You've read the vendor's SOC 2 report. You've ticked the ISO 27001 certificate. The demo went well and the sales engineer had an answer for every question on your list.
Now you're about to sign, and something still feels off.
That gap is the whole point of AI vendor due diligence, and it's why a rehearsed questionnaire keeps failing UAE businesses. The questions that reveal how a vendor handles your customer data, your Arabic inputs, and your PDPL obligations are the ones no vendor has a pre-written answer to.
Key Takeaways
- Vendor questionnaires get rehearsed, not honest answers — Live, unscripted questions about data flows expose more than certifications do. Ask for the actual artefact behind an ethical claim: the data-source register, the oversight log, the bias-testing record, not a marketing PDF.
- UAE compliance adds layers no Western checklist covers — PDPL (Federal Decree-Law No. 45 of 2021) governs data residency and cross-border transfer, DIFC and ADGM add their own regimes, and Cabinet Resolutions 56 and 57 of 2024 add Do Not Call fines up to AED 150,000 for outreach tools.
- 97% of AI breaches lacked basic access controls — IBM's 2025 Cost of a Data Breach Report also found 63% of those organisations had no AI governance policy at all, and high shadow AI exposure added an average $670,000 to breach costs.
- Vendor review has to continue after signing — Assign an internal owner with authority to pause the tool before you sign, define re-review triggers such as model updates or security incidents, and run annual checks tied to contract renewal dates.
- A written governance policy keeps oversight alive — Embedding vendor review in a formal policy survives staff turnover; a spreadsheet in one person's inbox does not. IBM found 63% of breached organisations had no such policy.
Why Standard AI Vendor Due Diligence Forms Only Surface Rehearsed Answers
Because every AI vendor of scale maintains a library of pre-approved answers to ISO 27001 and SOC 2 questionnaires. Your form gets filled in by someone whose job is to make forms go away, not to describe real practice. That's the failure mode of due diligence run as a checklist exercise.
IBM's 2025 Cost of a Data Breach Report found that 97% of organisations that suffered an AI-related security incident lacked basic AI access controls, and 63% had no AI governance policy at all. Those companies passed vendor reviews. Their forms were correct and their protection was fictional.
In 2026, most AI demos look good, and that's the trap. You do it precisely to close the gap between the polished demo and production reality, and you do it through questions the vendor has never rehearsed.
A vendor's website will always claim ethical AI, transparent training data, and human oversight. The distinguishing question is whether they can show you the artefact behind each ethical claim: the actual data-source register, the oversight log, the bias-testing record. A marketing PDF is not evidence.
The UAE Compliance Layer Every AI Vendor Must Answer To
Photo: qmicertification design on Pexels
Any AI vendor handling UAE data must satisfy the PDPL (Federal Decree-Law No. 45 of 2021, in force since 2 January 2022), overseen by the UAE Data Office established under Federal Decree-Law No. 44 of 2021.
DIFC and ADGM businesses face layered free-zone regimes on top of that.
A generic global compliance certificate does not cover this. Ask exactly where your data is stored: not the region, the actual data centre. If UAE data leaves the country, ask which mechanism, which sub-processor, and how they meet PDPL cross-border transfer conditions in writing.
Ask for their breach notification timeline in hours, not "as required by law". That answer protects nobody on your side of the contract.
If the tool touches customer outreach or lead generation, Cabinet Resolutions 56 and 57 of 2024 (effective 27 August 2024) apply on top of PDPL. Do Not Call Registry breaches carry fines of AED 50,000, AED 75,000, and AED 150,000 for first, second, and third breaches. Those fines land on you, not the vendor.
Questions like these belong inside a written AI governance policy, not a one-off form filed the week before signing. That's how organisations end up in the 63% with no AI governance policy at all.
If your compliance stack already looks messy and you need a second pair of eyes on it, book a free 30-minute consultation before signing anything else.
AI Vendor Due Diligence Questions That Expose How Your Data Is Handled
Three probes reveal more than any 80-question form: does your data enter their training pipeline, who are their sub-processors, and what happens to your data at contract end? A vendor that hedges any of these has no defensible answer waiting.
Ask directly whether UAE customer data enters the vendor's training pipeline, or improves a shared model other clients then use. Many default terms permit exactly this. The only reliable protection is a Data Processing Agreement with an explicit carve-out, negotiated before you sign.
Require the vendor to name every sub-processor who touches your data: LLM provider, vector database host, observability tool, any human review contractor. Organisations with high shadow AI exposure paid an average of $670,000 more per breach, per IBM's 2025 Cost of a Data Breach Report. Your vendor's security posture means little if the sub-processor routing your Arabic transcripts has weaker controls.
Test bilingual handling with real UAE inputs before signing: Arabic-English mixed messages, Arabizi ("shukran" written in Latin characters), and trade licences that mix both scripts on a single page. A model that mangles Arabic tokenisation cannot serve a UAE customer base reliably, and no vendor benchmark run on English corpora will tell you whether yours does.
