OAG_Vendor_AI_Questionnaire - DO NOT FILL OUT - REFERENCE DOCUMENT ONLY.xlsx

XLSX spreadsheet 71 KB Posted Jul 23, 2026

Attached to: RFI 26-002 - Modern eDiscovery Platform with Secure AI Supported Capabilities
Solicitation number: 2137398
Issued by: Albany County, Albany City, New York

About this file

Written by GovTribe AI · Sep 14, 2026

This document is a Generative AI Vendor Evaluation and Qualitative Risk Assessment questionnaire developed by the New York State Attorney General's Office (OAG) to evaluate third-party vendors providing generative AI products or services. The assessment model is structured in four primary phases: risk analysis across five domains (use of generative AI, business integration, use of confidential data, business resiliency, and regulatory/compliance exposure), adjustment of due diligence questions for internal stakeholder review, adjustment of vendor questionnaire questions, and compilation of final assessment findings. The questionnaire is designed as a reference document for assessing vendors and is not intended to be completed by external parties. Questionnaire responses address eight major domains including general discovery, data privacy and retention, model training and validation, information security, technology integration, Nth party risk, and legal and regulatory compliance. The assessment framework utilizes a three-level risk categorization system that determines which questionnaire depth (Level 1, 2, or 3) is appropriate for vendor evaluation, with higher risk scenarios triggering more comprehensive due diligence requirements.

The questionnaire template includes 73 questions distributed across internal stakeholder and vendor assessment sections, with questions either included or excluded based on assessed risk levels and organizational needs. Assessment questions address critical areas including data handling practices, foundational model specifications, security testing protocols, subcontractor disclosure requirements, intellectual property ownership, liability assumptions, indemnification provisions, service level agreements, and data deletion capabilities upon contract termination. The document version dated November 2023 provides instructions for formatting, archiving, and filtering assessment results, with guidance for converting assessments to PDF format for record-keeping. The template includes sections for documenting business justification, use case categorization, compliance with internal policies, vendor regulatory compliance capabilities, and potential exposure to copyrighted or protected information in AI-generated outputs. No pricing information, contract terms, or incumbent vendor details are specified in this reference document, as it serves as an evaluation methodology rather than a procurement announcement or completed assessment.

View the file

Other files

File	Type	Posted
RFI 26-002 - Purchasing Memorandum I - Q&A Extension.pdf	PDF	Jul 23, 2026
RFI 26-002 - Purchasing Memorandum II - Answers to Questions and Inquiries.pdf	PDF	Jul 23, 2026
RFI 26-002 - eDiscovery.pdf	PDF	Jul 23, 2026

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

1- Assessment Model OAG Generative AI - Vendor Evaluation and Qualitative Risk Assessment

Enter Vendor Information

Third-Party Name:

Website:

Product/Service:

Date Completed:

STEP 2 - Complete the Risk Analysis to Determine a Due Diligence Plan

	Domains / Risk	1-Low	2-Moderate	3-High	Choose Estimated Risk Level
1	Use of Generative AI (GenAI)	1L. Your organization is exploring the functionality of generative AI for educational purposes or R&D.	1M. Your organization's use of GenAI is limited to vendors who integrate generative AI technology as a secondary/supplemental service.	1H. Your organization's intended use of GenAI aligns with: 1) Utilizing the GenAI to generate influential content for customers; or 2) Developing a custom application that relies on a publicly available generative AI model for core functionality; or 3) Utilizing the GenAI to assist in code generation, or 4) Utilizing the GenAI to provide financial guidance to customers (regardless if human review)	3
2	Business Integration	2L. The GenAI outputs are not integrated with business processes.	2M. The GenAI outputs may be integrated with business processes.	2H. The GenAI outputs are integrated with business processes or critical non-financial business processes.	2
3	Use of Confidential Data	3L. No customer or company confidential information is used as inputs or is otherwise stored, processed, or transmitted by the system.	3M. No confidential data is used as inputs/prompts but inputs may include confidential company data. Agency data is not used to train the foundational model.	3H. There is a high probability that customer or company confidential information will be used as inputs/prompts, is used to train the foundational model, or is otherwise stored, processed, or transmitted by the system.	1
4	Business Resiliency	4L. Downtime of the GenAI functionality will not affect business operations.	4M. Downtime of the GenAI functionality will not materially impact business operations. Reversion from GenAI to human-driven activity is cost-effective and achievable within an acceptable period of time.	4H. Downtime could materially impact business operations. Reversion from GenAI to human-driven activity is prohibitive from a cost and/or personnel perspective, or is not possible.	2
5	Potential for Regulatory, Compliance, Reputation, or Operational Exposure	5L. Low potential for regulatory, compliance, or operational exposure resulting from your organization's use of generative AI.	5M. Moderate potential for regulatory, compliance, or operational exposure resulting from your organization's use of generative AI.	5H. High potential for regulatory, compliance, or operational exposure could result from your organization's use of generative AI.	3
				Recommended Due Diligence Plan	3

