This module shows you how to tell the difference between a vendor’s security claims and real evidence. You will learn what SOC 2 reports, ISO 27001 and ISO 42001 certificates, penetration test summaries and security self-assessments each prove, and what they leave out. You will practise finding this evidence in a vendor’s trust center and in a public security registry, and sorting it into documents you can read, documents you must request, and badges with nothing behind them. You will also learn how to read the parts of a SOC 2 report that matter most, including scope, audit period, exceptions and carved-out providers. You will finish with an evidence checklist for one AI vendor, with every gap flagged.

This module shows you how to find out what an AI vendor actually does with your data by reading its own terms. You will learn why the same AI tool can follow different data rules on free, personal paid and business plans. You will also learn the six questions that cover most data risks: training use, retention, residency, sub-processor access, deletion and human review. You will practise searching privacy terms for the answers and recognising vague wording. You will also learn which parts of a data processing agreement matter most for AI vendors. You will finish with a red-flag table for one AI tool, built from quotes taken directly from the vendor’s terms.

This module shows you how to look past an AI vendor to the model its product runs on. You will learn why that model can change in ways the vendor doesn’t control, and what model cards and system cards typically include and leave out. You will practise reading a public model page to find the licence, check whether access is gated, and spot non-commercial terms. You will also learn the main families of model licences and how their restrictions can reach a buyer. You will finish with a one-page fact sheet that compares an API model and an open-weight model for a use you choose.

This module shows you how to find and close the gaps that standard software contracts leave around AI. You will learn why ordinary agreements say little about model changes, training use or output liability. You will also learn eight clauses that address these gaps, from a no-training commitment to exit assistance. You will practise using an AI assistant to check a vendor’s AI terms against those clauses, and verifying its findings against the source. You will also learn how to set an opening position, a fallback and a walk-away point for each clause. You will finish with a checked clause gap table and a draft addendum for the gaps that matter most, ready for legal review.

This module shows you how to keep track of AI vendors once the contract is signed, and how to stay ready to leave. You will learn why model retirements, price changes, acquisitions and new sub-processors so often go unnoticed. You will also learn which public pages announce these changes and how often to check them. You will practise reading a status page’s incident history, a deprecation notice and changes to a sub-processor list. You will also run a test export to see what a vendor lets you take with you. You will finish with a watchlist for three AI vendors, with review dates, owners, action triggers and an exit trigger for each.