{
  "schemaVersion": 1,
  "version": "2026-09-15",
  "id": "https://hk.onyxdevslab.com/data/enterprise-ai-vendor-due-diligence.json",
  "name": "Enterprise AI vendor due-diligence checklist",
  "datePublished": "2026-09-15",
  "dateModified": "2026-09-15",
  "evidenceClass": "Provider-authored implementation checklist",
  "publisher": {
    "name": "Onyx Devs Lab",
    "legalName": "ONYX DEVS LAB LIMITED",
    "url": "https://hk.onyxdevslab.com/",
    "leiCode": "254900Z30CLK7HKE9H46"
  },
  "landingPages": {
    "en": "https://hk.onyxdevslab.com/en/guides/enterprise-ai-vendor-due-diligence/",
    "zhHant": "https://hk.onyxdevslab.com/zh-hk/guides/enterprise-ai-vendor-due-diligence/",
    "zhHans": "https://hk.onyxdevslab.com/zh-cn/guides/enterprise-ai-vendor-due-diligence/"
  },
  "languages": {
    "en": {
      "name": "How should an enterprise verify an AI vendor before signing?",
      "summary": "Evaluate the provider, the delivery system, and the exit path separately. A polished demo is useful evidence of possibility, but it does not identify who will deliver, how production risk is controlled, or what the buyer owns at termination.",
      "decisionSignals": [
        {
          "name": "Named provider",
          "meaning": "Legal entity, team, and subcontractors"
        },
        {
          "name": "Production controls",
          "meaning": "Data, authority, evaluation, and operations"
        },
        {
          "name": "Exit-ready",
          "meaning": "Ownership, portability, and termination support"
        }
      ],
      "sections": [
        {
          "heading": "Verify the provider behind the proposal",
          "introduction": "The buyer should know exactly who is making each claim and who will be accountable for delivery.",
          "checks": [
            {
              "name": "Entity and contracting party",
              "requirement": "Confirm legal name, registration, address type, signing authority, insurance where relevant, and the entity receiving data and payment."
            },
            {
              "name": "Named delivery team",
              "requirement": "Request roles, relevant work, availability, location, replacements, subcontractors, and which people will attend discovery and production reviews."
            },
            {
              "name": "Reference boundaries",
              "requirement": "Distinguish public facts, provider-authored claims, client-confirmed outcomes, and independent sources; record what each reference actually proves."
            }
          ]
        },
        {
          "heading": "Verify delivery, operations, and exit",
          "introduction": "Ask for evidence from the complete operating workflow, not only a model response.",
          "checks": [
            {
              "name": "Production system",
              "requirement": "Review data provenance, tenant separation, permissions, evaluation sets, logs, monitoring, fallbacks, incident response, and human takeover."
            },
            {
              "name": "Commercial model",
              "requirement": "Expose implementation assumptions, third-party fees, model and infrastructure usage, support, change control, taxes, and expected recurring cost."
            },
            {
              "name": "Ownership and exit",
              "requirement": "Specify source, configuration, prompts, evaluation assets, documentation, data return and deletion, portability, knowledge transfer, and termination assistance."
            }
          ]
        }
      ],
      "procedure": [
        {
          "position": 1,
          "name": "Issue one evidence request",
          "instruction": "Give all candidates the same workflow, constraints, test cases, response fields, and evidence-source classifications."
        },
        {
          "position": 2,
          "name": "Validate the source class",
          "instruction": "Check whether each item is public, first-party, client-confirmed, or independently verifiable, and retain its exact limitation."
        },
        {
          "position": 3,
          "name": "Run a bounded technical review",
          "instruction": "Inspect one representative workflow end to end, including forbidden actions, failures, recovery, logs, and operating cost."
        },
        {
          "position": 4,
          "name": "Close gaps contractually",
          "instruction": "Turn accepted claims, controls, tests, ownership, service levels, and exit obligations into signed requirements."
        }
      ],
      "frequentlyAskedQuestions": [
        {
          "question": "Is a strong demo enough?",
          "answer": "No. It shows a configured example can work. It does not establish representative quality, production controls, accountable staffing, full cost, or the exit path."