STEP 3 - Accept or Adjust the Due Diligence Questions that Will Appear in Internal Stakeholder Questionnaire

Instructions: Select INCLUDE to include a question in the level 1, 2, or 3 internal stakeholder questionnaire. Select EXCLUDE to exclude the question. You may change the settings to suit the needs of your organization.
	Questions for Internal Stakeholders	Level 1	Level 2	Level 3	Guidance
1	What is the business justification for generative AI?	INCLUDE	INCLUDE	INCLUDE	Free form
2	What is the intended use case for generative AI?	INCLUDE	INCLUDE	INCLUDE	Educational; R&D; Secondary feature or supplemental service; Generate content for casework; Internally developed application; Code generation; Legal guidance to public
3	Will the generative AI service be accessible outside the agency?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
4	[IF YES] Have we communicated with counsel that we will be incorporating generative AI services into our offerings?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
5	Does the use case comply with internal policies or standards related to generative AI?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
6	Do we have any contractual limitations/restrictions that prohibit the use of generative AI with customers, business partners, or otherwise integrating into our services?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7	Do we need to amend contracts or Terms and Conditions to limit our liability resulting from use of generative AI services?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
8	Does the use case of this engagement include the use of any artificial intelligence (AI) or generative AI functions to facilitate the completion of their services?	EXCLUDE	EXCLUDE	EXCLUDE	Yes, No, Undetermined
9	[IF YES] Please describe how you expect the third party to use AI to facilitate their services, including any specific AI technologies or vendors (if known). If you are unsure, or if the possible use of AI has not been finalized, please describe the possible scope or determining factors.	INCLUDE	INCLUDE	INCLUDE	Free form
10	[IF YES] Will the third party use a private AI solution (i.e. not accessible to the public), or will the third party be using publicly accessible AI solution / tools?	INCLUDE	INCLUDE	INCLUDE	Private, Public, Unsure
11	Can or does the vendor comply with all appropriate laws, rules, and regulations pertaining to the Company?	INCLUDE	INCLUDE	INCLUDE	Yes, Partially, No, Undetermined

STEP 4 - Accept or Adjust the Due Diligence Questions that Will Appear in the Vendor Questionnaire

