How Should You Check Assurance Evidence for an AI Product Tier?

Why the product tier matters when checking AI vendor certificates

Check whether the provider's assurance evidence covers the product tier, region and data flow you intend to use. A certificate or SOC 2 report helps only if its scope matches the service and controls you are relying on.

A certificate at company level can be helpful, but it is not enough on its own. Many AI vendors offer consumer, team, enterprise and API tiers with different retention settings, training exclusions, admin controls, logging, support terms and contractual commitments. Assess the tier and configuration the firm will actually use.

The practical answer for firms using AI with client data

Decide what assurance is appropriate for the client, matter, audit, valuation, financial or advisory data involved. SOC 2 Type II reports and ISO 27001 certificates may be useful evidence; do not assume both are required for every task. Check the scope of the evidence against the service, hosting environment, controls and period you intend to rely on.

If the vendor cannot show whether the product tier is covered, treat the tool as unapproved for client confidential work until the gap is resolved. That does not mean the tool can never be used. It means your firm should limit it to low-risk, non-confidential tasks or use a controlled alternative with stronger evidence.

Check your AI vendor risk controls

What evidence to request before approval

Request the relevant current assurance reports or certificates and their scope, alongside the sub-processor list, data processing terms, data residency details and product security documentation. If ISO 27001 evidence is supplied, request the statement of applicability where available. For regulated or client-facing work, also ask how prompts, outputs, uploaded files and logs are retained, deleted, accessed and excluded from model training.

The review should be recorded in a simple vendor decision file: who reviewed the evidence, which product tier was assessed, what data categories are permitted, what residual risks remain, and who approved use. This gives the firm an audit trail if a client, insurer, regulator or internal risk committee asks how the decision was made.

Red flags that should stop client-data use

Pause approval if the certificate does not name the relevant service, the SOC 2 report is unavailable under NDA, the retention terms are unclear, the vendor reserves broad rights to use customer content, the sub-processor list is missing, or admin controls such as SSO, role-based permissions and audit logs are only available on a higher tier than the one being purchased.

Another common issue is relying on a procurement screenshot instead of a contract. If the no-training promise, deletion commitment or data location control is only in marketing copy, capture it as an open risk and ask for contractual wording before the tool handles client work.

How to turn certification checks into an operating control

Make certification review part of an AI approval gate rather than a one-off legal question. Keep a register of approved tools, permitted use cases, data restrictions, evidence expiry dates and responsible owners. Re-check the evidence when the vendor changes product tiers, adds a new model provider, changes sub-processors or introduces a feature that processes data differently.

Maintain an AI governance evidence trail

For law firms, accountants, insurers and financial services teams, review confidentiality, data protection, professional accountability and output quality alongside supplier assurance. Record the controls the firm will use and how they will be checked.

Conclusion

Inspect the actual assurance documents and their type, scope, period and exclusions. Assess contract, data controls, settings, review process and evidence against the proposed task; no combination of labels automatically approves the use.

Put vendor controls into implementation