Assessment · Governance · Assess and know

9Vendor and model due diligence

Are our AI vendors safe, and are we too dependent on one?

AI vendors and models checked for terms, concentration, price and fit before and after you buy.

AutomatedStakeholder interviews 3 controls 4 engines

How we collect

  • AutomatedVendor practices captured from trust, privacy, DPA and pricing pages, dated and quotedRuns today
  • AutomatedSpend share per vendor from billsRuns today
  • Stakeholder interviewsProcurement: contracts and approved vendorsRuns today

Status labels show what runs today, what needs an export or setup from you, and what is planned.

What you get

  • Vendor scorecard: training use, retention, regions, subprocessors, price
  • Model and route choice: compliance applies to the route, not just the model
  • Concentration and backup routes

Questions we ask

  • Which AI contracts renew this year?

We can start from

Vendor risk assessments, contracts, SOC 2 reports

Data sources

SourceWhat we readStatus
Invoices, card and AP exportsAI vendors found on statements and invoices, including ones never approved. Spend is exact because it is on the statement.Partly automated
Defender for Cloud AppsThe discovered Generative AI apps export: which AI sites people use, how often, and Microsoft risk scores.Partly automated
QuestionnaireThe short interview for what data cannot show: purpose, owners, decisions AI informs, regulations in scope.Runs today
AI gateway telemetryLiteLLM, Cloudflare AI Gateway or AICost CostWall logs: cost per team, workload, agent and outcome.Partly automated

Built on governance engine modules

P14 PlannedPrivacy, Confidentiality & IP

Whose data trains what, and who owns the output?

Assess & Govern
P11 BetaModel & Vendor Selection

Which model routes pass your gates, published, contracted, configured, observed?

Value & Optimization

AICost governance controls in this module

AICost-GovControl701Partly automated
AI vendor due diligence
What it is

Review of AI vendors and AI features inside existing software: data use, training on your data, retention, security, liability and model changes.

Why it is needed

Most enterprise AI is bought, not built. Vendor terms decide where your data goes.

Why enterprises need it

Procurement needs a repeatable AI check that runs before signature and again at renewal.

What you get:Training on your data switched offContract protections in placeRenewals reassessed
Run by
Vendor Facts engine (ToolsInfo)Vendor Lock-in Risk engine
Data
Invoices, card and AP exports, Defender for Cloud Apps, Questionnaire
Evidence produced
Vendor review: vendor, product, trains on data, retention, region, certifications, contract terms, decision.
Maps to
ISO/IEC 42001: supplier relationships; NIST AI RMF: Govern
AICost-GovControl702Partly automated
Vendor commitments watch
What it is

Tracking changes to vendors terms, safety commitments and pricing, and reassessing when they weaken.

Why it is needed

Vendors change terms and prices between renewals. Decisions made last year may no longer hold.

Why enterprises need it

Teams want to hear about a material change and act before it affects customers or budgets.

What you get:Term changes flaggedPrice changes caught earlyReassessment triggered
Run by
Vendor Facts engine (ToolsInfo)Price Watch engine
Data
Questionnaire
Evidence produced
Change log: vendor, what changed, date, impact, decision.
Maps to
NIST AI RMF: Govern
AICost-GovControl506Runs today
Model and vendor choice on cost, quality and risk
What it is

Choosing the model and vendor per workload on price, quality tests, origin and dependency on a single provider.

Why it is needed

The most capable model is rarely needed for every step. One provider for everything is a resilience risk.

Why enterprises need it

Teams want lower cost per task without quality loss and a fallback if a vendor fails or reprices.

What you get:Lower cost per taskA tested fallback providerLess lock-in
Run by
Model and Vendor Decision engineCheapest Model engineModel Router engineVendor Lock-in Risk engineModel Compare engine
Data
AI gateway telemetry, Questionnaire
Evidence produced
Model choice table: workload, current model, recommended model, cost change, quality result, fallback.
Maps to
NIST AI RMF: Manage; ISO/IEC 42001: supplier relationships

Frameworks

ISO/IEC 42001AI management system: policy, roles, risk treatment, suppliers, monitoring, internal audit, improvement

Stakeholders

ProcurementThird-party riskCIO
← 8. MCP servers, tools and AI supply chain All modules 10. Answer quality and grounding →
📖 Data sources & methodology 172 text models · 9 embeddings · 44 vision · 62 audio · 8 vector DBs across 10 vendor pages · last verified 2026-10-18

