Pathway: AI for data protection and privacy officers Module 3 of 5
Assessing an AI tool or vendor before it is approved
A practical way to review an AI tool, from impact assessment to contract questions and to reach a clear decision: approve, approve with conditions or refuse.
Last reviewed: . Reviewer: Muhammad Asadullah.
Why this matters
The moment of approval is the cheapest moment to fix a privacy problem. After a tool has spread through an office, staff depend on it and changing course is slow and awkward. A short, structured review before approval protects citizens and protects you.
Start with an impact assessment
An impact assessment asks, before a tool is used: what is it for, whose data does it touch, what could go wrong and who would be hurt? Keep it proportionate. A tool that drafts public notices from published material needs a light review. A tool that reads citizens' case files needs a thorough one. The more sensitive the data and the more it affects people's lives, the deeper you go. The National AI Policy 2025 points in the same direction, with impact assessments and audits for high-impact systems.
Questions to put to the provider
Our guide to questions to ask an AI vendor has the full list. For personal data, these matter most:
- Where is data stored and processed, and by which companies?
- Is what we type or upload used to train or improve models? Can that be switched off in writing and by default?
- Who at the provider can see our data and under what conditions?
- How long is data kept and can we have it deleted, including backups and logs?
- Can we export our data and leave without losing it? (See vendor lock-in.)
- What security measures protect the data and how will we be told if something goes wrong?
- Which other companies process our data on the provider's behalf?
Check the answers against the promise
A sales page is not a contract. Ask for the promises in writing and make sure they appear in the terms or the agreement your department signs. Make the agreement part of the procurement file. If a provider will not put a promise in writing, treat it as not made.
Try before you approve
If the tool will be piloted, set the boundary first: which data may be used, which may not, for how long and who reviews the results. Our guide to piloting an AI tool explains how to do this safely. Use invented or published data for early tests.
Three possible decisions
| Decision | When it fits | What follows |
|---|---|---|
| Approve | Low sensitivity, clear written answers | Add to the list of approved tools |
| Approve with conditions | Useful, with manageable risks | Write the conditions down: which data, which staff, which settings |
| Refuse | Unclear answers, no written promises or data too sensitive | Say why, and suggest an alternative if there is one |
Record the decision, the date, the person who made it and the reasons. That record is part of your audit trail.
Try it
Take a tool someone has asked you to approve, or invent one. Write its impact assessment in five lines: purpose, data, risks, safeguards and your decision. Then list the three questions you could not yet answer.
Check yourself
- Why is the moment before approval the best time to fix privacy problems?
- What should you do if a provider will not put a promise in writing?
- What three things should a decision record show?
Answers: (1) Changing course is far harder once staff depend on the tool. (2) Treat the promise as not made. (3) The decision and its conditions; who made it and when; the reasons for it.