CANCanada has no AI Act — and four privacy regulators applied existing law to OpenAI anywayQCQuébec's automated-decision duty has applied since 22 September 2023 — notice at the decision, explanation on requestONOntario employers with 25+ staff must say when AI screens applicants — in force 1 January 2026CANFederal institutions and their vendors: the Directive on Automated Decision-Making, amended June 2025CAN2 bills would change all of this — C-36 and C-34 — and neither has passed
Assess vendor risk

Know what every AI vendor does with your data, before your board asks

Most of the AI an organization uses arrives inside someone else’s product. GOVERNBOX.ai keeps one register of those vendors, asks them the questions that matter, tracks the contracts that cover your data, and shows the risk each one carries.

See plans →Talk to Sales
How a vendor review works in GOVERNBOX.ai

From a name in a spreadsheet to a vendor you can defend

One register of every vendor

Starter+
  • Each third party is recorded once: AI model providers, AI applications, agent platforms, data processors, infrastructure and consultancies.
  • An Admin sets each vendor's approval: proposed, approved, restricted or retired. A use case cannot go live on a restricted vendor.
  • Already typed vendor names into your use cases, subscriptions or AI costs? GOVERNBOX.ai proposes a vendor record for each name, and an Admin confirms every one. Nothing is merged without a person deciding.

The AI behind each vendor

Starter+
  • Record the models, applications and agent platforms you rely on, link each to its vendor, and link your use cases and AI agents to the system they run on.
  • So when a vendor changes its terms or has an incident, you can see which of your AI uses it touches.

Due-diligence questionnaires your vendors answer online

Pro+
  • Start from the built-in “AI vendor due diligence” questionnaire, written in plain language. It asks whether your data trains their models, whether a DPA or HIPAA business associate agreement is available, where data is stored and how long it is kept, whether a person can override an AI-driven outcome, how fast they report incidents, their certifications and sub-processors.
  • Edit it, or write your own with text, yes/no, choice and date questions.
  • Send it by email. The vendor answers on a private link with no account to create, and you track it from sent to opened to submitted.
  • Answers are saved once and become part of the vendor's record. The questions are frozen as they were sent, so the record shows exactly what was asked.

Contracts that cover the data

Pro+
  • Track each vendor's data-processing agreement, HIPAA business associate agreement and international transfer terms (SCCs and the UK IDTA): missing, requested, signed or expired.
  • A missing agreement shows as a gap, not a blank.

The risk each vendor carries

Pro+
  • Risks in your register roll up to the vendor behind them, directly or through the AI system they run on, so the board sees which vendors hold the most risk.

Tell your other systems

Pro+
  • Signed webhooks fire when a vendor is added, when its approval changes and when a questionnaire comes back, so procurement and ticketing tools stay in step.

Put your vendors on the record

One flat price for your whole organization, never per seat.

See plans →Talk to Sales