Evaluating an AI vendor: legal and technical due diligence checklist

Purpose

Questions to ask about source coverage, data retention, model training, security, audit logs, export, support and contractual terms.

Practical legal consequence

This guide is written for Malaysian legal work. It distinguishes the legal task from the technology, identifies confidentiality and verification risks, and gives a starting workflow that can be adapted by a practitioner or firm.

Suggested workflow

• Define the legal task and intended output.
• Classify the information and confidentiality risk.
• Choose the appropriate source, tool or workflow.
• Prepare documents and preserve source references.
• Test on a limited matter before relying on the workflow.
• Verify facts, authorities and assumptions.
• Record final lawyer review and improvements for next use.

Professional-use note

This guide is informational. Practitioners remain responsible for professional judgment, confidentiality, authority checking and compliance with organisational policy.