Evaluating External AI Tools: a practical framework for Swiss businesses

In this article published in the Law & Tech Insights Magazine of the Swiss LegalTech Association, Crystal Dubois, together with Brechtje Lindeboom (General Counsel, SwissSign AG), presents a framework for evaluating external artificial intelligence (AI) tools.

From purpose-driven scoping and legal basis for data processing to transfer risks, AI-specific risk classification, vendor due diligence and internal governance, the article sets out a seven-step approach to assessing whether an external AI tool should be deployed internally. It also surveys the leading international and domestic evaluation models — the EU AI Act, ISO/IEC 42001, the NIST AI Risk Management Framework, the OECD AI Principles and FINMA guidance — and distils the key red flags counsel should watch for before approving any deployment.

Bonnard Lawson advises clients on the assessment of external AI tools and on the design and deployment of internal AI governance.