Instructions: Select INCLUDE to include a question in the level 1, 2, or 3 internal stakeholder questionnaire. Select EXCLUDE to exclude the question. You may change the settings to suit the needs of your organization.
1.0	General (Discovery)	Level 1	Level 2	Level 3	Guidance
1.1	Does your organization leverage generative AI?	INCLUDE	INCLUDE	INCLUDE	Yes - for product or service, Yes - for business development, Yes - for predictions based on patterns, Yes - Other (Use comments to describe)
1.2	Does your organization use generative AI in support of services provided to our Company?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
1.3		IN THE VENDOR QUESTIONNAIRE, THIS LINE IS USED TO DISPLAY THE PROCEED/DO NOT PROCEED DECISION BASED ON THE VENDOR'S ANSWERS TO 1.1 AND 1.2
1.4	[IF YES to 1.1 or 1.2] In what ways will our purchased product depend on generative AI?	INCLUDE	INCLUDE	INCLUDE	Not dependent, Highly dependent, Key features only, Secondary features only
1.5	[IF YES to 1.1 or 1.2] Will the use of generative AI support any customer interactions or services?	INCLUDE	INCLUDE	INCLUDE	Yes, No
2.0	Data Privacy, Retention and Deletion	Level 1	Level 2	Level 3	Guidance
2.1	Will our Company's use of your product remain anonymous?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.2	Does your product offer transparent notice to an end user that they will be interacting with a generative AI system?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.3	Is there an option to opt out of the generative AI features?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.4	[IF YES] Who has the option to opt out?	INCLUDE	INCLUDE	INCLUDE	Individual users, Entire organization, Both
2.5	[IF YES] If an end user opts to not use the generative artificial intelligence portion(s) of your product, to what degree will your product still function?	INCLUDE	INCLUDE	INCLUDE	Primary functionality remains, It will not function, Functionality will be limited, No opt-out available, Undetermined
2.6	Will data we input into the model be used to train the model?	EXCLUDE	INCLUDE	INCLUDE	Yes-Global, Yes-Your Instance Only, No, Optional-Global Setting, Optional-Your Instance Only, Optional-Per User, Undetermined
2.7	[IF YES] Can you provide evidence that opt outs have been removed?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined, N/A
2.8	Are prompts attributable to specific users or organizations (when no identifying information is included in the prompt)?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.9	[IF NO] Can you provide evidence of the controls used to prevent attribution?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.10	Will our inputs to the model remain segmented from that of other companies?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.11	Does the vendor moderate prompts (inputs) for the purpose of evaluating inappropriate content or bias?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.12	Are there different data retention polices for the user interface versus the API?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.13	How long will our inputs/prompts be retained if submitted via the user interface?	EXCLUDE	INCLUDE	INCLUDE	No retention, <30 days, >30 days, Indefinitely, Undetermined
2.14	How long will our inputs/prompts be retained if submitted via the API?	EXCLUDE	INCLUDE	INCLUDE	No retention, <30 days, >30 days, Indefinitely, Undetermined
2.15	[IF RETAINED] Is the data retention period configurable?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.16	[IF RETAINED] Can our data be deleted on request, even if temporarily retained?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.17	Where will our data reside?	EXCLUDE	INCLUDE	INCLUDE	Directly with vendor, With vendor 4th party, With vendor Nth party, Undetermined
2.18	Do we have the option to choose country residency for our data?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.19	Will our data traverse international boundaries?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.20	Do we have the option to restrict usage of the generative AI platform by region or country?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
2.21	Will personally identifiable information sent to your product be anonymized?	EXCLUDE	EXCLUDE	INCLUDE	Yes, No, Undetermined
3.0	Model Training, Validation, and Maintenance	Level 1	Level 2	Level 3	Guidance
3.1	What foundational model is used?	EXCLUDE	INCLUDE	INCLUDE	Licensed Proprietary, Open Source, Undetermined
3.2	Will you provide the common name of the foundational model? (e.g. GPT-3.5, LLAMA, etc.)	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
3.3	Does the generative AI feature rely on a Large Language Model (LLM)?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined, N/A
3.4	[IF YES] Is the product's LLM trained on an open or closed model?	EXCLUDE	INCLUDE	INCLUDE	Open, Closed, Undetermined
3.5	Do you have controls in place to ensure the foundational model was not trained with prohibited or biased content?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Nth Party, Undetermined
3.6	Do you check the provenance of the data in the training set to ensure its use is permitted?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
3.7	Is the model data de-identified, aggregated, and anonymized?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
3.8	Does your model training process include human re-enforcement?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
3.9	Do you publish a change log for the model?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
3.10	Have you performed any independent audits or validation of AI model outputs?	EXCLUDE	EXCLUDE	INCLUDE	Yes, No, Undetermined
3.11	[IF YES] Are you willing to share those results?	EXCLUDE	EXCLUDE	INCLUDE	Yes, No, Undetermined, N/A
3.12	[IF YES] What is the frequency of model validation and testing?	EXCLUDE	EXCLUDE	INCLUDE	Continuous, Each major release, Annually, Other
4.0	Information Security	Level 1	Level 2	Level 3	Guidance
4.1	Are penetration tests or other types of security assessments conducted on the model?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
4.2	[IF YES] Do you regularly share / post the results of these independent tests?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined, N/A
4.3	[IF YES] What is the frequency of model validation and testing?	INCLUDE	INCLUDE	INCLUDE	Continuous, Each major release, Annually, Other
