{
  "checklist_version": "2026.11",
  "issuer": "Best AI Data Providers Procurement Benchmark (bestaidataproviders.org)",
  "audit_scope": "Frontier Lab Cap-Table Neutrality, Telemetry Isolation & IP Firewall Due Diligence",
  "reference_event": "Post-2025 structural market split following Meta's $14.3B / 49% equity stake in Scale AI",
  "due_diligence_controls": [
    {
      "control_id": "CAP-01",
      "category": "Beneficial Ownership & Equity Independence",
      "question": "Does any frontier foundation model developer (including Meta, OpenAI, Google, Anthropic, Microsoft, or xAI) hold >= 5% direct equity, convertible debt, or warrant coverage in Vendor or its parent?",
      "acceptable_response": "NO (0.0% frontier model lab ownership verified via officer certificate)",
      "severity_if_failed": "CRITICAL_DISQUALIFICATION_FOR_PROPRIETARY_R_AND_D"
    },
    {
      "control_id": "CAP-02",
      "category": "Governance & Information Rights",
      "question": "Do external strategic AI investors hold board seats, board observer rights, technical advisory seats, or non-public product telemetry inspection rights?",
      "acceptable_response": "NO",
      "severity_if_failed": "CRITICAL_DISQUALIFICATION"
    },
    {
      "control_id": "CAP-03",
      "category": "Change-of-Control Termination Covenant",
      "question": "Does the MSA grant Buyer immediate no-fault termination, 15-day pro-rata prepaid retainer refund, and cryptographic data purge within 72 hours if Vendor signs a >= 10% equity or acquisition agreement with a model competitor?",
      "acceptable_response": "YES (Binding MSA Section included)",
      "severity_if_failed": "HIGH_LEGAL_REDLINE_BLOCKER"
    },
    {
      "control_id": "IP-01",
      "category": "Ban on Residual Knowledge & Derivative Weights",
      "question": "Are boilerplate 'residual knowledge', 'service improvement', 'rubric template reuse', and 'aggregated telemetry training' carve-outs completely stricken from the MSA?",
      "acceptable_response": "YES (Buyer owns 100% of prompts, rubrics, edge-case rulings, and rejected rows)",
      "severity_if_failed": "CRITICAL_IP_CONTAMINATION_RISK"
    },
    {
      "control_id": "SEC-01",
      "category": "Zero-Data-Retention (ZDR) VDI & Sub-Processor Lock",
      "question": "Are contributor sessions confined to clipboard-disabled, screenshot-blocked VDI or Buyer VPC workspaces with cryptographic 5-day ZDR destruction post-acceptance and zero undisclosed fourth-party crowd routing?",
      "acceptable_response": "YES (Audited in SOC 2 Type II report + GDPR Art. 28 Sub-Processor Schedule)",
      "severity_if_failed": "HIGH_SECURITY_BLOCKER"
    }
  ]
}