Public-health leadership is contracting an AI vendor that will process clinic-related content. Which supply-chain due diligence step is most appropriate?

Public-health leadership contracting an AI vendor that will process clinic-related content should verify the vendor’s model-hosting subprocessors and data-handling path before contract signature. Reviewing the vendor’s SOC 2 Type II report and data-retention schedule after deployment completion fails because post-deployment review comes too late to prevent hidden exposure and cannot enforce residency and retention commitments before clinic content flows. Mapping hosting locations, subprocessors, retention, and cross-border flows before signing prevents hidden exposure and supports lawful, policy-aligned use.

Reviewing SOC 2 and retention documentation only after deployment completion fails conceptually because late attestation does not reveal where models or logs actually reside before clinic content is processed. Validating the vendor’s API uptime guarantees and support escalation matrix before contract signature fails because availability and support metrics do not reveal hosting locations, subprocessors, or data-handling paths for clinic-related content. Auditing the vendor’s upstream training-data suppliers and consent records after model procurement fails because post-procurement review of training inputs does not verify where clinic content will be hosted or how it will flow and comes too late to set pre-signature controls. Operational check: require a current subprocessor inventory and data-flow diagram before signature, prohibit undocumented subprocessors for clinic-related content, and calendar a periodic re-attestation tied to contract renewals.