4.4	Are we permitted to test the model controls using prompt engineering techniques?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
4.5	Does the AI system or provider have change/release management processes to identify, reduce/mitigate, and manage toxic outputs, hallucinations, and biases during system development and operation?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Partial, Undetermined
4.6	Do you ensure that third-party libraries and components integrated into the AI system are current and secure?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Partial, Undetermined
4.7	Are you able to provide evidence of the implementation, effectiveness, and maintenance of security controls within the AI system?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
4.8	Do you maintain evidence of baseline configurations and any subsequent changes made to the AI system?	EXCLUDE	INCLUDE	INCLUDE	Yes (Able to Provide), Yes (Unable to Provide), No, Undetermined
4.9	Do you log security-related events (unplanned or externally initiated event) in the AI system? (e.g. breaches, exfiltration of data, attempted exploits)	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
4.10	Is there a formalized training to ensure stakeholders remain current on best practices, emerging threats, and risks associated with AI?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
4.11	What measures are in place to prevent unintentional leakage of private or sensitive information?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
4.12	Are safeguards implemented to protect the AI system agaInst malicious input or prompt injections?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
4.13	Do you maintain a configuration management plan, and can you provide evidence of its implementation?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
5.0	Technology Integration	Level 1	Level 2	Level 3	Guidance
5.1	Can the generative AI system be integrated via an API?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
5.2	Do you offer private (in-house) and public options for use of the generative AI system?	EXCLUDE	INCLUDE	INCLUDE	Private and Public, Public only, Undetermined
5.3	Do you allow third parties to develop plugins or add-ons for sale to the public?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
5.4	[IF YES] Do you publish standards for developers?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined, N/A
5.5	[IF YES] Do you review the plugins or add-ons before publication to ensure they meet the same security standards as your AI solution?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined, N/A
6.0	Nth Party Risk/Usage	Level 1	Level 2	Level 3	Guidance
6.1	Do you utilize subcontractors in the development of or support of your generative AI system?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
6.2	[IF YES] Will you disclose the subcontractors who support the platform?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined, N/A
6.3	Will subcontractors have access to any of our data that we submit to the generative AI system, or that has been captured in logs?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
6.4	[IF YES] Do you have a Third Party Risk Management (TPRM) policy by which you have assessed those subcontractors?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
6.5	Is the generative AI service delivered via a cloud service provider (CSP)?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
6.6	[IF YES] Which one?	INCLUDE	INCLUDE	INCLUDE	Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), Other, N/A
6.7	[IF YES] Is the same CSP used for failover / disaster recovery purposes?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined, N/A
6.8	Will you disclose the critical subservice providers that support the platform?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.0	Legal, Regulatory, and Compliance	Level 1	Level 2	Level 3	Guidance
7.1	Will you disclose future discoveries in the model that may materially impact the output?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.2	Is the AI model continuously scanned (security scans, bias scans, etc.)?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.3	Do you maintain policies and procedures related to user privacy, biases, and explainability?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.4	Are your services compliant with relevant data protection regulations (e.g., GDPR, HIPAA) and industry-specific regulations (e.g., finance, healthcare)?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.5	Can you provide documentation of compliance or audits?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.6	Is your service compliant with regulations such as GLBA, CCPA, GDPR, or other data protection laws/regs regarding the handling of personal identifying information?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.7	Do you have a Data Processing Agreement (DPA) that outlines data protection responsibilities?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.8	Who owns the data generated by the generative AI system?	INCLUDE	INCLUDE	INCLUDE	Customer, Vendor, Depends on the Input or Output, Undetermined
7.9	Is ownership clearly defined in the Terms and Conditions?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.10	Are there any restrictions on how we can use the AI-generated content?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.11	Is there any potential that copyrighted or other protected information could be produced as outputs from the generative AI systems?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.12	Do you provide mechanisms to trace or audit the AI-generated results?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.13	Do you assume liability in the event that the output of the generative AI system contradicts laws or regulations?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.14	Is there an indemnification clause in the contract to protect clients in such situations?	INCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.15	Do you provide guaranteed SLAs for uptime of the generative AI service?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.18	Is there a subcontractor disclosure provision in the contract?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined
7.19	Should we need to terminate the relationship, will you be able to remove our data from your generative AI system in a reasonable period of time?	EXCLUDE	INCLUDE	INCLUDE	Yes, No, Undetermined

