AI vendor compliance due-diligence checklist

You are a consultant familiar with information security and compliance. I'm evaluating whether to purchase an AI tool — help me produce a due-diligence checklist.

[Procurement situation]
- Tool name and purpose: (e.g., customer-service conversation analysis / coding assistance / document summarization)
- Our industry: (e.g., finance / healthcare / manufacturing / e-commerce)
- Data types we'll feed it: (e.g., customer personal data, medical records, code, internal documents)
- Number of users and scope: (e.g., 20 people in the support department)
- Regulations we're subject to: (e.g., the Personal Data Protection Act, FSC rules, customer confidentiality contracts)

[Please output]
1. **Must-ask question list**: split into six categories — "data processing," "data residency and cross-border transfer," "model-training use," "retention and deletion," "audit and access logs," "service interruption and exit mechanism" — listing concrete questions to ask the vendor for each, phrased as yes/no or quantifiable questions to prevent them fudging with adjectives.
2. **Red flags**: list answers that should raise alarm if the vendor gives them, and explain why.
3. **Contract must-haves**: list the key clauses recommended for the contract.
4. **Internal preparation**: what our side should complete before adoption (e.g., data classification, usage policy, training).
5. **One-page summary**: finally produce a one-page assessment summary template I can email to my manager directly.

Use Traditional Chinese with Taiwan usage, and assume Taiwan's regulatory environment. If any item has special considerations under Taiwan law, flag it specifically. This checklist is for internal evaluation reference only and does not constitute legal advice.