handling and competent interpretation. If sufficient evidence is unavailable, the buyer can reduce reliance, shorten the proposed commitment or seek another option without inventing a numerical failure probability.

• Test recovery capability and key-person coverage for the specific service.

Keep regulatory applicability explicit

FINRA Regulatory Notice 21-29 addresses member firms' supervision of outsourced activities and emphasizes that outsourcing does not remove their applicable responsibilities. It is not a universal vendor law for every purchaser. A firm's compliance function should determine which activities and obligations apply to its situation, including whether this proposed service supports a regulated function or is limited to a different research purpose.

Record that applicability decision separately from the supplier assessment. A technically strong supplier does not decide the buyer's regulatory perimeter, and a supplier questionnaire is not proof that a buyer's supervisory system is adequate. Escalate questions about registrations, records or customer information to the responsible specialists. Keep the procurement outcome bounded to the evidence and permissions actually reviewed.

• Have the buyer's qualified reviewers determine applicable obligations.

Issue a conditional or final conclusion

Write a short conclusion listing supported claims, unresolved gaps and the resulting approved use. Each condition needs an owner, due date and consequence if it remains unresolved. A condition that says obtain more documentation sometime is not operationally useful. Prefer a statement that names the missing evidence and explicitly limits reliance until a designated reviewer accepts it.

Retain the supplier's responses with their dates and schedule reassessment when a material event changes the service, such as a new subcontractor or delivery route. Do not present this fictional procurement as a real client engagement or the USD 16,000 figure as market pricing. The framework supports a reasoned purchase decision; it does not certify a supplier or provide legal or investment advice.

• Close each material gap with evidence or an explicit restriction.

Source notes

1. NIST SP 800-161 Revision 1, updated 2024: Cybersecurity Supply Chain Risk Management
2. FINRA Regulatory Notice 21-29: Outsourcing to Third-Party Vendors
3. WIPO: Technology Transfer Agreements