Generative AI at Work / Unit 7 GAI 171 worked example, 60 to 90 seconds
Reviewing a Vendor's AI Tool
The idea
Reviewing a vendor's AI tool before adoption combines NIST's third-party guidance with the privacy checks of this unit, and follows five steps.
In practice
Step one: identify the type of AI, whether a foundation model, a fine-tuned model or a feature embedded in other software, since controls differ by type. Step two: read the data terms: what the tool keeps, for how long, where it is processed, and whether it trains on your inputs. Step three: ask for the vendor's evidence: its component list, service levels, independent audit or attestation reports, and how it reports incidents. Step four: test it on your own realistic cases before any decision. Step five: record the decision, the approved uses and the conditions, and set a date to review it again.
Where people slip
Vendor answers describe the product as sold; updates change it. Build the re-review date in at the start, and treat a major model change as a new review.
Your place on the trail
Every lesson rests on earlier ones and opens later ones. Tap any to jump.
Something wrong in this lesson? Flag it · Sources for Generative AI at Work