Vendor Security & Compliance Posture

Purpose and Scope

VEN-04 is the canonical security and compliance validation checklist for legal AI vendor evaluation and internal governance. It operationalises requirements from SOC 2 Type II, ISO 27001, GDPR, the EU AI Act, and ABA Model Rules into concrete verification steps with explicit pass/fail criteria.

VEN-04 is a mandatory companion to:

• VEN-01 – Vendor scoring (compliance sub-score input)
• VEN-02 – RFP compliance requirements baseline
• VEN-03 – POC pass/fail gate
• DAT-03 – DPA execution and validation

Compliance gaps identified by VEN-04 generate GOV-03 Risk Register entries and feed the DPS Defensibility lens evidence bundle.

Triggers

• Vendor shortlisted via VEN-02 → complete VEN-04 before advancing to VEN-03 POC.
• Annual internal compliance review → complete VEN-04 for all active vendors.

Ecosystem hooks

• VEN-01 · VEN-02 · VEN-03 · DAT-03 · GOV-02 · GOV-03 · STR-07 · DPS.

Metric 0 — Pre-Check Gates

Before beginning compliance validation, confirm and record status for each gate:

| Gate | Requirement | Status |

|—|—|—|

| DAT-03 DPA initiated or in negotiation | Mandatory | ☐ / ☑ |

| VEN-02 RFP shortlist confirmed for this vendor | Mandatory | ☐ / ☑ |

| GOV-02 approved use category confirmed for vendor scope | Mandatory | ☐ / ☑ |

| STR-07 AI Task Force notified of vendor evaluation | Required | ☐ / ☑ |

Failure on any mandatory gate pauses VEN-04 until remediated.

Risk Taxonomy 2026 — Class Cross-Walk

Map VEN-04 coverage to the Risk Taxonomy 2026:

| Risk Taxonomy 2026 Class | VEN-04 Coverage |

|—|—|

| Class 2: Privilege and confidentiality | ABA Rule 1.6 client data protections; DPA prohibition on training use; access controls |

| Class 4: Privacy and data protection | GDPR compliance; DPIA requirements; individual rights mechanisms; cross-border transfer safeguards |

| Class 7: Regulatory compliance drift | EU AI Act risk classification and obligations; ABA Model Rules 1.1/1.4/1.5/1.6/5.1/5.3; state bar requirements |

| Class 9: Operational resilience | SOC 2 Type II availability; ISO 27001 ISMS; incident response; business continuity |

| Class 3: Bias and fairness | GOV-04 methodology required for EU AI Act Article 10 data governance; automated decision-making safeguards |

| Class 1: Hallucination and accuracy | ABA competence (Rule 1.1) output verification; hallucination/error risk in compliance scoring |

Use this cross-walk when tagging GOV-03 Risk Register entries.

Section 1 — SOC 2 Type II Compliance Validation

Mandatory Security Criteria

Current SOC 2 Type II Report

• [ ] Report dated within 12 months with unqualified opinion
• [ ] Scope covers AI services and all relevant data processing activities
• [ ] No material weaknesses or significant deficiencies
• [ ] Management response reviewed for identified control gap remediation

Security Controls Independently Audited

• [ ] Access controls: MFA, role-based access, privileged account management
• [ ] Network security: firewalls, intrusion detection, network segmentation
• [ ] Data protection: encryption at rest and in transit, secure data handling, backup
• [ ] Monitoring and logging: security event logging, log review, incident detection

Logical and Physical Access Controls

• [ ] Strong authentication: password policies, account lockout, session management
• [ ] Authorisation: role-based permissions, regular access reviews
• [ ] Change management: authorised change procedures, testing requirements, rollback

Optional but Recommended

• [ ] Availability commitments: ≥99.9% uptime SLAs with documented DR and failover
• [ ] Processing integrity: input validation, accuracy checks, error handling, audit trails
• [ ] Confidentiality safeguards: data classification, DLP, third-party controls

Section 2 — ISO 27001 Information Security Compliance

Mandatory Certification Requirements

• [ ] Valid ISO 27001 certificate from accredited certification body (not expired)
• [ ] Scope covers AI services, data processing, and customer operations
• [ ] Annual surveillance audits completed without major non-conformities
• [ ] ISMS documentation: security policy, risk assessment, Statement of Applicability, risk treatment plan

Mandatory Control Implementation

• [ ] Asset management: complete information asset inventory with ownership
• [ ] Access control: user access management, privileged access controls
• [ ] Cryptography: encryption key management, secure communications
• [ ] Operational security: change management, vulnerability management, backup management, event logging

