← All domains
Domain 07 · Domains 5–7
Procurement, Vendors & Legal
Vendor risk, contracts, licensing, regulatory compliance, and rapid pilots for acquired AI.
Key AI risks
▹Hidden training-data and data-use terms in vendor contracts
▹Weak vendor security and unclear liability
▹Non-compliance with CCPA/CPRA and emerging state AI law
▹Lock-in and opaque model updates over the contract life
Governed through the RMF Playbook
Each function pairs the outcome to reach for this domain (the Playbook's About) with the Playbook's suggested actions.
Govern
Set the terms on which AI enters the institution through vendors — rights, ownership, data use, and acceptable use.
Playbook · suggested actions
Adopt AI procurement, open-source-model, and IP policies.
Map
Understand each vendor product’s risk, its data practices, and the obligations it carries into the institution.
Playbook · suggested actions
Assess vendor risk and surface data-use and training-data terms.
Measure
Scrutinize vendor claims, contract protections, and the evidence high-risk products are required to supply.
Playbook · suggested actions
Enforce a contract checklist and require high-risk vendors’ own documentation.
Manage
Pilot safely, remediate vendor gaps, and manage each relationship across its full life.
Playbook · suggested actions
Pilot with human escalation and manage renewals and audits.
Worked case studies · the RMF Playbook applied
10 scenarios
Each step is a Playbook suggested action for that function; the evidence line is the transparency & documentation you keep.
Buying a public-facing admissions chatbot
Procurement · enrollment technology
Enrollment wants a vendor chatbot that answers prospective students’ admissions and financial-aid questions.
Govern
Apply the AI procurement policy and its IP and data provisions.
Map
Run a vendor risk assessment, classify the product as consequential, and surface training-data terms.
Measure
Require the vendor’s own impact assessment and bias documentation and run the contract checklist.
Manage
Approve a rapid-cycle pilot with mandatory human escalation, then set a renewal and audit cycle.
Outcome — A vendor is selected with audit rights and human escalation, mitigating the hallucination risk of public answers.
Evidence: Vendor risk assessment + signed AI contract addendum
Rapid pilot of a low-risk productivity tool
Procurement · rapid-cycle pilot
A department wants to try a low-risk AI writing tool without a full procurement cycle.
Govern
The rapid-cycle pilot pathway covers low-risk tools with defined thresholds.
Map
Confirm the tool is low-risk and touches no sensitive data.
Measure
Check the tool against baseline data-governance and security standards.
Manage
Grant a time-limited pilot approval and reassess before full adoption.
Outcome — The team pilots quickly within safe, time-limited guardrails.
Evidence: Pilot approval form + risk threshold check
An LMS vendor adds AI features mid-contract
Procurement · vendor management
The learning-management vendor pushes new generative-AI features into an existing contract.
Govern
Vendor-management policy requires review of new AI capabilities.
Map
Identify what data the new features use and their risk tier.
Measure
Assess the features against contract terms and data-use rules.
Manage
Enable, restrict, or renegotiate based on the review.
Outcome — New AI features are governed rather than silently enabled.
Evidence: Feature review + contract amendment
Negotiating training-data terms
Procurement · contract negotiation
A vendor’s default terms allow using institutional data to train its models.
Govern
Contract standards require protection of institutional data.
Map
Identify the training-data and data-use clauses at issue.
Measure
Assess the clauses against data-governance requirements.
Manage
Negotiate opt-outs, deletion, and audit rights into the contract.
Outcome — Institutional data is contractually protected from model training.
Evidence: Redlined contract + data-use addendum
Deciding to self-host an open-source model
Procurement + IT · build-vs-buy
A team weighs a hosted vendor model against self-hosting an open-source model.
Govern
The open-source model-use policy governs the choice.
Map
Compare data exposure, control, and obligations of each option.
Measure
Assess security, licensing, and total cost of each path.
Manage
Choose the option that meets data-governance needs and support both.
Outcome — The decision balances control, cost, and data protection deliberately.
Evidence: Build-vs-buy analysis + licensing review
State AI-law compliance
Legal · regulatory compliance
New state rules on automated decision-making (e.g., CCPA/CPRA ADMT) affect several tools.
Govern
Compliance standards track state and federal AI legislation.
Map
Identify which tools fall under the new requirements.
Measure
Assess each tool against the legal obligations.
Manage
Remediate gaps and update contracts and notices.
Outcome — Affected tools meet new legal requirements before enforcement.
Evidence: Compliance register + gap-remediation log
A marketing-tech vendor with generative AI
Procurement · martech
A marketing platform adds generative AI that creates public-facing content.
Govern
Procurement governs martech AI, with Domain 3 providing the content standards.
Map
Identify the public content the AI generates and its risks.
Measure
Check disclosure, accuracy, and human-review controls.
Manage
Require human review and disclosure in the contract.
Outcome — AI-generated marketing is governed for accuracy and disclosure.
Evidence: Vendor review + content-control clause
A library database with AI training clauses
Procurement + Library
An academic database license now includes AI training-data provisions.
Govern
Library and procurement standards cover AI-enabled database licensing.
Map
Identify the training-data and copyright clauses in the license.
Measure
Assess the clauses against data and copyright standards.
Manage
Negotiate protective terms with library representation.
Outcome — The database is licensed with acceptable AI and copyright terms.
Evidence: License review + negotiated terms
Vendor security and audit-rights review
Procurement · security review
A consequential AI vendor must demonstrate security and grant audit rights.
Govern
The vendor-risk standard requires security evidence and audit rights.
Map
Identify the data the vendor handles and the risk tier.
Measure
Review security attestations and require audit provisions.
Manage
Approve only with audit rights and a remediation clause.
Outcome — The vendor is contractually accountable for security over time.
Evidence: Security review + audit-rights clause
Contract termination and model deprecation
Procurement · offboarding
An AI contract ends and the institution must exit cleanly without data loss.
Govern
Contract standards require exit, deletion, and continuity terms.
Map
Identify data held by the vendor and dependencies on the model.
Measure
Verify data return or deletion and continuity of service.
Manage
Execute the exit, confirm deletion, and update the inventory.
Outcome — The institution exits with data recovered or deleted and no gap in service.
Evidence: Offboarding checklist + deletion certificate
Risk-tier examples
Operational
AI vendor-evaluation scoring tools used in procurement review.
Tools & artifacts
AI vendor risk-assessment questionnaire
AI contract-requirements checklist
Vendor impact-assessment request
Pilot approval form
Key controls & instruments
AI procurement policy
AI vendor risk assessment standard
AI contract requirements checklist
State & federal AI-legislation compliance standards