AI
Hiring an external AI consultant is structurally different from licensing a SaaS product: instead of one company's fixed, auditable service, you're granting a person (or small team) access to your systems and data, often using their own personal tooling. The standard vendor-vetting questions (SOC 2, DPA) still apply, but they need a consultant-specific layer covering what tools they'll actually use and what happens when the engagement ends.
Auditing a consultant engagement specifically
1. Ask explicitly which AI tools and accounts they'll use on your data. A consultant using their personal ChatGPT or Claude account (consumer tier) to process your data is a materially different risk than one using your company's provisioned enterprise-tier accounts — get this in writing before the engagement starts.
2. Add a cross-client confidentiality clause, not just a generic NDA. Explicitly prohibit reusing your data, prompts, or derived artifacts (fine-tuned models, cached embeddings) on other clients' engagements — a standard NDA doesn't always cover this specifically.
3. Define offboarding terms before the engagement starts, not after. Specify the exact deadline for access revocation and data/artifact deletion once the project ends, and require written confirmation once it's done — don't rely on the consultant remembering to clean up.
# Consultant-specific data-handling addendum (excerpt)
Tools: Consultant will use only company-provisioned AI
accounts (Claude for Work / ChatGPT Enterprise) for any
work involving company data. Personal/consumer AI accounts
may not be used to process company data under any circumstance.
Cross-client use: Consultant shall not reuse company data,
prompts, or any artifacts derived from company data
(including fine-tuned models or cached embeddings) on any
other client engagement.
Offboarding: Within 5 business days of engagement end,
Consultant shall revoke all access to company systems and
provide written confirmation of deletion of all company
data and derived artifacts from Consultant-controlled systems.| Risk Area | SaaS Vendor | External Consultant |
|---|---|---|
| Tooling | Fixed, auditable product | May vary by individual — needs explicit specification |
| Cross-customer data mixing | Covered by the vendor's own multi-tenancy architecture | Depends entirely on the individual's discipline and contract terms |
| Offboarding | Account deactivation via admin console | Requires explicit contractual deadline and confirmation |
The underlying principle is the same as vetting any vendor — verify, don't assume — but a consultant engagement needs the verification aimed at a person's actual working habits and tools, not just a company's certified product. Build the addendum into the contract before work starts; retrofitting it after data has already changed hands is much harder.
Practical Challenge
Draft a data-handling addendum like the excerpt above for a hypothetical AI consulting engagement at your organization, specifically naming approved tools and an offboarding deadline.
Concept Check
Sources & Further Reading
- DeepInspect: AI Vendor Due Diligence Checklist — the broader due-diligence framework this consultant-specific addendum builds on.
- Anthropic Privacy Center: Is my data used for model training? — reference for why specifying enterprise-tier vs. personal AI accounts matters contractually.