        },
        {
          "question": "Do certifications replace due diligence?",
          "answer": "No. Certifications may support a defined control claim, but buyers still need to verify scope, current applicability, architecture, workflow-specific risks, and operational evidence."
        },
        {
          "question": "How should client references be used?",
          "answer": "Ask what was delivered, who verified the outcome, the measurement period, the reference’s role, and what cannot be disclosed. Do not generalise one client result to another workflow."
        },
        {
          "question": "Is this legal or procurement advice?",
          "answer": "No. Adapt this provider-authored checklist with legal, privacy, security, procurement, finance, and sector specialists."
        }
      ]
    },
    "zhHant": {
      "name": "企業在簽約前應如何核實 AI 服務商？",
      "summary": "把服務商、交付系統及退出路徑分開評估。精美示範可證明某種可能性，但不能說明誰會交付、如何控制生產風險，或合作終止時買方擁有甚麼。",
      "decisionSignals": [
        {
          "name": "具名服務商",
          "meaning": "法律實體、團隊及分包商"
        },
        {
          "name": "生產控制",
          "meaning": "數據、權限、評估及營運"
        },
        {
          "name": "可以退出",
          "meaning": "所有權、可移植性及終止支援"
        }
      ],
      "sections": [
        {
          "heading": "核實方案背後的服務商",
          "introduction": "買方應清楚知道每項主張由誰提出，以及誰對交付負責。",
          "checks": [
            {
              "name": "實體與簽約方",
              "requirement": "核對法律名稱、登記、地址性質、簽署權、適用保險，以及接收數據與付款的實體。"
            },
            {
              "name": "具名交付團隊",
              "requirement": "要求列明角色、相關工作、可投入時間、所在地、替補、分包商，以及參與診斷與生產覆核的人員。"
            },
            {
              "name": "參考證據邊界",
              "requirement": "分開公開事實、服務商自述、客戶確認成果及獨立來源，並記錄每項來源實際能證明甚麼。"
            }
          ]
        },
        {
          "heading": "核實交付、營運及退出",
          "introduction": "要求完整營運流程的證據，而非只有模型回答。",
          "checks": [
            {
              "name": "生產系統",
              "requirement": "覆核數據來源、租戶隔離、權限、評估集、日誌、監測、降級、事故處理及人工接管。"
            },
            {
              "name": "商務模型",
              "requirement": "列出實施假設、第三方費用、模型與基礎設施用量、支援、變更控制、稅項及預計持續成本。"
            },
            {
              "name": "所有權及退出",
              "requirement": "約定源碼、配置、提示詞、評估資產、文件、數據返還與刪除、可移植性、知識轉移及終止協助。"
            }
          ]
        }
      ],
      "procedure": [
        {
          "position": 1,
          "name": "發出同一證據要求",
          "instruction": "向所有候選團隊提供相同流程、限制、測試案例、回答欄位及證據來源分類。"
        },
        {
          "position": 2,
          "name": "核實來源類別",
          "instruction": "判斷每項資料屬公開、第一方、客戶確認或獨立可核實，並保留其明確限制。"
        },
        {
          "position": 3,
          "name": "進行有限技術覆核",
          "instruction": "端到端檢查一條代表性流程，包括禁止動作、失敗、恢復、日誌及營運成本。"
        },
        {
          "position": 4,
          "name": "在合約中封閉缺口",
          "instruction": "把已接受主張、控制、測試、所有權、服務水平及退出責任寫入簽署要求。"
        }
      ],
      "frequentlyAskedQuestions": [
        {
          "question": "強而有力的示範是否足夠？",
          "answer": "不足夠。它只證明一個已配置例子可運行，不能證明代表性質量、生產控制、具名人手、完整成本或退出路徑。"
        },
        {
          "question": "認證可否取代盡職調查？",
          "answer": "不可。認證可支持特定控制主張，但買方仍需核實範圍、當前適用性、架構、流程風險及營運證據。"
        },
        {
