Draft a vendor risk memo with a real decision at the end
This page lists three turns, the messages you send to the AI one after another in the same chat, and then a check of the answer. Keep it open next to your chat. Each turn shows the next thing to paste, with the values you entered already filled in. Nothing is sent from this page, and your conversation stays in the AI tool you are using.
Who they are, what they do for you, deal economics, term, and how deeply they integrate.
Everything the vendor produced, with dates and any gaps or refusals.
Drives the tier and the diligence depth.
The regime that sets the floor for what the contract must contain.
Contract governing law plus every hosting region and sub-processor location you know of.
Watch for these throughout
SOC 2 Type II reports are point-in-time and scope-limited. Confirm the report period, which trust services criteria were in scope, and whether the exceptions were remediated. A clean cover letter can sit on top of a narrow scope.
The model will happily accept the vendor's own questionnaire answers as evidence. Self-attestation is not an artifact; treat unanswered controls as gaps.
Do not paste vendor confidential material (SOC 2 reports and financial statements are usually under NDA) unless your AI policy and that NDA permit it.
Cross-border transfer mechanisms and the assessments behind them change with case law and regulator guidance. Verify the current requirement before relying on any transfer conclusion here.
Insurance limits sized to a generic benchmark rather than your record count will look inadequate the day you need them. Confirm the per-record figure with your broker.