Risk Management Framework

• [ ] Risk assessment methodology documented and current
• [ ] Risk treatment plan with timelines, responsibilities, and effectiveness monitoring
• [ ] Internal audit programme: schedule, qualified auditors, formal reports
• [ ] Management review: at least annual with performance data and improvement decisions

Incident Management

• [ ] Formal incident response plan with clear roles and escalation
• [ ] Trained incident response team
• [ ] Root cause analysis and corrective action procedures
• [ ] Lessons-learned process integrated with continuous improvement

Section 3 — GDPR Data Protection Compliance

Fundamental Compliance Principles

• [ ] Lawful basis for all data processing documented (Article 6)
• [ ] Data minimisation: purpose limitation, adequacy, retention limits
• [ ] Individual rights mechanisms: access, rectification, erasure, portability
• [ ] Consent management where consent is the lawful basis

AI-Specific GDPR Requirements

• [ ] Automated decision-making safeguards: meaningful human review, decision logic disclosure, challenge mechanisms
• [ ] Bias monitoring per EU AI Act Article 10 and GOV-04 methodology
• [ ] Processing notices: clear AI use disclosure, algorithm information, regular updates
• [ ] DPIA completed for high-risk AI processing
• [ ] Privacy by design: privacy-protective default settings, data minimisation built in

Vendor Data Processing Agreement

• [ ] DPA executed per DAT-03 checklist (mandatory gate — VEN-04 cannot proceed without DPA)
• [ ] Controller/processor roles clearly defined
• [ ] Processing instructions and purpose limitations specified
• [ ] Sub-processor controls and restrictions documented
• [ ] International transfer mechanisms confirmed (SCCs, adequacy decisions, BCRs)

Breach Notification

• [ ] Detection procedures and internal reporting documented
• [ ] 72-hour supervisory authority notification capability confirmed
• [ ] Individual notification procedures for high-risk breaches

Section 4 — EU AI Act Compliance

Risk Classification

• [ ] Prohibited practices confirmed absent
• [ ] High-risk assessment completed against Annex III categories
• [ ] Limited and minimal risk AI systems documented with transparency obligations noted

High-Risk AI System Requirements (where applicable)

• [ ] Continuous risk management system documented
• [ ] Data governance and quality standards meeting Article 10 requirements
• [ ] Technical documentation: system description, risk assessment, performance metrics, validation evidence
• [ ] Human oversight: override capabilities, monitoring tools, training requirements

Agentic Tier — Autonomous AI Supplement

For vendor solutions operating in autonomous execution mode (Agentic Tier), verify the following additional EU AI Act provisions:

| Agentic Tier EU AI Act Requirement | Verified |

|—|—|

| Kill-switch and override capability for autonomous AI decisions | ☐ / ☑ |

| Intervention logging: complete audit trail of autonomous decisions | ☐ / ☑ |

| Scope limitation controls preventing unauthorised autonomous task expansion | ☐ / ☑ |

| Escalation protocol documented: automatic human review trigger for high-risk actions | ☐ / ☑ |

| Systemic risk assessment for foundation models integrated into autonomous workflows | ☐ / ☑ |

Agentic Tier failure on any item = high-risk classification; escalate to STR-07 and generate GOV-03 entry.

Transparency Obligations

• [ ] AI system disclosure to human users confirmed
• [ ] AI-generated content clearly marked
• [ ] Conformity assessment and CE marking (if applicable) completed
• [ ] Registration in EU database for high-risk AI systems (where required)

Section 5 — ABA Professional Responsibility Compliance

Competence (Rule 1.1)

• [ ] Reasonable understanding of AI capabilities and limitations documented
• [ ] All AI outputs reviewed by qualified attorney before client delivery
• [ ] Citation and factual accuracy verification procedures in place
• [ ] Professional-grade AI tools selected (not general-purpose systems)
• [ ] Regular AI technology training completed

Confidentiality (Rule 1.6)

• [ ] DPA prohibits use of client data for model training (verified per DAT-03)
• [ ] End-to-end encryption for client data in transmission and storage
• [ ] Strict access controls: client data limited to authorised personnel only
• [ ] Input screening for client data before entry into AI systems
• [ ] Vendor audit rights for confidentiality compliance included in contract

Client Communication (Rule 1.4)

• [ ] Client engagement letters updated with AI use disclosure
• [ ] Informed consent procedures for AI use documented
• [ ] AI limitation and risk disclosure to clients in place

Supervision (Rules 5.1 & 5.3)

• [ ] Human oversight responsibility clearly assigned
• [ ] Systematic review procedures for AI-assisted work products
• [ ] Mandatory training for all staff using AI systems
• [ ] Non-lawyer AI use supervision procedures documented

Billing and Fees (Rule 1.5)

• [ ] Billing adjustments reflect AI-driven efficiency improvements