The assessment starts with the work, not a questionnaire. A writing assistant with no sensitive data needs a different review from an agent that reads contracts, calls internal APIs, or sends customer messages. Build versus buy AI is only a useful decision once the requirements are clear.
What should the review cover?
Ask where data is processed and retained, which sub-processors are involved, how access is controlled, what the model can do, and how the vendor handles changes or incidents. Review integration permissions, audit evidence, service limits, pricing mechanics, and how the company can export or remove its data. The vendor must fit the risk and operating needs of this workflow, not an imagined future program.
An AI inventory should record the approved provider, owner, use case, and review outcome. A strong contract does not prove a tool works safely in your environment.
How does testing fit into the assessment?
Run representative tasks with synthetic or sanitized inputs and known failures. Test whether the provider respects AI governance boundaries and whether an agent can be limited by agent authorization. Shadow AI becomes less likely when teams can get a timely assessment instead of a procurement delay.