AI Consultant Vetting Checklist

This document is a checklist designed to assist organizations in vetting AI consultants before engagement. It outlines critical questions to ask regarding security documentation, certifications, and data handling practices. The checklist emphasizes the importance of obtaining full security documentation and verifying SOC 2 Type II certification to ensure that the consultant's security controls have been independently audited. It also stresses the need for cyber liability insurance and experience in high-privacy environments. Additionally, the document details inquiries about data access, retention policies, and compliance with relevant regulations such as HIPAA and FINRA. It highlights potential red flags, including refusal to share documentation and lack of certification. The checklist serves as a practical guide to ensure that organizations engage with consultants who prioritize security and compliance in their AI implementations.