AITPRM 1-Page AI Vendor Scorecard · 2026

Twelve domains. One score per domain. Evidence rated separately.

VendorTool and useReviewer · date

Domain	What to establish	Weight	Score 0–4	Evidence
D1 Data and model control	Training, tuning and evaluation rights on our data and derivatives	High	01234	VPCM
D2 Subprocessors and supply chain	Every model provider named and bound under the BAA	High	01234	VPCM
D3 Derivative data and embeddings	Ownership, retention and destruction of embeddings, summaries, inferences	High	01234	VPCM
D4 Human in the loop controls	Documented human confirmation for care, coverage or billing decisions	High	01234	VPCM
D5 Suspension and fallback	Customer-side halt and documented prior-workflow fallback	Medium	01234	VPCM
D6 Model incident reporting	Drift, bias and hallucination notice with timelines, distinct from breach	Medium	01234	VPCM
D7 Ambient capture governance	Audio ownership, consent model, retention, state disclosure duties	Medium	01234	VPCM
D8 Cross border data transfer	Where PHI is stored, processed and backed up, including by subprocessors	Medium	01234	VPCM
D9 Cross customer tenant separation	Isolation at the model layer; no learning across customers	Medium	01234	VPCM
D10 Agentic access and API scope	Permission scope, write confirmation, audit log, rollback	High	01234	VPCM
D11 Termination and data return	Return, destruction and certification for data, prompts, outputs	Standard	01234	VPCM
D12 Audit rights and inspectability	Direct inspection by us or our independent auditor	Standard	01234	VPCM

Score bands

0 · Declined or absent · 1 · Asserted, unevidenced · 2 · Partial · 3 · Evidenced · 4 · Evidenced and contractual

Evidence

V verified · P partial · C documentation gap · M missing. An artifact that does not substantiate the response, or is missing, opens a finding regardless of score.

Rule

Any open finding at tier 3 or above caps the overall score at 3.0. An unanswered item scores 0 and generates a finding; the response is recorded as part of the assessment.

Decision support, not a determination of compliance. Not legal advice. Full library: 256 cited questions across these twelve domains, scoped by deployment pattern. © 2026 ReMyll. AITPRM Health™ is a trademark of ReMyll.