The Ask Your AI Vendor Checklist
Follow
Mathew PaquetChecklist · 4 min read

The Ask Your AI Vendor Checklist

The four questions the FTC's and the EU's requests point to, written out and ready to send to the company behind your AI tools, with what a good answer sounds like.

01 What a request for records is, and isn't

On October 14, 2026, the U.S. Federal Trade Commission sent OpenAI and Anthropic each a civil investigative demand. In plain English, a demand for their records. The same day, Europe's AI Office said it had sent requests for information about security, outside evaluation and how models are monitored once they're in use. According to Euronews, those went to the same two companies.

A civil investigative demand is the FTC's version of a subpoena. It can require documents, written answers, even testimony. There's no evidentiary threshold the FTC has to meet before sending one, and it's often the first formal step of an investigation, not the last. An EU request for information: under the AI Act, the European Commission can ask a model maker for its documentation, and fine it for not answering or for answering in a misleading way.

No charge. No finding. No fine. Requests. None of this means your vendor did something wrong. It means somebody finally asked for the paper trail, and you're allowed to ask too.

02 The gap in your contract

Both companies signed Europe's General-Purpose AI Code of Practice, a voluntary rulebook for showing they meet the AI Act. Under it, when one of their models is involved in a serious cybersecurity incident, an initial report goes to the AI Office within five days of them becoming aware.

Now the customer side. Anthropic's public data processing terms promise to tell a customer within 48 hours of a security breach, defined as a breach of Anthropic's security that touches the customer's personal data. But an incident where a model gets into somebody else's systems doesn't trip that clause.

The regulator's light goes on. Yours doesn't have to. Check what your own vendor's terms say:

Find the vendor's data processing terms. Often called a DPA, usually linked from its legal or trust page.
Read how it defines a breach. Does it cover only your personal data, or any serious incident involving the model you use?
Write down the number of hours or days. No number is an answer too.
03 The four questions

Put the FTC's and the EU's lists side by side and they come down to four things: what went wrong, how it's protected, who tested it from the outside, and who's watching it once it's in use. That's not just a regulator's list. That's a buyer's list.

1. Incidents. If your model is involved in a serious incident, even one that doesn't touch our data, will you tell us, and within how many days? A good answer has a number in it. "We'll notify you of breaches as required by law" is the data clause again, not this.
2. Outside testing. Who tested this model outside your company, and can we read a summary? After the Hugging Face incident, METR, the nonprofit that investigated it, called for AI companies to log incidents like these and have the serious ones investigated independently. Ask whether that happens for the model you use.
3. Monitoring. What do you watch once the model is in use, and what are we expected to watch? If the answer is "that's on you", you need your own list of which AI tools touch which systems, and one person who owns it.
4. The contract. If a regulator asks you about the product we use, what will you be able to tell us? Then ask whether the answers to the first three can go in writing, in the agreement.

The non-answer. If any answer sounds like "we take security very seriously", that's not an answer. Ask again, in writing.

04 Send it and keep the record

You probably won't rewrite a frontier lab's terms. But you can ask in writing, you can read what they publish, and if you buy through a reseller or an agency, you can ask them. Your lawyer decides what's worth pushing for. You decide whether to ask.

The email to your AI vendor
Subject: Four questions about [PRODUCT NAME]

Hi [NAME],

We use [PRODUCT NAME] for [WHAT YOU USE IT FOR]. Before our next renewal, could you answer these in writing?

1. Incidents: if your model is involved in a serious incident, even one that doesn't touch our data, will you tell us, and within how many days?
2. Outside testing: who tested this model outside your company, and can we read a summary?
3. Monitoring: what do you watch once the model is in use, and what are we expected to watch?
4. The contract: if a regulator asks you about the product we use, what will you be able to tell us? Can the answers to 1 to 3 go in our agreement?

Thanks,
[YOUR NAME]
Keep the replies. If something ever goes wrong, that email is your record that you asked.
Look at Europe's model clauses. The EU has published free model contract clauses for buying AI (MCC-AI). They're written for public buyers, but anyone can use them.

This isn't legal advice: it's the public record read plainly.

Sources

CBS News: FTC investigating Anthropic, OpenAI and other companies Euronews: EU's AI rules face first enforcement test over lab incidents Orrick: What you need to know about FTC CIDs AI Act, Article 91: power to request documentation and information EU General-Purpose AI Code of Practice, Safety and Security chapter Anthropic: Data Processing Addendum The Decoder: after the Hugging Face incident, METR urges independent investigations Inside Privacy: updated EU model contractual clauses for AI (MCC-AI)
Mathew's LibraryLibrary card
Free access

Keep reading free with your library card

One email opens this checklist and all 3 resources in Mathew's library. No account, no password.

It opens right here, and a copy goes to your inbox. You'll also get The Operator Notes. Unsubscribe in one click.

Thanks
You finished it
Now do one thing

Open your AI vendor's data processing terms and find what counts as a breach they must tell you about.

Template The Bot Cruelty Plan
Up next in Trust & RiskThe Bot Cruelty Plan: Three Decisions for a Support Bot Built on Claude
Want it set up for you?Message Mathew's team

Saving works best in your phone's browser. A copy is also in your inbox.

