AI Vendor Assessment Checklist for South African SMEs

1. Define the use case before reviewing the vendor

A provider cannot be approved in the abstract. Document the intended users, information classes, integrations, outputs, business decisions influenced, and expected volume. The same tool may be acceptable for public-copy drafting and unacceptable for restricted records.

2. Confirm the exact service and terms

• Product name, plan, region, account type, and administrator controls.
• Contract, data-processing terms, privacy commitments, and acceptable-use terms.
• Whether inputs or outputs are used for training by default or by opt-in.
• Retention periods, deletion controls, backup treatment, and support access.
• Processing locations, subprocessors, and cross-border considerations.

3. Review security and operational control

• Identity integration, multifactor authentication, role-based access, and offboarding.
• Encryption, audit logs, incident notification, vulnerability management, and assurance reports.
• Permissions granted to connectors, plugins, agents, and external data sources.
• The ability to restrict sharing, public links, exports, and unapproved integrations.
• Service continuity, data portability, and a practical exit route.

4. Evaluate the output and human system

Security controls do not make an unreliable output correct. Define how accuracy, bias, completeness, and unsafe failure will be tested for the intended context. Identify the person who reviews the output and the evidence they need.

Pilot with controlled data, record the decision, set an expiry or review date, and reassess after material product or term changes. An approval register should show what was approved, for whom, for which data, and for which purpose.

Primary sources and further reading

• Protection of Personal Information Act 4 of 2013
• Information Regulator of South Africa
• NIST AI Risk Management Framework
• OpenAI business data privacy
• Microsoft 365 Copilot enterprise data protection