AI Vendor Security Due Diligence Questions for Family Offices in 2026

Last updated: September 29, 2026.

Quick Answer

AI vendor security due diligence for a family office goes to two vendors: the AI assistant provider whose model reads the office’s data, and the software vendor, such as the wealth platform, that connects to it. Five questions decide most evaluations: training on the data, including in de-identified form; retention and whether it can be set to zero; where the data is processed and who can see it; whether the AI assistant inherits the user’s permissions and needs approval before acting; and what happens to the data at contract end. Good answers are specific and sit in the contract, and a platform vendor such as Aleta publishes its answers while the office verifies the AI assistant provider separately. Capability, fit, and price are a separate evaluation that this article does not cover.

Key Takeaways

• Third-party risk featured in 40% of cyberattacks on family businesses in the past two years, while 32% rely on vendor governance as a control, according to Deloitte’s 2026 family business cybersecurity report.

• 77% of family offices expect their use of third parties to increase over the next three years, and Ocorian’s 2026 Global Family Office Report notes that when services are externalized, data moves with them.

• Every AI assistant provider a family office connects is a new subprocessor of its wealth data, with its own retention and training terms.

• A no-training commitment that excludes only identifiable data still allows the vendor to learn from the office’s data in aggregate. The question that separates a real commitment from a nominal one is whether de-identified derivatives are excluded as well.

• AI vendor due diligence repeats whenever the vendor changes its model, its subprocessors, or its terms, and at least once a year regardless.

• A wealth platform vendor can publish its platform-side answers, and Aleta does: no training on client data, permissions inherited from the user, approval before any change, every query logged, and revocation by the office. The AI assistant provider's answers come only from its enterprise contract.

Why Does AI Vendor Security Due Diligence Matter for Family Offices?

Vendor governance is one of the least used security controls among family businesses, relied on by 32% according to Deloitte’s 2026 report, and AI tools are the newest vendors on the list.

Deloitte’s 2026 family business cybersecurity report found that 74% of family businesses experienced at least one cyberattack in the past two years, that third-party risk featured in 40% of those attacks, and that only 32% rely on vendor governance as a security control. Ocorian’s 2026 Global Family Office Report adds the direction of travel: 77% of family offices expect their use of third parties to increase over the next three years, 19% name cybersecurity concerns as one of the reasons, and the report observes that “when services are externalised, data moves with them.” Citi’s 2026 report AI in the Family Office lists third-party vendors accessing family information as one of the three specific worries behind the data privacy concern that it calls the primary barrier to AI adoption.

An AI assistant is a third party of exactly this kind. The moment an answer about the office’s holdings reaches it, the provider holds a piece of the office’s wealth data under terms the office may never have read. The connection can sit outside the office’s usual procurement process, since the tool is a monthly subscription and the person connecting it may be an analyst, so the vendor review that would meet a new custodian does not always meet a new AI tool. The questions below give that connection the same scrutiny, in a form a family office can complete in an afternoon.

Which AI Vendors Need Due Diligence?

Three kinds of vendor touch the office’s data with AI, and each one answers a different subset of the questions.

A few definitions first. AI vendor security due diligence is the process of verifying, before and during a contract, how a vendor’s AI handles the office’s data, who can access it, and what the office can enforce if the vendor’s answers turn out to be wrong. A subprocessor is any company that processes the office’s data on behalf of a vendor the office has contracted with, so an AI assistant provider used by a software vendor is the office’s subprocessor even when the office never signed anything with it. An enterprise tier is the version of an AI product sold to organizations under negotiated terms, as distinct from the consumer version sold to individuals under standard terms. Zero data retention is a contractual arrangement in which the AI provider does not store prompts or answers after the response is delivered. A data processing agreement, or DPA, is the contract clause or addendum that sets out what a vendor may do with personal data on the office’s behalf.

Table 1. The three kinds of AI vendor a family office evaluates

The second row is where most wealth data sits. A platform such as Aleta exposes the office’s data through an open API with an MCP (Model Context Protocol) layer on top for AI agents, so the platform answers for what an AI assistant can see and do inside the platform, and the AI assistant provider answers for what happens to the answer afterward. Our article on whether it is safe to connect an AI assistant to family office data explains that two-sided model in full, and our article on the state of AI in family offices covers the data foundation underneath it. This article assumes both and moves to the questions.

What Data Handling Questions Should You Ask an AI Vendor?

Six questions cover how an AI vendor treats the data itself, and the first one carries a second half that decides whether the answer means anything.

Table 2. Data handling questions for an AI vendor, with what a good answer sounds like

The first question deserves its own paragraph, because the second half of it is where a nominal commitment and a real one part ways. Many providers publish a default position of not training on business customers’ data. OpenAI’s enterprise privacy page states that it does not train on business data by default and offers zero data retention on eligible API endpoints, and Anthropic’s published data policy states that inputs and outputs from its commercial products are not used to train its models unless the customer opts in. Those are the right kind of answer, and the office should still read the next clause. Terms across the industry commonly allow feedback a user submits, or data that has been stripped of identifiers, to be used for analysis and product improvement. Wealth data that has been de-identified is still the office’s data, and a family’s portfolio is recognizable from its shape long after the family’s name is removed. The question to put in writing is whether the exclusion covers de-identified and aggregated derivatives as well as the raw data, and whether any feedback feature can be switched off for the whole organization.

