Vendor AI & Data Governance Audit Plan
Most small law firms are adding AI risk without adding AI governance. The problem is not just the shiny new AI tool. It is every ordinary vendor that now has AI quietly bolted onto the side.
Small law firms have a vendor problem hiding inside their AI problem.
A firm does not need an enterprise compliance department. But it does need a defensible file showing it acted reasonably before giving vendors access to client information.
AI is no longer limited to obvious tools like ChatGPT, Claude, Gemini, Copilot, or legal-specific AI platforms. It is embedded in email, document storage, PDF tools, practice management systems, transcription tools, intake platforms, website chat, legal research, payment systems, CRMs, and marketing tools.
That creates a simple problem for small firms: client data may be flowing into tools the firm has never reviewed for AI training, data retention, confidentiality, human review, deletion, subprocessors, or breach notice.
The goal is not to bury the firm in paperwork. The goal is to create a practical record that answers one question:
The six-part vendor audit
Need a lighter-weight first pass? Start with the AI Vendor Evaluation Worksheet.
Here is the practical version. No committee. No theater. Just the work that matters.
1. Inventory
List every vendor that touches firm data, client data, documents, emails, billing, payments, intake, research, transcription, or communications.
2. Classify
Sort vendors by risk. The higher the sensitivity of the data and the more AI involved, the more review is required.
3. Ask
Send written questions about AI use, data retention, confidentiality, deletion, human review, subprocessors, security, and policy changes.
4. Collect
Save the vendor’s written answers, contracts, privacy terms, AI terms, data processing addendum, subprocessor list, and security materials.
5. Decide
Approve, approve with limits, reject, or pause. Then document the decision. Vague concern is not governance. A written decision is.
6. Review Again
Set a review date. AI features, terms, subprocessors, and retention policies change. Yesterday’s answer may not protect tomorrow’s file.
Start with the vendor inventory
The first mistake is only reviewing vendors with “AI” in the name. That misses the real risk. AI is being added to ordinary software the firm already uses.
Every small firm should create a simple vendor inventory with the following fields:
| Field | What to capture |
|---|---|
| Vendor name | Microsoft, Google, Clio, Dropbox, LawPay, Zoom, Adobe, QuickBooks, website chat, transcription provider, answering service, etc. |
| Product or service | Email, storage, practice management, billing, intake, payments, communications, document review, research, marketing. |
| Data touched | Client documents, matter notes, emails, billing data, trust data, intake data, financial records, medical records, personal information. |
| AI features | Drafting, summarization, transcription, classification, predictive search, chat, recommendations, document generation. |
| AI status | Enabled, disabled, unknown, admin-controlled, user-controlled. |
| Risk tier | Low, medium, high, or critical. |
| Decision | Approved, approved with limits, not approved, or needs follow-up. |
The inventory does not need to be fancy. A spreadsheet is fine. The trick is actually filling it out. A blank spreadsheet is just a guilt document.
Classify vendors by risk
Not every vendor needs the same review. The office supply vendor does not need the same scrutiny as the document management system. Unless the stapler starts summarizing deposition transcripts. Then we have entered a darker timeline.
| Risk Tier | Vendor Type | Examples | Review Level |
|---|---|---|---|
| Low | No client or confidential data. | Office supplies, generic vendors, non-sensitive tools. | Basic vendor file. |
| Medium | Firm business data or limited client contact data. | Newsletter platform, CRM, appointment scheduler, payment processor. | Short review. |
| High | Client files, matter data, email, pleadings, contracts, discovery, billing. | Practice management, email, cloud storage, e-signature, transcription. | Full audit. |
| Critical | Privileged data plus AI processing, sensitive personal information, financial/trust data, or large-scale document analysis. | Legal AI, Microsoft Copilot/Gemini used on client files, e-discovery AI, intake bots. | Full audit + owner/partner approval + contract review. |
The questions that matter
The firm should not ask vendors vague questions like “Are you secure?” Every vendor says yes. Nobody writes back, “Honestly, it’s chaos here.”
Ask direct questions that create a record.
AI use
- Does the product use generative AI, machine learning, automated classification, transcription, summarization, drafting, or predictive technology?
- What AI features are currently available?
- Are AI features enabled by default?
- Can the firm disable AI features globally or by user?
- What AI models or third-party AI providers are used?
- Are prompts, uploaded documents, outputs, metadata, embeddings, usage logs, or support materials used to train, fine-tune, evaluate, test, or improve AI models?
Confidentiality
- Does the vendor contractually agree that firm and client data remains confidential?
- Can vendor employees, contractors, or third parties access firm data?
- If human review is possible, when does it happen and how is it controlled?
- Are access logs maintained?
- Does the vendor use customer data for analytics, benchmarking, marketing, advertising, product improvement, or AI development?
Retention and deletion
- How long is active data retained?
- How long are deleted files retained?
- How long are backups retained?
