You get an AI vendor risk assessment by inventorying every AI tool your team actually uses, scoring each one against data handling, model training, and compliance criteria, then documenting the findings before you sign a contract or renew one. Done properly, it takes two to four weeks for a mid-sized SaaS company with a moderate AI footprint, longer if procurement has been informal and nobody has a full list of what is actually in use.
That last part is the real problem. Most Canadian tech companies do not have an AI vendor risk problem because they lack a process. They have one because a developer added an AI code assistant on a Tuesday, marketing signed up for an AI writing tool on a Friday, and neither purchase ever touched security review. By the time a customer's due diligence team or a SOC 2 auditor asks "which AI tools have access to your data," the honest answer is often "we are not entirely sure." This guide walks through the assessment process that fixes that, step by step, with the timelines you should actually expect.
Step 1: Build a Complete AI Tool Inventory (Week 1)
You cannot assess what you have not found. Start with a discovery pass across three sources:
- Finance and procurement records: expense reports and SaaS subscription tools will surface anything paid for with a corporate card.
- SSO and identity provider logs: any AI tool your team logs into with Google or Microsoft SSO shows up here, including free-tier tools nobody expensed.
- A short employee survey: ask directly which AI tools people use for coding, writing, customer support, or data analysis. This catches shadow IT the other two methods miss, especially browser extensions and personal-account usage.
Expect this step to surface more tools than you expect. It is common for a 40-person company to find 15 to 25 distinct AI tools in active use once you look past the obvious ones like ChatGPT or GitHub Copilot.
Step 2: Classify Vendors by Data Exposure and Business Criticality
Not every AI tool deserves the same scrutiny. A grammar checker with no access to customer data is a different risk category than an AI tool that ingests your codebase or customer support tickets to generate responses. Sort your inventory into tiers:
- Tier 1, high risk: tools with access to customer PII, source code, financial data, or protected health information.
- Tier 2, moderate risk: tools with access to internal but non-sensitive business data.
- Tier 3, low risk: tools with no meaningful data access, used for isolated tasks.
Tier 1 vendors get the full assessment described below. Tier 2 gets a lighter version. Tier 3 gets a one-time check and periodic re-review. This triage is what keeps the process from taking six months on a company with dozens of tools.
Step 3: Request and Review the Vendor's Security and AI Governance Documentation (Weeks 1 to 2)
For each Tier 1 vendor, request:
- Their SOC 2 Type II report or equivalent, and its exceptions
- A written data processing agreement or AI addendum
- Their model training policy, specifically whether your inputs are used to train their underlying models
- Sub-processor list, since most AI vendors are themselves built on top of another provider's foundation model
- Data residency and retention terms
This is the step where response time becomes your bottleneck rather than your own effort. Enterprise AI vendors with a mature trust program can turn documents around in days. Smaller or newer AI startups, which describes a large share of the tools your team is probably experimenting with, sometimes do not have this documentation written down at all. Build in a buffer for follow-up and, in some cases, a decision to not use a vendor because they cannot answer the model training question.
Step 4: Score Against a Consistent Risk Framework
Use the same scoring criteria across every vendor so the results are comparable and defensible to an auditor or a customer's security team later. A workable framework scores each vendor on:
- Data handling practices and encryption in transit and at rest
- Whether customer data trains the vendor's models by default, and whether opt-out is available
- Sub-processor transparency and their own security posture
- Compliance certifications held (SOC 2, ISO 27001, ISO 42001)
- Incident history and breach notification terms in the contract
- Data residency, which matters directly for PIPEDA and, for any vendor touching Quebec residents' data, Quebec's Law 25
The output should be a simple risk rating per vendor, not a fifty-page report nobody reads. If your company is working toward SOC 2 or aligning with an emerging framework like CPCSC, this scoring becomes part of your vendor management control and needs to be repeatable on a schedule, not a one-time exercise.
Step 5: Decide, Document, and Set Contract Terms
For each vendor, the assessment ends in one of three outcomes: approve, approve with conditions, or reject. "Approve with conditions" is common, for example requiring the vendor's enterprise plan (which usually disables model training on your data) rather than their free or team tier. Document the decision and the reasoning. This record is exactly what a SOC 2 auditor or an enterprise customer's procurement team will ask to see, and having it ready is far better than reconstructing it under deadline pressure during due diligence.
Step 6: Set a Re-Assessment Cadence
AI vendors change their terms, their sub-processors, and their model training defaults more often than traditional SaaS vendors do. A tool that did not train on your data last year may quietly change that default in a terms update. Tier 1 vendors should be re-reviewed at least annually, and any vendor with a material change to its terms or a public incident should trigger an immediate re-check rather than waiting for the annual cycle.
Realistic Timelines
For a company with 15 to 25 AI tools in scope, expect roughly:
- Discovery and tiering: 1 week
- Documentation collection for Tier 1 vendors: 1 to 3 weeks, dependent on vendor response time
- Scoring and decisions: 3 to 5 days
- Total for a first pass: 3 to 5 weeks
Subsequent annual re-assessments run faster, typically 1 to 2 weeks, since the inventory and documentation baseline already exists.
Where a Partner Helps
The mechanics above are not complicated, but they are time-consuming and easy to deprioritize once week two hits and half the vendors have not replied yet. That is usually where the process stalls inside companies without a dedicated security function, which describes most Canadian tech companies under 200 people. traztech runs AI vendor risk assessments as a fixed-scope engagement: we do the discovery, chase down vendor documentation, apply a consistent scoring framework, and hand you a decision record you can put in front of an auditor or a customer's security questionnaire. We work with companies in Toronto, Waterloo, Ottawa, Vancouver, Calgary, and Montreal, and the assessment accounts for PIPEDA and, where relevant, Quebec's Law 25 from the start rather than as an afterthought.
If your company is scaling into the US and expects SOC 2 due diligence to ask about AI tool usage, this is worth doing before that conversation happens, not during it. It also pairs naturally with broader compliance program work if AI governance is one gap among several.
Get in touch with traztech at /contact to scope an AI vendor risk assessment for your tool inventory.