A practical AI vendor risk assessment checklist for small businesses: data use, model training, permissions, integrations, contracts, logs, incident response, and approval decisions.