Methodology

  • All prices are USD per 1 million tokens, current as of 2026-10-18.
  • Vendor-published values have no mark. Inferred/extrapolated values are marked with * and listed below.
  • Batch API discounts are 50% off standard rates across providers that offer Batch mode.
  • Prompt caching discounts vary by provider (typically 80-90% off cached input tokens).
  • Regional data-residency surcharges (Anthropic 1.1x, OpenAI 1.1x, Google regional tiers) are NOT included in base rates.
  • Long-context pricing tiers apply when input exceeds model threshold.
  • Embedding prices are input-only (no output tokens generated).

Primary sources

Last-verified date is the most recent successful daily snapshot (aicost_pricing_snapshots) or, when no snapshot exists yet, the latest successful crawler run (aicost_crawler_runs). 10 of 10 vendors are currently verified. Aggregator services (TokenCost, AI Pricing Guru, etc.) are not listed.

Anthropic
2026-10-18
https://www.anthropic.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Anthropic Docs
2026-10-18
https://platform.claude.com/docs/en/about-claude/pricing
Daily snapshot since Sep 2023 · 704 days captured
OpenAI
2026-10-18
https://openai.com/api/pricing/
Daily snapshot since Sep 2023 · 705 days captured
Google AI
2026-10-18
https://ai.google.dev/gemini-api/docs/pricing
Daily snapshot since Dec 2023 · 680 days captured
Google Vertex
2026-10-18
https://cloud.google.com/vertex-ai/generative-ai/pricing
Daily snapshot since Dec 2023 · 680 days captured
DeepSeek
2026-10-18
https://api-docs.deepseek.com/quick_start/pricing
Daily snapshot since May 2024 · 619 days captured
xAI
2026-10-18
https://x.ai/api
Daily snapshot since Nov 2024 · 537 days captured
Mistral
2026-10-18
https://mistral.ai/pricing
Daily snapshot since Dec 2023 · 678 days captured
Cohere
2026-10-18
https://cohere.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Voyage AI
2026-10-18
https://docs.voyageai.com/docs/pricing

Inferred values (marked with * in calculator tables)

Derived from industry conventions, not directly published by the vendor. Typical conventions: cached input = 10% of base (90% off), Batch API = 50% of base (50% off).

Vendor / Model Field Why it’s inferred
Anthropic — Claude Sonnet 4.6 cachedInput Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.
Anthropic — Claude Sonnet 4.5 cachedInput Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.
Anthropic — Claude Sonnet 4.5 batchInput Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Sonnet 4.5 batchOutput Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Haiku 4.5 cachedInput Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.
OpenAI — GPT-5.4 Mini cachedInput Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.
OpenAI — GPT-5.4 Nano cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Nano batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Nano batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Pro batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.2 cachedInput Derived at 10% of input; no residency uplift.
OpenAI — GPT-5.2 batchInput Derived at 50% of input.
OpenAI — GPT-5.2 batchOutput Derived at 50% of output.
OpenAI — GPT-5 cachedInput Derived at 10% of input.
OpenAI — GPT-5 batchInput Derived at 50% of input.
OpenAI — GPT-5 batchOutput Derived at 50% of output.
OpenAI — GPT-5.5 Pro cachedInput Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.
OpenAI — GPT-5.5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.2 Pro cachedInput Derived at 10% of input — pro-tier convention.
OpenAI — GPT-5.2 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.2 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.1 batchInput Derived at 50% of input.
OpenAI — GPT-5.1 batchOutput Derived at 50% of output.
OpenAI — GPT-5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5 Nano cachedInput Derived at 10% of input.
OpenAI — GPT-5 Nano batchInput Derived at 50% of input.
OpenAI — GPT-5 Nano batchOutput Derived at 50% of output.
Google — Gemini 3 Flash cachedInput Derived at 10% of input — Google caching discount convention ~90%.
Google — Gemini 3.1 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 3.1 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 3.1 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Pro cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 2.5 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
xAI — Grok 4 (legacy) cachedInput Extrapolated at 25% of base.

Pricing is cross-verified against the LiteLLM community registry when available. Daily snapshots are kept in aicost_pricing_snapshots; every change is logged to aicost_price_changelog with old & new values for full audit trail. Read the full methodology →