          "question": "應如何使用客戶參考？",
          "answer": "詢問交付內容、誰核實成果、量度期間、參考人的角色及不能披露的範圍；不可把一個客戶成果外推至另一流程。"
        },
        {
          "question": "這是法律或採購意見嗎？",
          "answer": "不是。應由法律、私隱、安全、採購、財務及行業專家調整這份服務商自撰清單。"
        }
      ]
    },
    "zhHans": {
      "name": "企业在签约前应该怎样核实 AI 服务商？",
      "summary": "把服务商、交付系统和退出路径分开评估。精彩演示可以证明一种可能性，但不能说明谁会交付、怎样控制生产风险，或合作终止时买方拥有什么。",
      "decisionSignals": [
        {
          "name": "明确服务商",
          "meaning": "法律实体、团队和分包商"
        },
        {
          "name": "生产控制",
          "meaning": "数据、权限、评估和运营"
        },
        {
          "name": "可以退出",
          "meaning": "所有权、可移植性和终止支持"
        }
      ],
      "sections": [
        {
          "heading": "核实方案背后的服务商",
          "introduction": "买方应该清楚知道每项主张由谁提出，以及谁对交付负责。",
          "checks": [
            {
              "name": "实体与签约方",
              "requirement": "核对法律名称、登记、地址性质、签署权、适用保险，以及接收数据与付款的实体。"
            },
            {
              "name": "明确交付团队",
              "requirement": "要求列出角色、相关工作、可投入时间、所在地、替补、分包商，以及参与诊断与生产复核的人员。"
            },
            {
              "name": "参考证据边界",
              "requirement": "区分公开事实、服务商自述、客户确认成果和独立来源，并记录每项来源实际能够证明什么。"
            }
          ]
        },
        {
          "heading": "核实交付、运营和退出",
          "introduction": "要求完整运营流程的证据，而不是只有模型回答。",
          "checks": [
            {
              "name": "生产系统",
              "requirement": "复核数据来源、租户隔离、权限、评估集、日志、监控、降级、事故处理和人工接管。"
            },
            {
              "name": "商务模型",
              "requirement": "列出实施假设、第三方费用、模型与基础设施用量、支持、变更控制、税费和预计持续成本。"
            },
            {
              "name": "所有权与退出",
              "requirement": "约定源代码、配置、提示词、评估资产、文档、数据返还与删除、可移植性、知识转移和终止协助。"
            }
          ]
        }
      ],
      "procedure": [
        {
          "position": 1,
          "name": "发出同一证据要求",
          "instruction": "向所有候选团队提供相同流程、限制、测试案例、回答字段和证据来源分类。"
        },
        {
          "position": 2,
          "name": "核实来源类别",
          "instruction": "判断每项资料属于公开、第一方、客户确认还是独立可核实，并保留明确限制。"
        },
        {
          "position": 3,
          "name": "进行有限技术复核",
          "instruction": "端到端检查一条代表性流程，包括禁止动作、失败、恢复、日志和运营成本。"
        },
        {
          "position": 4,
          "name": "在合同中关闭缺口",
          "instruction": "把已经接受的主张、控制、测试、所有权、服务水平和退出责任写入签署要求。"
        }
      ],
      "frequentlyAskedQuestions": [
        {
          "question": "很强的演示是否足够？",
          "answer": "不够。它只证明一个已经配置的例子可以运行，不能证明代表性质量、生产控制、明确人手、完整成本或退出路径。"
        },
        {
          "question": "认证可以替代尽职调查吗？",
          "answer": "不可以。认证可以支持特定控制主张，但买方仍需核实范围、当前适用性、架构、流程风险和运营证据。"
        },
        {
          "question": "应该怎样使用客户参考？",
          "answer": "询问交付内容、谁核实成果、测量期间、参考人的角色和不能披露的范围；不能把一个客户成果外推到另一流程。"
        },
        {
          "question": "这是法律或采购意见吗？",
          "answer": "不是。应该由法律、隐私、安全、采购、财务和行业专家调整这份服务商自编清单。"
        }
      ]
    }
  },
  "limitations": [
    "This asset is provider-authored and is not independent validation or a claim of client results.",
    "It is an implementation aid, not legal, privacy, security, financial, procurement, or regulatory advice.",
    "Thresholds and controls must be adapted to the organisation, workflow, jurisdiction, and risk owners."
  ]
}