Data and security
- What data will be entered, uploaded, processed, stored, or logged?
- Will prompts, outputs, or documents be used to train models?
- Which subprocessors are involved?
- What security reports, attestations, or controls are available?
Due diligence checklist
AI vendor due diligence checklist for credit unions.
AI vendor diligence should produce more than a meeting transcript. Use this checklist to structure the questions, documents, and decision records a credit union team should capture before approving a pilot, purchase, or internal rollout.
Checklist
Questions to ask before approval.
Governance and oversight
- Who reviews AI outputs before use?
- What known limitations or failure modes are documented?
- How are incidents, errors, or complaints handled?
- What controls prevent unauthorized or high-risk use?
Decision record
Capture the outcome in plain language.
A useful diligence record should summarize the intended use, key evidence reviewed, open gaps, risk rating, required controls, unresolved questions, and recommended next step. CAI turns these inputs into a structured first-pass review packet for internal discussion.