v.2023.11.13

2 - Stakeholder Questionnaire

	OAG Generative AI - Internal Stakeholder Questionnaire
		Level 3
		For Use by Assessment Administrator:
Was the Internal Stakeholder Questionnaire Used in this Assessment?	Yes	Reason not used:
		Third-Party Name:	0
		Website:	0
		Product/Service:	0
		Instructions:
		Use the Comments field to add relevant details, including the name of the individual proving the response.
		If some questions appear partially hidden, highlight Column B and select Home > Format > Auto Fit Row Height.
		For Internal Use	Response	Comments
	1	What is the business justification for generative AI?	[use comments]
	2	What is the intended use case for generative AI?	Select one…
	3	Will the generative AI service be accessible outside the agency?	Select one…
	4	[IF YES] Have we communicated with counsel that we will be incorporating generative AI services into our offerings?	Select one…
	5	Does the use case comply with internal policies or standards related to generative AI?	Select one…
	6	Do we have any contractual limitations/restrictions that prohibit the use of generative AI with customers, business partners, or otherwise integrating into our services?	Select one…
	7	Do we need to amend contracts or Terms and Conditions to limit our liability resulting from use of generative AI services?	Select one…
	8	EXCLUDED	Select one…
	9	[IF YES] Please describe how you expect the third party to use AI to facilitate their services, including any specific AI technologies or vendors (if known). If you are unsure, or if the possible use of AI has not been finalized, please describe the possible scope or determining factors.	[use comments]
	10	[IF YES] Will the third party use a private AI solution (i.e. not accessible to the public), or will the third party be using publicly accessible AI solution / tools?	Select one…
	11	Can or does the vendor comply with all appropriate laws, rules, and regulations pertaining to the Company?	Select one…

v.2023.10.14

Data

Educational	Internally developed application	Code generation	Legal guidance to public
R&D
Secondary feature or supplemental service
Generate content or analysis
Internally developed application
Code generation
Legal guidance to public

