Exam AAISM Topic 1 Question 67 Discussion

The priority control in AI vendor due diligence is ensuring explicit disclosure of data handling: data flows, purpose limitation, retention/deletion, training vs. inference use, isolation controls, access paths, subcontractors, and storage/transfer boundaries. This disclosure is then tied to contractual commitments and measurable controls. A public policy (Option A) may be incomplete; a pre-procurement external audit (Option C) can be valuable but is not always feasible or targeted to your data use; legal discussions (Option D) are necessary for terms but must be grounded in clear, detailed data-use disclosures to be effective.
References:
AAISM Body of Knowledge: Third-Party AI Risk Management; Data Governance and Usage Controls; Contractual and Technical Safeguards for Vendor AI.
AAISM Study Guide: AI Procurement Due Diligence; Data-Use Transparency (Training vs. Fine-tuning vs.
Inference); Retention, Purpose Limitation, and Cross-Border Controls.