Does an AI vendor have a published responsible AI policy?

A published policy can help you understand what an AI vendor says it aims to do. To decide whether the supplier is suitable for your firm, check how those commitments apply to the specific service and use you are considering, then compare the answers with the evidence and contract terms available.

What to ask the vendor

Ask for the policy and whether it covers the product and service in scope. A broad statement about responsible AI may not address every model, feature or use of your data.

• Currency: When was the policy issued or last reviewed? What prompts a review?
• Scope: Which products, models, staff and activities does it cover? Does that include the service you plan to use?
• Ownership: Who oversees the policy in practice? How does the vendor handle questions or exceptions?
• Evidence: What relevant procedures, records or product controls can the vendor share to show how its commitments are applied?
• Terms and support: Do the contract and support arrangements align with the vendor’s statements about data use, system changes and handling concerns?

These are practical procurement questions, not a statement of UK legal requirements. Your firm’s legal, regulatory and contractual position depends on its circumstances. The presence or absence of a vendor policy does not establish that position.

Use the answers to guide your decision

Look for answers that are specific to the service and consistent across the policy, supporting evidence and contract. If a commitment matters to your intended use, ask how it is put into practice and what the vendor can show you.

Record the policy version or date, the product and use case assessed, the evidence received and any open questions. If an answer is vague or the policy does not cover your use, ask for clarification. Then decide whether the remaining gap matters given the data, users and work involved. A gap warrants investigation; it is not by itself proof of harm or a legal breach.

Aona AI’s vendor-authored questionnaire includes this policy question. It suggests assessing the completeness and credibility of responses and reviewing gaps in individual sections rather than relying only on an overall score. This is commercial guidance from the questionnaire’s publisher, not independent assurance or UK legal authority. View the Aona questionnaire.

Discuss the supplier decision

If you are weighing a supplier or implementation decision, you can discuss it on a 30-minute Pattrn Data AI Automation Discovery Call with Rohit. The conversation can help you consider what next step makes sense and what may not be worth doing yet.