3 - Vendor Questionnaire

OAG Generative AI - Vendor Questionnaire
	Level 3
	Third-Party Name:	0
	Website:	0
	Product/Service:	0
	Instructions:
	Use the Comments field to add relevant details.
	If some questions appear partially hidden, highlight Column B and select Home>Format>Auto Fit Row Height.
	Domain	Response	Comments
1.0	General (Discovery)
1.1	Does your organization leverage generative AI?
1.2	Does your organization use generative AI in support of services provided to our Company?
1.3	Generative AI in use: Please complete the rest of the questionnaire.
1.4	[IF YES to 1.1 or 1.2] In what ways will our purchased product depend on generative AI?
1.5	[IF YES to 1.1 or 1.2] Will the use of generative AI support any customer interactions or services?
2.0	Data Privacy, Retention, and Deletion
2.1	Will our Company's use of your product remain anonymous?
2.2	Does your product offer transparent notice to an end user that they will be interacting with a generative AI system?
2.3	Is there an option to opt out of the generative AI features?
2.4	[IF YES] Who has the option to opt out?
2.5	[IF YES] If an end user opts to not use the generative artificial intelligence portion(s) of your product, to what degree will your product still function?
2.6	Will data we input into the model be used to train the model?
2.7	[IF YES] Can you provide evidence that opt outs have been removed?
2.8	Are prompts attributable to specific users or organizations (when no identifying information is included in the prompt)?
2.9	[IF NO] Can you provide evidence of the controls used to prevent attribution?
2.10	Will our inputs to the model remain segmented from that of other companies?
2.11	Does the vendor moderate prompts (inputs) for the purpose of evaluating inappropriate content or bias?
2.12	Are there different data retention polices for the user interface versus the API?
2.13	How long will our inputs/prompts be retained if submitted via the user interface?
2.14	How long will our inputs/prompts be retained if submitted via the API?
2.15	[IF RETAINED] Is the data retention period configurable?
2.16	[IF RETAINED] Can our data be deleted on request, even if temporarily retained?
2.17	Where will our data reside?
2.18	Do we have the option to choose country residency for our data?
2.19	Will our data traverse international boundaries?
2.20	Do we have the option to restrict usage of the generative AI platform by region or country?
2.21	Will personally identifiable information sent to your product be anonymized?
3.0	Model Training, Validation, and Maintenance
3.1	What foundational model is used?
3.2	Will you provide the common name of the foundational model? (e.g. GPT-3.5, LLAMA, etc.)
3.3	Does the generative AI feature rely on a Large Language Model (LLM)?
3.4	[IF YES] Is the product's LLM trained on an open or closed model?
3.5	Do you have controls in place to ensure the foundational model was not trained with prohibited or biased content?
3.6	Do you check the provenance of the data in the training set to ensure its use is permitted?
3.7	Is the model data de-identified, aggregated, and anonymized?
3.8	Does your model training process include human re-enforcement?
3.9	Do you publish a change log for the model?
3.10	Have you performed any independent audits or validation of AI model outputs?
3.11	[IF YES] Are you willing to share those results?
3.12	[IF YES] What is the frequency of model validation and testing?
4.0	Information Security
4.1	Are penetration tests or other types of security assessments conducted on the model?
4.2	[IF YES] Do you regularly share / post the results of these independent tests?
4.3	[IF YES] What is the frequency of model validation and testing?
4.4	Are we permitted to test the model controls using prompt engineering techniques?
4.5	Does the AI system or provider have change/release management processes to identify, reduce/mitigate, and manage toxic outputs, hallucinations, and biases during system development and operation?
4.6	Do you ensure that third-party libraries and components integrated into the AI system are current and secure?
4.7	Are you able to provide evidence of the implementation, effectiveness, and maintenance of security controls within the AI system?
4.8	Do you maintain evidence of baseline configurations and any subsequent changes made to the AI system?
4.9	Do you log security-related events (unplanned or externally initiated event) in the AI system? (e.g. breaches, exfiltration of data, attempted exploits)
4.10	Is there a formalized training to ensure stakeholders remain current on best practices, emerging threats, and risks associated with AI?
4.11	What measures are in place to prevent unintentional leakage of private or sensitive information?
4.12	Are safeguards implemented to protect the AI system agaInst malicious input or prompt injections?
4.13	Do you maintain a configuration management plan, and can you provide evidence of its implementation?
5.0	Technology Integration
5.1	Can the generative AI system be integrated via an API?
5.2	Do you offer private (in-house) and public options for use of the generative AI system?
5.3	Do you allow third parties to develop plugins or add-ons for sale to the public?
5.4	[IF YES] Do you publish standards for developers?
5.5	[IF YES] Do you review the plugins or add-ons before publication to ensure they meet the same security standards as your AI solution?
6.0	Nth Party Risk / Usage
6.1	Do you utilize subcontractors in the development of or support of your generative AI system?
6.2	[IF YES] Will you disclose the subcontractors who support the platform?
6.3	Will subcontractors have access to any of our data that we submit to the generative AI system, or that has been captured in logs?
6.4	[IF YES] Do you have a Third Party Risk Management (TPRM) policy by which you have assessed those subcontractors?
6.5	Is the generative AI service delivered via a cloud service provider (CSP)?
6.6	[IF YES] Which one?
6.7	[IF YES] Is the same CSP used for failover / disaster recovery purposes?
6.8	Will you disclose the critical subservice providers that support the platform?
7.0	Legal, Regulatory, and Compliance
7.1	Will you disclose future discoveries in the model that may materially impact the output?
7.2	Is the AI model continuously scanned (security scans, bias scans, etc.)?
7.3	Do you maintain policies and procedures related to user privacy, biases, and explainability?
7.4	Are your services compliant with relevant data protection regulations (e.g., GDPR, HIPAA) and industry-specific regulations (e.g., finance, healthcare)?
7.5	Can you provide documentation of compliance or audits?
7.6	Is your service compliant with regulations such as GLBA, CCPA, GDPR, or other data protection laws/regs regarding the handling of personal identifying information?
7.7	Do you have a Data Processing Agreement (DPA) that outlines data protection responsibilities?
7.8	Who owns the data generated by the generative AI system?
7.9	Is ownership clearly defined in the Terms and Conditions?
7.10	Are there any restrictions on how we can use the AI-generated content?
7.11	Is there any potential that copyrighted or other protected information could be produced as outputs from the generative AI systems?
7.12	Do you provide mechanisms to trace or audit the AI-generated results?
7.13	Do you assume liability in the event that the output of the generative AI system contradicts laws or regulations?
7.14	Is there an indemnification clause in the contract to protect clients in such situations?
7.15	Do you provide guaranteed SLAs for uptime of the generative AI service?
7.18	Is there a subcontractor disclosure provision in the contract?
7.19	Should we need to terminate the relationship, will you be able to remove our data from your generative AI system in a reasonable period of time?

