DRAFT — Adapt for your institution. This template supplements your standard vendor assessment and HECVAT process.

Vendor AI Assessment Checklist

AI Governance Framework for Institutional Advancement

Complete during procurement, contract renewal, or when a vendor introduces new AI features.

Assessment details

Vendor name [Vendor name]

Product / service [Product or service name]

Assessment date [Date]

Assessor [Name and title]

Existing contract? [Y / N]

Contract renewal date [Date or N/A]

2. Transparency and Explainability

Vendor can explain model methodology at a level sufficient for governance committee evaluation Feature importances or model explanations are available for individual predictions Vendor provides instance-specific performance metrics (not just aggregate benchmarks) Vendor publishes model cards or equivalent technical documentation For generative AI: content provenance or attribution is available for generated outputs Model limitations and known failure modes are documented

Notes

3. Bias and Fairness

Vendor has conducted demographic bias testing on model outputs and can share methodology and results Vendor documents whether protected class attributes are used as model inputs and what safeguards exist Institution can test model outputs for disparate impact on its own constituent base Vendor provides tools or data exports for independent fairness evaluation Vendor has a documented process for addressing identified bias in model outputs

Notes

4. Security and Compliance

AI service holds relevant certifications (SOC 2 Type II, ISO 27001, FedRAMP) — document which Vendor has completed the current HECVAT assessment — verify that AI/ML-specific questions are addressed in the completed instrument Data processing agreement specifically covers AI processing, not just traditional SaaS Vendor documents how it handles AI-specific security threats (prompt injection, data poisoning, model extraction, adversarial inputs) Vendor's PII handling covers advancement-specific sensitive fields (giving amounts, bequest intentions, wealth estimates) Incident notification timeline for AI-specific events is documented (model errors, data exposure through model outputs) Vendor undergoes regular third-party security assessments covering AI infrastructure Access controls and audit logging are available for AI processing of institutional data Vendor's data processing agreement addresses FERPA compliance, including designation as a school official with legitimate educational interest where applicable, and restrictions on re-disclosure of education records

Notes

5. Contract Terms

Contract confirms institution retains all rights in its input data; vendor acquires no ownership interest Contract specifies the institution's rights in AI-generated outputs (scores, predictions, generated content), including whether outputs are works made for hire, licensed, or unowned Model outputs (scores, segments, predictions, generated content) are exportable in a portable format Contract addresses data handling and model disposition on termination AI-specific liability is addressed (harm from biased outputs, regulatory exposure from automated decisions) Contract includes audit rights for AI processing with defined scope, frequency or trigger conditions, cost allocation, notice period, and access to relevant systems or documentation Restrictions on using AI outputs outside the vendor's platform are documented and acceptable For generative AI: contract addresses copyright status of AI-generated content, including which party bears risk if outputs do not qualify for copyright protection

Notes

Risk Assessment Summary

Overall risk tier recommendation [1 / 2 / 3]

See AI Governance Committee Charter for tier definitions. Tier 1 = minimal risk, Tier 2 = moderate risk, Tier 3 = high risk.

Key findings

Outstanding questions requiring vendor response

Conditions for approval, if any

Recommendation

Approve Approve with conditions (document conditions above) Deny (document rationale above) Defer — outstanding questions require vendor response before assessment can be completed

Signatures

Assessor name [Name]

Assessor title [Title]

Date [Date]

Committee review date [Date]

Committee decision [Decision]

Vendor AI Assessment Checklist

Vendor AI Assessment Checklist

Assessment details

1. Model and Data

Notes

2. Transparency and Explainability

Notes

3. Bias and Fairness

Notes

4. Security and Compliance

Notes

5. Contract Terms

Notes

Risk Assessment Summary

Key findings

Outstanding questions requiring vendor response

Conditions for approval, if any

Recommendation

Signatures