Eight checks in AI marketing tools vendor due diligence

What to take away

The most common mistake is running the demo first and reading the data terms after the pilot has gone live.
Due diligence covers four areasdata, contract, evidence and exit.
Ask for documents rather than reassurance. A supplier that cannot list its subprocessors is a risk you cannot price.
Keep one dated file per vendor so procurement and legal work from the same evidence.
Set the review date before you sign, not after the first renewal invoice.

Map the data first

Start with the fields the tool will see. Name each one, its source, where it is stored and who can read it.

Most AI marketing tools sit on top of a stack you already run, so the model is rarely the main risk. The bigger risk is the copy of your customer list that leaves your systems and never comes back.

For example, a team that pipes its whole CRM into a copywriting tool is handing over far more than the campaign it wants written.

The ICO step-by-step guide to direct marketing for your small business explains consent, lawful basis and record keeping for small teams, and the same habits apply once campaigns run automatically.

Eight checks in order

Purpose. Write one paragraph on what the tool is for, and what it must never be used for.
Data map. List every field the vendor receives, its source and its retention period.
Subprocessors. Request the current list, including model providers and hosting regions.
Security evidence. Ask for a certification or audit report and read its scope, not the badge.
Model detail. Confirm which model and version runs, and how changes get announced.
Contract terms. Cover training use, deletion on exit, notice periods and price increases.
Trial measures. Agree the numbers the pilot must hit before it starts.
Review date. Diarise when the decision gets revisited, and by whom.

The DMA toolkits and templates collection is a sensible place to look for a marketing brief and contract documents, so you are not starting from a blank page.

Put the checks in a file

One folder per vendor, with a date on every document. When renewal arrives, the file answers most questions without a fresh round of emails.

Record who approved each item and what they saw. If the subprocessor list changes in month three, you want the name of the person who accepted the original.

The wider tools and supplier guide for 2027 explains how the supplier market is structured, which helps when a subprocessor list names companies you have never heard of.

Evidence of change control

Ask how the vendor announces model updates, retraining or feature changes. The Microsoft Foundry documentation covers how deployments, evaluation and monitoring are set up on one major platform, which is the level of detail worth expecting from any supplier.

Change control evidence to request

Ask how model updates are announced
Ask how retraining and feature changes are announced
Request the last two release notes
Check messaging matches the sales call

Request the last two release notes. They show how the messaging works in practice, not just on the sales call.

Contract points to pin down

Training on your data is the clause most teams miss. Some suppliers train on customer content by default, so get the position in writing before signature.

Deletion on exit needs a defined window and a stated export format. Ask for written confirmation once it is done.

Check price change clauses as well. Look at the notice period and whether increases follow an index or sit at the supplier's discretion.

Liability caps and service credits rarely change the decision, but they are worth a look before the schedule goes to legal.

Carry the file into delivery

Selection evidence is little use if it stops at signature. The people running campaigns need the data map, the retention rules and the review date.

The AI marketing tools tool implementation in England guide covers that handover from procurement to the delivery team, which is where most of these commitments are kept or quietly dropped.

Common questions

How long should due diligence take?

Set aside several weeks, most of it waiting on documents from the supplier. The checks themselves take an afternoon once the papers are in hand.

What if the supplier will not share its subprocessors?

Treat that as an unresolved risk, not a paperwork gap. Ask again under a confidentiality agreement, and if the list still does not come, weigh it in the decision.

Do we need a lawyer for every check?

No. Legal review earns its keep on the contract schedule and any international transfer. The data map and trial measures are internal work.

When should the checks be repeated?

Before each renewal, and straight after any change of subprocessor, owner or model provider. A dated file makes the second pass quick.