# AI vendor checklist — 12 questions before you buy

Vendor: [ ]  Product/tier: [ ]  Assessor: [ ]  Date: [ ]

Record evidence links, contract language and unresolved questions. A marketing claim is not a verified control.

| # | Question | Evidence / answer | Pass / gap / unknown |
| --- | --- | --- | --- |
| 1 | Which task will this replace or improve, and what is our current baseline? | | |
| 2 | Has it passed a representative test set using our permitted data? | | |
| 3 | What are the full costs: seats, usage, storage, integrations and support? | | |
| 4 | Are inputs or outputs used for training, and can this be contractually disabled? | | |
| 5 | Where is data stored and processed, and which subprocessors receive it? | | |
| 6 | What are the retention, deletion and export procedures and time limits? | | |
| 7 | Which authentication, access controls and audit logs exist on this tier? | | |
| 8 | How are confidential data, personal data and incidents handled? | | |
| 9 | Can a person review or stop consequential actions before execution? | | |
| 10 | What happens during downtime, model changes or quality regression? | | |
| 11 | Who owns our inputs, outputs, workflow configuration and custom work? | | |
| 12 | Can we leave without losing our data, and what are renewal/cancellation terms? | | |

Decision: [trial / approve / defer / reject]
Required conditions: [ ]
Approver and next review date: [ ]