How do I turn the nine vendor questions into something I can actually send, and what should I do with the answers?

The nine questions an advisory firm should send an AI vendor before signing cover the breach-notification clock, where client data is processed, subprocessors and model providers, training, retention and deletion, audit-trail export, Rule 204-2 recordkeeping, and liability. This page assembles them into a letter addressed to a named vendor from a named firm, with the rule reference beside each question and a note on what a usable answer looks like, ready to copy into email or print. The letter is built in your browser; nothing is stored or sent.

Vendor diligence letter

Key facts

Regulation S-P requires an SEC-registered adviser's policies to provide for oversight of service providers "including through due diligence and monitoring" (17 CFR 248.30(a)(5)(i)); a written question and a filed answer are the plainest evidence of both.
The 72-hour service-provider notification standard and the firm's 30-day client-notice deadline both come from 17 CFR 248.30; the vendor's clock runs to the firm, and the firm's clock runs to affected individuals.
Rule 204-2(a)(25)(v) makes written documentation of any agreement entered into under Regulation S-P's service-provider provision a required record.
Of nineteen AI vendors reviewed in August 2026, eight of the ten that publish a breach deadline put it somewhere other than the privacy policy, which is why question one asks for the document and section.

Address the letter

Both fields are optional. Leave them blank for a generic letter. The text updates as you type and is built entirely in your browser.

The letter

What to do with the answers

File the reply with the vendor contract. Under Rule 204-2(a)(25)(v) an agreement made under Regulation S-P's service-provider provision is a required record; the answer to question one is the clause you will rely on.
Record the date each answer was obtained in the firm's vendor inventory. Regulation S-P calls for monitoring as well as diligence, so set a date to ask again, at renewal or annually.
Where a question came back without a document reference, ask again for the clause. A vendor that cannot name where a promise is written has not made one the firm can point to.
Where the answer changes what the firm wants in the contract, negotiate it before signing rather than after an incident.

Questions

Why send the questions in writing?

Because the reply becomes a record. Under Rule 204-2(a)(25)(v), written documentation of any agreement made under Regulation S-P's service-provider provision is a required record for an SEC-registered adviser, and a written answer filed with the contract is the evidence that diligence happened.

What if the vendor answers only some of the questions?

The pattern of the response is information. Which questions get a clause reference, which get marketing copy, and which get a promise to follow up tells the firm how much the vendor has thought about an adviser's obligations. Ask again for the ones that came back without a document reference.

Does this page store the vendor or firm names I type?

No. The names are used only in your browser to assemble the letter text. Nothing is transmitted, saved, or measured.

Does a state-registered adviser need the same questions?

Mostly. The 72-hour figure has no hook in the FTC Safeguards Rule, which requires oversight of service providers by contract but sets no deadline, so for a state-registered firm question one is a contract preference rather than a regulatory alignment. The other eight apply as written.

Primary sources

General information from ValaisOS LLC, not legal, compliance, tax, or investment advice. Confirm requirements for your firm with counsel. See Terms of Use.