What Access and Control Questions Should You Ask?

Access and control questions go to the software vendor that connects the AI assistant to the office’s data, because that vendor decides what the AI assistant can see and do.

Table 3. Access and control questions for the software or wealth platform vendor

For example, an AI assistant connected through Aleta’s two-way MCP layer works with the connected user’s permissions, reads within them, and acts only after explicit approval, with every query it runs against the platform logged and the connection revocable by the office at any time. Those answers are published, so a family office evaluating the platform can read them before the first call, which is the standard the second column of the table describes. The capital call workflow in our article on real AI prompts family offices run shows the approval step in practice, with the AI assistant preparing the postings from five notices and stopping for a person before anything is posted.

What Security Evidence Should an AI Vendor Provide?

Answers describe intent, and evidence shows whether the intent is tested, so six items of security evidence belong in every AI vendor file whatever kind of vendor it is.

An independent audit report, such as a SOC 2 Type II report or an ISO 27001 certificate, with the office reading the scope section to confirm that the product it is buying is the product that was audited. A penetration test summary from an outside firm, dated within the past year. A contractual incident notification timeline, stated in hours and running from the moment the vendor becomes aware of an incident, since a clock that starts after the investigation ends can run for weeks. A written answer to whether the vendor has had a reportable breach in the past three years, and what changed afterward. Cyber insurance, with the office asking for the coverage limit. A signed DPA that names the office as controller, the vendor as processor, and the AI assistant provider as subprocessor where that applies.

The audit report is the item most often misread. A report covers the systems and the period in its scope statement, and an AI feature added after the audit period or run on infrastructure outside the scope is not covered by it. The question to ask is whether the AI capability the office is evaluating sits inside the audited scope, and if the answer is no, when the next report will include it.

What Contract and Exit Terms Belong in an AI Vendor Agreement?

The contract is where the answers become enforceable, and the exit terms are the ones a family office regrets skipping.

Deletion on termination, with written confirmation and a stated period within which backups are purged. Export of the office’s data in a usable format before deletion, at no additional cost. Notice before the vendor changes the underlying model, adds a subprocessor, or revises its data terms, with the right to terminate without penalty if the office objects. Limits on price changes at renewal. Liability that is not capped at a trivial multiple of fees where the vendor’s failure exposes the office’s data. Audit rights, or at minimum the right to receive the vendor’s own audit reports on request each year. An AI assistant provider on an enterprise tier will usually have standard positions on each of these, and a software vendor connecting to that provider should be able to show how its own terms pass the same commitments through.

Do Consumer AI Tools Pass Due Diligence?

A consumer AI account fails the training, retention, and staff access questions by default, and no internal policy changes the terms attached to it.

On a consumer account the terms typically let the provider improve its models on conversations unless the user opts out, retention follows the provider’s defaults rather than the office’s, and the office has no administrator, no log, and no contract. That is the account staff reach for first, which is why the ungoverned connection is the larger risk in most family offices. The enterprise tier is the minimum for wealth data, and family offices that want prompts and answers to stay inside an environment they administer can run a model in their own cloud account.

How Does Aleta Answer AI Vendor Due Diligence Questions?

Aleta is a total wealth platform that delivers consolidated wealth reporting for family offices, built on an open, AI-native architecture. It is a software vendor in the sense of Table 1, SOC 2 Type II certified and named Best Data Provider at the Family Wealth Report Awards 2026, and its answers to the platform-side questions are published.

Table 4. Aleta's answers to the platform-side AI vendor due diligence questions

The last row is the one to read twice. A platform vendor controls what leaves the platform and can commit to that in writing. What the AI assistant provider does with an answer once it arrives is governed by the office’s agreement with that provider, and a platform vendor that claims otherwise is answering a question it cannot answer.

How Should a Family Office Run AI Vendor Due Diligence?

AI vendor security due diligence runs on the process a family office already uses for custodians and administrators, with the AI vendors added to the list.

Ownership sits with whoever owns third-party risk today, usually the CFO, the controller, or the office lead, with the person who will use the tool answering the practical questions. The questions in Tables 2 and 3 go to the vendor in writing, and the answers come back in writing; a call can explain an answer, but the written version is the one that counts. Each answer is scored on two points: is it specific, and is it in the contract. A specific answer that appears only on the vendor’s website scores half, since web pages change without notice. The evidence from the security section is collected once and filed with the DPA. The whole review is repeated once a year and whenever the vendor changes its model, its subprocessors, or its terms, since each of those changes can move an answer from the good column to the red flag column without anything else looking different. Ocorian’s 2026 report puts the standing requirement in one line: managing third-party relationships well “requires more than onboarding questionnaires.”

For the process itself, the NIST AI Risk Management Framework gives family offices that want a formal structure a vendor-neutral one, organized around governing, mapping, measuring, and managing AI risk. Most family offices will not need it in full.

The test of an answer is whether it is specific and whether it is in the contract. A vendor that has done this before hands over a document.