Vendor evidence check
Upload a vendor's contract, terms, security pack, model card and policies into a workspace, then check them against 14 AI vendor controls (data use for training, location, sub-processors, incident notice, audit rights, model change notice, exit, human oversight, APRA access and others). Each control is marked evidenced, unclear or not found, with the cited sentence.
Keyword evidence matching: "evidenced" means a sentence addresses the control, not that the commitment is adequate. A person must read the cited text and the contract. APRA CPS 230 paragraph references are from the 2023 standard; confirm against the current version.
Previous checks
No checks yet.
Control set
| ID | Control | Critical | Source |
|---|---|---|---|
| VC-01 | Use of customer data for model training Does the vendor use our data (prompts, files, outputs) to train or improve its models, and can this be switched off contractually? | yes | Victorian AI procurement guidance (information security); good practice |
| VC-02 | Data location and offshoring Where is our data stored and processed (including backups, support access and sub-processors), and can it stay in Australia? | yes | CPS 230 para 59(b) (material offshoring notification) |
| VC-03 | Sub-processors and material fourth parties Which sub-processors and model providers does the vendor rely on, and how will we be notified of changes? | yes | CPS 230 para 54(d) and (e) |
| VC-04 | Security incident notification What is the incident notification time frame, and what information will the vendor provide? | yes | Good practice; CPS 230 para 54(b)-(c) |
| VC-05 | Model and feature change notice Will we be notified before the vendor changes the model, adds AI features or changes how AI is used in the service? | Victorian AI procurement guidance (no new AI without approval; opt-out) | |
| VC-06 | Schedule of permitted AI uses Which specific AI uses are in scope of the service, and which are excluded? | Victorian AI procurement guidance (schedule of permitted AI uses) | |
| VC-07 | Audit and information rights What audit, assurance reports and information rights do we and our auditors have? | yes | CPS 230 para 54(b) (audit access); Victorian guidance (audit and information rights) |
| VC-08 | APRA access Will the vendor give APRA access to documentation, data and an on-site visit, and not impede APRA? | yes | CPS 230 para 55(a)-(c) |
| VC-09 | Termination, exit and data return or deletion Can we terminate all or part of the service, and how is our data returned and deleted on exit? | yes | CPS 230 para 54(g); good practice |
| VC-10 | Service levels and continuity What service levels, continuity arrangements and force majeure terms apply? | CPS 230 para 54(a) and (f) | |
| VC-11 | Ownership and control of data, liability and indemnity Who owns inputs and outputs, and what liability and indemnity apply to AI outputs? | CPS 230 para 54(b) | |
| VC-12 | Monitoring, accuracy and human oversight How does the vendor monitor model accuracy, drift and bias, and what human oversight controls are available? | Victorian AI procurement guidance (continuous monitoring, validation, human oversight) | |
| VC-13 | Information on automated decisions (APP 1.7-1.9) Does the product make, or substantially and directly support, decisions about individuals, and what information does the vendor give for our privacy policy? | OAIC APP 1.7-1.9 Transparency Obligation fact sheet | |
| VC-14 | Security certification and testing Which current certifications and independent tests (ISO/IEC 27001, SOC 2, ISO/IEC 42001, penetration or AI red-team tests) cover the AI service? | Good practice |
Answers come only from the governed library and are decision support, not legal advice. Verify regulatory content against the regulator's current publication.