AI Vendor Risk Assessment
Decide which AI vendors you will allow.
Every SaaS product now claims AI. SAINT runs vendor risk reviews that end in clear bands: APPROVED, WITH CONTROLS, ADDITIONAL REVIEW, HIGH RISK, or NOT RECOMMENDED. These are operational decisions for your environment — not legal determinations, not insurance underwriting, and not a promise a regulator will agree.
Five clear decision bands
Data residency, training use, subprocessors
Identity and SSO requirements
Ties into governance and M365/Google admin
Capabilities
What we evaluate
Data & training claims
Whether prompts/files can train vendor models, retention, and export — in plain language, not brochure copy.
Identity & access
SSO, MFA, admin roles, and whether the tool becomes a backdoor around your Entra or Cloud Identity baseline.
Decision bands
APPROVED / WITH CONTROLS / ADDITIONAL REVIEW / HIGH RISK / NOT RECOMMENDED — documented so IT and leadership share one list.
Re-review cadence
AI features change. High-risk and “with controls” vendors get a scheduled revisit, not a forever green light.
What you get when you book
- Free AI readiness conversation (15 minutes)
- Maturity picture across people, process, technology, data, security, governance
- One prioritized next step you can act on this month
- No obligation — no published pressure pricing on this page
Zero risk: free assessment, no credit card, no obligation. Match-or-beat applies to comparable written scopes when we propose paid work — see /pricing.
Schedule AI Readiness Assessment531-625-2111Questions we actually get
Is this a legal opinion?+
No. It is an operational risk recommendation for your stack. Counsel, compliance officers, and carriers make their own determinations.
How does this relate to general vendor assessments?+
General IT vendor/contract review lives at /vendor-assessments. This page is specifically for AI-capable products and features.
Put AI to work without losing control.
Schedule an AI readiness assessment — Lincoln & Omaha primary markets. Hickman-based. 531-625-2111.
15 minutes. NIST-aligned report. No obligation.