COMPEL Glossary / vendor-due-diligence
Vendor Due Diligence
Vendor due diligence is the structured investigation of an AI vendor's or partner's capabilities, security practices, data handling procedures, compliance posture, financial stability, support quality, and contractual terms before entering a business relationship or deploying their technology.
What this means in practice
For AI vendors specifically, due diligence must cover model provenance, training data legality, bias testing practices, intellectual property encumbrances, performance guarantees, and the vendor's own AI governance maturity. For organizations, inadequate vendor due diligence can result in deploying AI systems that carry hidden risks the organization inherits but did not knowingly accept. In COMPEL, vendor due diligence is part of the third-party and supply chain AI governance covered in Module 3.4, Article 6, and the vendor ecosystem operating integration of Module 4.4, Article 8.
Why it matters
Inadequate vendor due diligence can result in deploying AI systems that carry hidden risks the organization inherits but did not knowingly accept, including biased models, legally questionable training data, and inadequate security practices. As organizations increasingly depend on third-party AI components, the vendor's governance maturity directly affects the organization's risk posture. Thorough due diligence is a prerequisite for responsible AI procurement.
How COMPEL uses it
Vendor due diligence is part of third-party and supply chain AI governance covered in Module 3.4, Article 6 during the Model stage. Due diligence covers model provenance, training data legality, bias testing, IP encumbrances, and governance maturity. The Governance pillar tracks vendor risk across the portfolio, and the vendor ecosystem operating integration of Module 4.4, Article 8 addresses ongoing vendor governance at scale.
Related Terms
Other glossary terms mentioned in this entry's definition and context.