Legal AI Vendor Compliance Checklist

Last updated: October 2026 · For US law firms evaluating AI tools that handle protected health information

What this is A pre-contract checklist for US law firms evaluating AI tools that will touch protected health information. Every item below is something you should be able to confirm — in writing — before signing. The checklist is organised into three tiers: Critical items that should end the conversation if unmet, Important items that need justification if unmet, and Good practice items that strengthen your compliance posture. It is a companion to our full guide to HIPAA and SOC 2 compliance for legal AI tools.

How to use it

Print it or keep it open during vendor conversations.
Send the relevant sections to the vendor and ask for written answers — not verbal assurances.
Any Critical item that fails means do not sign. There is no workaround for a missing BAA.

Vendor name: _______________________________________

Product: _______________________________________

Review date: _______________________________________

Reviewer (name / role): _______________________________________

Business Associate Agreement

Critical

	Item to confirm
	The vendor will sign a BAA covering all PHI the tool will touch No BAA means the tool cannot legally process medical records. There is no technical workaround.
	The BAA specifies permitted uses and disclosures for PHI Broad language like "for service improvement" needs to be read carefully and narrowed where possible.
	The BAA contains a subcontractor flow-down clause This is the clause that protects you when the vendor uses third-party model providers. Without it, you have a compliance gap you cannot see.
	The BAA specifies a breach notification timeframe in numbers "Without unreasonable delay" is not a number. You need a defined period — commonly 24 to 72 hours for discovery notification.
	The BAA addresses return or destruction of data at termination "We retain it for our records" is not acceptable for PHI. Get the deletion obligation and timeframe in writing.
	The BAA supports your access and amendment obligations Your client has the right to access and correct their records. The vendor must support you in meeting that obligation.

Subprocessors

Critical

Almost every AI tool is built on a third-party foundation model. Every provider in the chain that touches PHI must be covered by a BAA — not just the vendor you are buying from.

	Item to confirm
	The vendor has provided a complete written list of subprocessors that may touch PHI Ask for names, not categories. "Various cloud providers" is not a list.
	The vendor confirms BAAs are in place with each subprocessor A signed statement from the vendor is sufficient here — you are not entitled to see their subprocessor contracts, but you are entitled to confirmation.
	The vendor will notify you before adding a new subprocessor A new subprocessor changes your compliance posture. You should get advance notice and the chance to object.
	The vendor can explain what data each subprocessor receives Some subprocessors receive full documents; others receive only embeddings or summaries. The scope matters.

SOC 2 Type II

Important

SOC 2 is an AICPA audit standard, not a HIPAA certification. It is one input among several, not a substitute for the BAA items above.

	Item to confirm
	The vendor has provided a current SOC 2 Type II report Type II covers effectiveness over time. Type I only covers design at a single point — ask for Type II.
	The audit period ended within the last 12 months A stale report does not reflect current operations. Controls change; the report should be recent.
	The report covers confidentiality and privacy criteria, not only security SOC 2 has five trust services criteria. Many reports cover only security. For PHI you want confidentiality and privacy included.
	You have read the exceptions section of the report This is where the auditor lists control failures. A report with unremediated exceptions is a problem.
	The report's scope covers the specific product you are buying A SOC 2 report can cover only part of a vendor's platform. Confirm the product you are evaluating is in scope.

Model training and data use

Critical

	Item to confirm
	Written confirmation that the vendor does not train models on your uploaded data Confidentiality obligations apply independently of HIPAA. A vendor using client data for product development is a problem regardless of BAA status.
	Confirmation that "no training" is the default, not an opt-out you must activate An opt-out you have to remember to flip is a weaker guarantee than a default of no training.
	Confirmation that the model provider does not train on data sent through the tool This is a separate question from the vendor's own training practices. Ask both.
	Clarity on whether de-identified or aggregated data is used for any purpose "De-identified" is a defined HIPAA concept with specific requirements. Ask what method is used.

Data retention and deletion

Important

	Item to confirm
	Data storage location is documented Which jurisdiction, and does that create any cross-border transfer issue for your firm or clients?
	Retention period is documented and configurable where possible Do not accept "as long as needed." You need a defined retention schedule.
	Export on termination is confirmed, with a documented format You need to be able to retrieve your matter data if you leave. CSV is fine; proprietary formats are a lock-in risk.
	Deletion on termination includes backups, with a defined timeframe Many vendors delete from the primary store but retain backups for months. Ask explicitly.
	Internal access controls are documented Who inside the vendor can access your data, and under what controls? Support staff and engineers debugging issues are the common gap.

Professional responsibility

Good practice

	Item to confirm
	Your firm has documented how its use of the tool aligns with ABA Formal Opinion 512 The opinion covers competence, confidentiality, communication, and fees. A short internal memo is sufficient.
	Your state bar's AI guidance has been checked National guidance is a floor. Several state bars have more specific positions, and this area is moving quickly.
	An internal policy exists for what may be uploaded and by whom A technically compliant tool can still be misused. A written policy on what staff may upload is the operational control that prevents this.
	Client communication approach is decided Opinion 512 includes a communication duty. Decide whether and how you tell clients about AI use that affects their case.
	A vendor review date has been entered in your vendor register Re-check compliance annually and whenever the vendor notifies you of a material change.

🚩 Red flags that should end the conversation

The vendor says a BAA is "only available on the enterprise plan"
The vendor's BAA is a single page with no subcontractor clause
The vendor cannot name its subprocessors or says "we'll send that later"
The vendor says data is "de-identified at ingestion" but cannot explain the de-identification method
The vendor cannot confirm in writing whether models train on your data
The vendor's most recent SOC 2 report is more than 18 months old
The vendor cannot explain what happens to your data on termination
Any answer to a Critical item is "we'd have to check with legal" and never follows up in writing

How to score the result

All Critical items must pass before signing. There is no compensating control for a missing BAA or a BAA without a subcontractor clause.

Important items that fail need a documented reason and a mitigation plan. A missing SOC 2 report, for example, might be acceptable for a small vendor with compensating contractual controls — but that decision should be written down, not assumed.

Good practice items that fail are a signal that your firm's internal governance needs work before adopting the tool. A tool is only as compliant as the firm using it.

Full guide: For the reasoning behind each item, including the subprocessor chain, SOC 2 report structure, and ABA Formal Opinion 512 duties, read HIPAA and SOC 2 compliance for legal AI tools.

Disclaimer: This checklist is general information for US law firms evaluating AI vendors as of October 2026. It is not legal advice or a compliance certification. HIPAA regulations, ABA guidance, and state bar rules change, and their application depends on the specific facts of your practice. Firms should consult their own compliance counsel before adopting tools that process protected health information. Corrections and suggestions: techdedon@gmail.com.