Final Report

OAG Generative AI - Vendor Evaluation and Qualitative Risk Assessment
	Third-Party Name:	0
	Website:	0
	Product/Service:	0
	Date Completed:	12/31/99
Tips for Formatting and Archiving This Report:
Ensure the content is visible in all cells: Highlight all cells, then navigate to Home > Format > Auto-Fit Row Height.
Hide Excluded questions: Using the filter on Internal Stakeholders Responses cell, uncheck "EXCLUDED" to hide any questions excluded from all sections of the assessment.
Print to PDF for archiving: Navigate to File > Print and select the available print-to-PDF option.

	I. Table of Contents
	II. Risk Analysis
	III. Internal Stakeholder Responses
	IV. Vendor Responses
	1.0. General (Discovery)
	2.0. Data Privacy, Retention, and Deletion
	3.0. Model Training, Validation, and Maintenance
	4.0. Information Security
	5.0. Technology Integration
	6.0. Nth Party Risk / Usage
	7.0. Legal, Regulatory, and Compliance
	V. Additional Considerations
	II. Risk Analysis
The following risk analysis was used to determine the scope of due diligence and is not a final determination of risk to the organization.
	Domain	Risk	Selected Scenario (Determines Risk)
1	Use of Generative AI (GenAI)	HIGH	1H. Your organization's intended use of GenAI aligns with: 1) Utilizing the GenAI to generate influential content for customers; or 2) Developing a custom application that relies on a publicly available generative AI model for core functionality; or 3) Utilizing the GenAI to assist in code generation, or 4) Utilizing the GenAI to provide financial guidance to customers (regardless if human review)
2	Business Integration	MODERATE	2M. The GenAI outputs may be integrated with business processes.
3	Use of Confidential Data	LOW	3L. No customer or company confidential information is used as inputs or is otherwise stored, processed, or transmitted by the system.
4	Business Resiliency	MODERATE	4M. Downtime of the GenAI functionality will not materially impact business operations. Reversion from GenAI to human-driven activity is cost-effective and achievable within an acceptable period of time.
	Based on the above Risk Analysis, the Level 3 questionnaire was sent to the vendor. The vendor's responses are shown below.

	III. Internal Stakeholder Responses
Following are the questions submitted to internal stakeholders, their responses, and additional comments.

	Question	Responses	Comments
1	What is the business justification for generative AI?	[use comments]	No comments provided
2	What is the intended use case for generative AI?	Select one…	No comments provided
3	Will the generative AI service be accessible outside the agency?	Select one…	No comments provided
4	[IF YES] Have we communicated with counsel that we will be incorporating generative AI services into our offerings?	Select one…	No comments provided
5	Does the use case comply with internal policies or standards related to generative AI?	Select one…	No comments provided
6	Do we have any contractual limitations/restrictions that prohibit the use of generative AI with customers, business partners, or otherwise integrating into our services?	Select one…	No comments provided
7	Do we need to amend contracts or Terms and Conditions to limit our liability resulting from use of generative AI services?	Select one…	No comments provided
8	EXCLUDED	Select one…	No comments provided
9	[IF YES] Please describe how you expect the third party to use AI to facilitate their services, including any specific AI technologies or vendors (if known). If you are unsure, or if the possible use of AI has not been finalized, please describe the possible scope or determining factors.	[use comments]	No comments provided
10	[IF YES] Will the third party use a private AI solution (i.e. not accessible to the public), or will the third party be using publicly accessible AI solution / tools?	Select one…	No comments provided
11	Can or does the vendor comply with all appropriate laws, rules, and regulations pertaining to the Company?	Select one…	No comments provided