Get a documented deletion procedure in writing covering what happens to your data at contract end: a certificate, not a promise. When the tool is used for employee or candidate screening, the deletion question extends to any model weights fine-tuned on your workforce data, because those weights carry your data forward after the raw records are gone.
These four risk areas are where a hedged answer tells you more than a confident one.
| Data Risk Area | What to Ask | Evidence That Counts |
|---|---|---|
| Training pipeline | Does UAE data enter training or improve a shared model? | DPA with an explicit carve-out, negotiated before signing |
| Sub-processors | Name every sub-processor touching your data | Full list: LLM provider, vector database host, observability tool, review contractor |
| Bilingual handling | Test Arabic-English mixes, Arabizi, and dual-script trade licences | Real UAE inputs tested before signing, not an English benchmark |
| Data at contract end | What happens to data when the contract ends? | Documented deletion certificate, not a promise |
Evaluating Model Quality Beyond the Sales Demo
Photo: Pavel Danilyuk on Pexels
For due diligence on model quality, start by scoring each vendor 1 to 5 across five areas, weighted by what matters to your business. Accuracy, precision, recall, and F1 are the minimum metrics. Ask for those on the vendor's benchmark, then retest against your actual UAE inputs before committing.
Request performance data on Arabic-language or bilingual test sets specifically. Most vendor benchmarks run on English-only corpora and tell you nothing about how the model behaves when a customer messages in Emirati dialect or switches script mid-sentence. If the vendor cannot produce a bilingual benchmark, treat the absence as an answer.
Ask how the vendor handles model drift, and demand specifics: who notifies you when the underlying model is updated, the SLA for re-testing after a change, and what evidence you'll receive that the update has not degraded your use case. Those questions separate a live monitoring practice from a monitoring page.
Clarify version control and rollback in the contract itself, not the sales deck. If an update degrades performance on your workflow, can you revert to the previous version, and in what timeframe does the vendor guarantee that option? "Best effort" is a rollback policy in name only.
There's a solid industry framing of AI vendor contract terms that covers the drafting side of these questions, worth reading alongside the technical review.
Making AI Vendor Due Diligence an Ongoing Process, Not a Signing Formality
Assign internal ownership of vendor oversight before you sign, define re-review triggers, and tie annual reviews to contract renewal dates. Doing this only at pre-signing is how vendors drift and nobody notices.
Name the internal owner before the contract goes anywhere near legal, not after an incident. That role needs authority to pause the tool, request evidence, and escalate to leadership. Without those powers, the person notionally responsible is whoever opens the incident email first.
Define the events that force a re-review: a major model update, new PDPL guidance from the UAE Data Office, a DIFC or ADGM rule amendment, a vendor security incident (disclosed or otherwise), or any change in what customer data the tool actually sees. Each triggers a documented review inside 30 days.
Set annual checkpoints tied to contract renewal dates. At each, re-run the UAE compliance questions, request updated incident logs, and re-test Arabic performance with current customer data. The point is to catch drift before renewal, not to sign a form saying nothing changed.
Embed vendor review inside a written AI governance policy so oversight does not live in one person's inbox. Governance survives staff turnover; inbox promises do not.
If you're evaluating an AI vendor now and the answers feel rehearsed, book a free 30-minute consultation. Lenoo AI listens first, then gives an honest recommendation on whether to proceed, including whether what you're being sold fits your business.
FAQ
What is AI vendor due diligence and why does it matter for a UAE business specifically?
The point of it is to investigate how an AI vendor actually handles your data, models, and compliance duties, both before signing and periodically after. For a UAE business, PDPL, the UAE Data Office, and DIFC and ADGM regimes impose duties that no generic Western questionnaire covers.
Does UAE law require companies to assess AI vendors before signing a contract?
Federal Decree-Law No. 45 of 2021 (the PDPL) makes the controller responsible for personal data processing carried out by a processor on their behalf. If your AI vendor mishandles UAE customer data, the accountability sits with your business.
Meeting that duty means running proper due diligence.
What should I ask an AI vendor about where our customer data is stored and processed?
Ask for the actual data centre location, every sub-processor that touches the data, and whether any data leaves the UAE. If it does, get the PDPL cross-border transfer mechanism written into the Data Processing Agreement. "Cloud region: Middle East" is a marketing sentence, not an answer.
How often should we review an AI vendor after the contract is signed?
At minimum, annually and tied to contract renewal. Trigger a re-review again on any material change: a model update, new PDPL guidance from the UAE Data Office, a DIFC or ADGM amendment, or a vendor security incident. Passive review calendars miss almost everything that matters.
What are our obligations if an AI vendor has a security breach involving UAE customer data?
Under PDPL, the controller (your business) must notify the UAE Data Office of any personal data breach that poses risk to individuals, and in some cases notify the individuals too. Your vendor contract needs a breach notification SLA fast enough for you to meet that duty. If the vendor's SLA is longer than your regulator deadline, the contract is not fit for UAE use.