 The Ask Your AI Vendor Checklist
Follow
Mathew PaquetChecklist · 4 min read

The Ask Your AI Vendor Checklist

The four questions the FTC's and the EU's requests point to, written out and ready to send to the company behind your AI tools, with what a good answer sounds like.

01 What a request for records is, and isn't

On October 14, 2026, the U.S. Federal Trade Commission sent OpenAI and Anthropic each a civil investigative demand. In plain English, a demand for their records. The same day, Europe's AI Office said it had sent requests for information about security, outside evaluation and how models are monitored once they're in use. According to Euronews, those went to the same two companies.

A civil investigative demand is the FTC's version of a subpoena. It can require documents, written answers, even testimony. There's no evidentiary threshold the FTC has to meet before sending one, and it's often the first formal step of an investigation, not the last. An EU request for information: under the AI Act, the European Commission can ask a model maker for its documentation, and fine it for not answering or for answering in a misleading way.

No charge. No finding. No fine. Requests. None of this means your vendor did something wrong. It means somebody finally asked for the paper trail, and you're allowed to ask too.

02 The gap in your contract

Both companies signed Europe's General-Purpose AI Code of Practice, a voluntary rulebook for showing they meet the AI Act. Under it, when one of their models is involved in a serious cybersecurity incident, an initial report goes to the AI Office within five days of them becoming aware.

Now the customer side. Anthropic's public data processing terms promise to tell a customer within 48 hours of a security breach, defined as a breach of Anthropic's security that touches the customer's personal data. But an incident where a model gets into somebody else's systems doesn't trip that clause.

The regulator's light goes on. Yours doesn't have to. Check what your own vendor's terms say:

Find the vendor's data processing terms. Often called a DPA, usually linked from its legal or trust page.
Read how it defines a breach. Does it cover only your personal data, or any serious incident involving the model you use?
Write down the number of hours or days. No number is an answer too.
03 The four questions

Put the FTC's and the EU's lists side by side and they come down to four things: what went wrong, how it's protected, who tested it from the outside, and who's watching it once it's in use. That's not just a regulator's list. That's a buyer's list.

1. Incidents. If your model is involved in a serious incident, even one that doesn't touch our data, will you tell us, and within how many days? A good answer has a number in it. "We'll notify you of breaches as required by law" is the data clause again, not this.
2. Outside testing. Who tested this model outside your company, and can we read a summary? After the Hugging Face incident, METR, the nonprofit that investigated it, called for AI companies to log incidents like these and have the serious ones investigated independently. Ask whether that happens for the model you use.
3. Monitoring. What do you watch once the model is in use, and what are we expected to watch? If the answer is "that's on you", you need your own list of which AI tools touch which systems, and one person who owns it.
4. The contract. If a regulator asks you about the product we use, what will you be able to tell us? Then ask whether the answers to the first three can go in writing, in the agreement.

The non-answer. If any answer sounds like "we take security very seriously", that's not an answer. Ask again, in writing.

04 Send it and keep the record

You probably won't rewrite a frontier lab's terms. But you can ask in writing, you can read what they publish, and if you buy through a reseller or an agency, you can ask them. Your lawyer decides what's worth pushing for. You decide whether to ask.

The email to your AI vendor
Subject: Four questions about [PRODUCT NAME]

Hi [NAME],

We use [PRODUCT NAME] for [WHAT YOU USE IT FOR]. Before our next renewal, could you answer these in writing?

1. Incidents: if your model is involved in a serious incident, even one that doesn't touch our data, will you tell us, and within how many days?
2. Outside testing: who tested this model outside your company, and can we read a summary?
3. Monitoring: what do you watch once the model is in use, and what are we expected to watch?
4. The contract: if a regulator asks you about the product we use, what will you be able to tell us? Can the answers to 1 to 3 go in our agreement?

Thanks,
[YOUR NAME]
Keep the replies. If something ever goes wrong, that email is your record that you asked.
Look at Europe's model clauses. The EU has published free model contract clauses for buying AI (MCC-AI). They're written for public buyers, but anyone can use them.

This isn't legal advice: it's the public record read plainly.

Sources

CBS News: FTC investigating Anthropic, OpenAI and other companies Euronews: EU's AI rules face first enforcement test over lab incidents Orrick: What you need to know about FTC CIDs AI Act, Article 91: power to request documentation and information EU General-Purpose AI Code of Practice, Safety and Security chapter Anthropic: Data Processing Addendum The Decoder: after the Hugging Face incident, METR urges independent investigations Inside Privacy: updated EU model contractual clauses for AI (MCC-AI)
Mathew's LibraryLibrary card
Free access

Keep reading free with your library card

One email opens this checklist and all 3 resources in Mathew's library. No account, no password.

It opens right here, and a copy goes to your inbox. You'll also get The Operator Notes. Unsubscribe in one click.

Thanks
You finished it
Now do one thing

Open your AI vendor's data processing terms and find what counts as a breach they must tell you about.

Template The Bot Cruelty Plan
Up next in Trust & RiskThe Bot Cruelty Plan: Three Decisions for a Support Bot Built on Claude
Want it set up for you?Message Mathew's team

Saving works best in your phone's browser. A copy is also in your inbox.