	IV. Vendor Responses
Following are the questions submitted to the vendor, the vendor's responses, and additional comments.
1.0	General (Discovery)	Responses	Comments
1.1	Does your organization leverage generative AI?	0	No comments provided
1.2	Does your organization use generative AI in support of services provided to our Company?	0	No comments provided
1.3	Generative AI in use: Please complete the rest of the questionnaire.
1.4	[IF YES to 1.1 or 1.2] In what ways will our purchased product depend on generative AI?	0	No comments provided
1.5	[IF YES to 1.1 or 1.2] Will the use of generative AI support any customer interactions or services?	0	No comments provided
2.0	Data Privacy, Retention, and Deletion	Responses	Comments
2.1	Will our Company's use of your product remain anonymous?	0	No comments provided
2.2	Does your product offer transparent notice to an end user that they will be interacting with a generative AI system?	0	No comments provided
2.3	Is there an option to opt out of the generative AI features?	0	No comments provided
2.4	[IF YES] Who has the option to opt out?	0	No comments provided
2.5	[IF YES] If an end user opts to not use the generative artificial intelligence portion(s) of your product, to what degree will your product still function?	0	No comments provided
2.6	Will data we input into the model be used to train the model?	0	No comments provided
2.7	[IF YES] Can you provide evidence that opt outs have been removed?	0	No comments provided
2.8	Are prompts attributable to specific users or organizations (when no identifying information is included in the prompt)?	0	No comments provided
2.9	[IF NO] Can you provide evidence of the controls used to prevent attribution?	0	No comments provided
2.10	Will our inputs to the model remain segmented from that of other companies?	0	No comments provided
2.11	Does the vendor moderate prompts (inputs) for the purpose of evaluating inappropriate content or bias?	0	No comments provided
2.12	Are there different data retention polices for the user interface versus the API?	0	No comments provided
2.13	How long will our inputs/prompts be retained if submitted via the user interface?	0	No comments provided
2.14	How long will our inputs/prompts be retained if submitted via the API?	0	No comments provided
2.15	[IF RETAINED] Is the data retention period configurable?	0	No comments provided
2.16	[IF RETAINED] Can our data be deleted on request, even if temporarily retained?	0	No comments provided
2.17	Where will our data reside?	0	No comments provided
2.18	Do we have the option to choose country residency for our data?	0	No comments provided
2.19	Will our data traverse international boundaries?	0	No comments provided
2.20	Do we have the option to restrict usage of the generative AI platform by region or country?	0	No comments provided
2.21	Will personally identifiable information sent to your product be anonymized?	0	No comments provided
3.0	Model Training, Validation, and Maintenance	Responses	Comments
3.1	What foundational model is used?	0	No comments provided
3.2	Will you provide the common name of the foundational model? (e.g. GPT-3.5, LLAMA, etc.)	0	No comments provided
3.3	Does the generative AI feature rely on a Large Language Model (LLM)?	0	No comments provided
3.4	[IF YES] Is the product's LLM trained on an open or closed model?	0	No comments provided
3.5	Do you have controls in place to ensure the foundational model was not trained with prohibited or biased content?	0	No comments provided
3.6	Do you check the provenance of the data in the training set to ensure its use is permitted?	0	No comments provided
3.7	Is the model data de-identified, aggregated, and anonymized?	0	No comments provided
3.8	Does your model training process include human re-enforcement?	0	No comments provided
3.9	Do you publish a change log for the model?	0	No comments provided
3.10	Have you performed any independent audits or validation of AI model outputs?	0	No comments provided
3.11	[IF YES] Are you willing to share those results?	0	No comments provided
3.12	[IF YES] What is the frequency of model validation and testing?	0	No comments provided
4.0	Information Security	Responses	Comments
4.1	Are penetration tests or other types of security assessments conducted on the model?	0	No comments provided
4.2	[IF YES] Do you regularly share / post the results of these independent tests?	0	No comments provided
4.3	[IF YES] What is the frequency of model validation and testing?	0	No comments provided
4.4	Are we permitted to test the model controls using prompt engineering techniques?	0	No comments provided
4.5	Does the AI system or provider have change/release management processes to identify, reduce/mitigate, and manage toxic outputs, hallucinations, and biases during system development and operation?	0	No comments provided
4.6	Do you ensure that third-party libraries and components integrated into the AI system are current and secure?	0	No comments provided
4.7	Are you able to provide evidence of the implementation, effectiveness, and maintenance of security controls within the AI system?	0	No comments provided
4.8	Do you maintain evidence of baseline configurations and any subsequent changes made to the AI system?	0	No comments provided
4.9	Do you log security-related events (unplanned or externally initiated event) in the AI system? (e.g. breaches, exfiltration of data, attempted exploits)	0	No comments provided
4.10	Is there a formalized training to ensure stakeholders remain current on best practices, emerging threats, and risks associated with AI?	0	No comments provided
4.11	What measures are in place to prevent unintentional leakage of private or sensitive information?	0	No comments provided
4.12	Are safeguards implemented to protect the AI system agaInst malicious input or prompt injections?	0	No comments provided
4.13	Do you maintain a configuration management plan, and can you provide evidence of its implementation?	0	No comments provided
5.0	Technology Integration	Responses	Comments
5.1	Can the generative AI system be integrated via an API?	0	No comments provided
5.2	Do you offer private (in-house) and public options for use of the generative AI system?	0	No comments provided
5.3	Do you allow third parties to develop plugins or add-ons for sale to the public?	0	No comments provided
5.4	[IF YES] Do you publish standards for developers?	0	No comments provided
5.5	[IF YES] Do you review the plugins or add-ons before publication to ensure they meet the same security standards as your AI solution?	0	No comments provided
6.0	Nth Party Risk / Usage	Responses	Comments
6.1	Do you utilize subcontractors in the development of or support of your generative AI system?	0	No comments provided
6.2	[IF YES] Will you disclose the subcontractors who support the platform?	0	No comments provided
6.3	Will subcontractors have access to any of our data that we submit to the generative AI system, or that has been captured in logs?	0	No comments provided
6.4	[IF YES] Do you have a Third Party Risk Management (TPRM) policy by which you have assessed those subcontractors?	0	No comments provided
6.5	Is the generative AI service delivered via a cloud service provider (CSP)?	0	No comments provided
6.6	[IF YES] Which one?	0	No comments provided
6.7	[IF YES] Is the same CSP used for failover / disaster recovery purposes?	0	No comments provided
6.8	Will you disclose the critical subservice providers that support the platform?	0	No comments provided
7.0	Legal, Regulatory, and Compliance	Responses	Comments
7.1	Will you disclose future discoveries in the model that may materially impact the output?	0	No comments provided
7.2	Is the AI model continuously scanned (security scans, bias scans, etc.)?	0	No comments provided
7.3	Do you maintain policies and procedures related to user privacy, biases, and explainability?	0	No comments provided
7.4	Are your services compliant with relevant data protection regulations (e.g., GDPR, HIPAA) and industry-specific regulations (e.g., finance, healthcare)?	0	No comments provided
7.5	Can you provide documentation of compliance or audits?	0	No comments provided
7.6	Is your service compliant with regulations such as GLBA, CCPA, GDPR, or other data protection laws/regs regarding the handling of personal identifying information?	0	No comments provided
7.7	Do you have a Data Processing Agreement (DPA) that outlines data protection responsibilities?	0	No comments provided
7.8	Who owns the data generated by the generative AI system?	0	No comments provided
7.9	Is ownership clearly defined in the Terms and Conditions?	0
7.10	Are there any restrictions on how we can use the AI-generated content?	0	No comments provided
7.11	Is there any potential that copyrighted or other protected information could be produced as outputs from the generative AI systems?	0
7.12	Do you provide mechanisms to trace or audit the AI-generated results?	0	No comments provided
7.13	Do you assume liability in the event that the output of the generative AI system contradicts laws or regulations?	0	No comments provided
7.14	Is there an indemnification clause in the contract to protect clients in such situations?	0	No comments provided
7.15	Do you provide guaranteed SLAs for uptime of the generative AI service?	0	No comments provided
7.18	Is there a subcontractor disclosure provision in the contract?	0
7.19	Should we need to terminate the relationship, will you be able to remove our data from your generative AI system in a reasonable period of time?	0	No comments provided

	V. Additional Considerations
Following are additional avenues you may choose to consider in a risk assessment of a generative AI product or service. This list is not all inclusive and your organization should pursue a risk assessment process in line with its risk appetite that adheres to its policies, procedures, regulatory requirements, and relevant laws.
ERROR:#REF!	ERROR:#REF!	ERROR:#REF!
ERROR:#REF!	ERROR:#REF!	ERROR:#REF!
ERROR:#REF!	ERROR:#REF!	ERROR:#REF!
ERROR:#REF!	ERROR:#REF!	ERROR:#REF!
ERROR:#REF!	ERROR:#REF!	ERROR:#REF!

//Confidential// v2023.11.21 Page &P of &N

File details come from the government source that posted it. Updated Sep 14, 2026.