- How long are prompts, outputs, chat history, transcripts, summaries, logs, and metadata retained?
- Can the firm delete specific client or matter data?
- Can the vendor certify deletion after account termination?
Subprocessors and legal process
- What subprocessors or third-party providers process firm or client data?
- Are any third-party AI model providers involved?
- Will the vendor notify the firm before material subprocessor changes?
- Will the vendor notify the firm of subpoenas, court orders, warrants, or government requests unless legally prohibited?
Build the evidence file
The audit is only useful if the firm saves the proof. Do not rely on links alone. Download documents. Save screenshots. Date the file. Future you will not remember which version of the vendor’s AI terms existed when the decision was made.
| Evidence to save | Why it matters |
|---|---|
| Completed vendor questionnaire | Shows the firm asked specific questions. |
| Name, title, email, and department of respondent | Shows the answer came from an identifiable person. |
| Contract, MSA, order form, or terms | Shows the legal agreement governing the relationship. |
| Data processing addendum | Shows privacy and processing obligations. |
| AI terms or AI addendum | Shows how AI features treat data, prompts, outputs, and training. |
| Privacy policy and security documentation | Shows current public commitments and security posture. |
| Subprocessor list | Shows downstream providers that may touch firm data. |
| Retention and deletion policy | Shows what happens to data over time and after termination. |
| Admin settings screenshots | Shows what the firm actually configured. |
| Internal decision memo | Shows the firm reviewed the answer and made a decision. |
Use the right depth of review. For a single proposed tool, start with the short vendor worksheet. Use this audit when the firm needs a documented evidence file across vendors or client-data flows. For a firm-specific priority plan across tools, workflows, and risk points, see the AI Workflow Assessment.
Red flags that deserve follow-up
Some vendor answers should slow the process immediately. The AI Vendor Evaluation Worksheet is the simple gate to run before this full audit.
| Red Flag | Why it matters |
|---|---|
| “We use AI but cannot disclose the model provider.” | The firm cannot assess where client data may go. |
| “Customer data may be used to improve services.” | This could include model training, analytics, or product testing. |
| “Data may be reviewed by humans.” | The firm needs scope, controls, logging, and opt-out rights. |
| “Deleted data may remain in backups indefinitely.” | Retention and deletion are unclear. |
| “Terms may change at any time.” | The firm may lose control over material risk terms. |
| “See our website.” | Public marketing language is not enough for high-risk vendors. |
| “Ask your sales rep.” | That is not a governance answer. That is a detour. |
| No subprocessor list. | The firm cannot see who else may process client data. |
Approve, approve with limits, or reject
The audit should end with a written decision. Not a vibe. Not a hallway conversation. A decision.
Approve
Use when written answers are complete, confidentiality obligations are clear, client data is not used for shared/public AI training without consent, retention and deletion are understandable, and security documentation is acceptable.
Approve with limits
Use when the vendor is useful but not clean enough for unrestricted use. Example: approved for scheduling or admin data, but not for privileged documents or sensitive matter details.
Reject or pause
Use when the vendor refuses written answers, uses customer data for AI training without opt-out, cannot explain retention/deletion, or will not commit to confidentiality protections.
Use a short decision memo
For high-risk and critical vendors, create a one-page memo covering:
- Vendor and product.
- Use case.
- Data involved.
- AI features enabled or disabled.
- Documents reviewed.
- Key risks.
- Safeguards.
- Decision and limits.
- Approver and date.
- Next review date.
A simple internal rule
Small firms need clear operating rules, not museum-quality policies no one reads. Your insurer may care about the same answers. See the AI Insurance Audit.
Suggested firm rule: The firm may not enter, upload, transmit, or process client confidential information, privileged communications, client documents, matter materials, financial information, personal information, or other sensitive data in any vendor platform or AI-enabled feature unless the vendor has been reviewed and approved under the firm’s vendor due diligence process.
Approval should be documented in writing and should address confidentiality, AI training, data retention, deletion, security, human review, subprocessors, and breach notification.
That paragraph alone is worth posting near every “try this new AI tool” impulse.
Get the full Vendor AI & Data Governance Audit Packet
The public version gives you the framework. The full packet gives you the operating materials.
Included in the full packet
- Full vendor AI and data governance audit plan.
- Complete vendor questionnaire.
- Initial vendor request email.
- Follow-up email for vague vendor answers.
- Evidence file checklist.
- Risk tiering system.
- Decision memo template.
- Rollout plan for a small law firm.
Best use
Use it before giving a vendor access to client documents, emails, matter data, transcripts, intake information, billing data, or any AI-enabled feature that could process confidential information.
This is not paperwork for its own sake. It is how a small firm creates proof of reasonable diligence.
Ethics and risk-management anchors
This page is a practical operating resource, not legal advice. Firms should adapt the process to their jurisdiction, client base, vendor contracts, and applicable privacy/security obligations.