How to Use This Checklist
This checklist is designed for enterprise procurement teams, legal counsel, and CIOs evaluating GenAI vendors for significant deployments — defined as any AI system that will process confidential data, inform commercial decisions, or be embedded in customer-facing products at meaningful scale.
The checklist is structured in seven sections corresponding to the stages of a rigorous AI procurement process. Each section contains specific questions that should be answered before proceeding to the next stage. Any "no" or "unclear" answer is a negotiating point, not an acceptance criterion.
"In our experience, enterprises that run a structured GenAI procurement process consistently achieve 25–40% better commercial terms and significantly stronger data protections than those who accept vendor defaults."
Section 1: Vendor Evaluation (Pre-Shortlist)
Before issuing an RFP or entering commercial discussions, validate that each shortlisted vendor meets minimum thresholds across the following dimensions. Vendors who cannot satisfy these questions in pre-sales conversations should be treated with elevated caution in subsequent stages.
Vendor Viability and Market Position
- Financial stability: Has the vendor provided evidence of financial stability — either public financials, investor-backed funding visibility, or audited accounts — sufficient to support a multi-year engagement?
- Enterprise reference customers: Can the vendor provide three or more enterprise reference customers of similar scale and complexity willing to discuss their deployment experience?
- Model provenance: Can the vendor clearly explain what training data was used to build their foundation model, including licensing status for third-party data?
- Support model: Does the vendor have a dedicated enterprise support structure with named account management and defined escalation paths?
- Product roadmap: Has the vendor shared a 12-month product roadmap, and are there contractual commitments around feature availability for capabilities critical to your use case?
- Regulatory experience: Does the vendor have documented experience operating in your sector's regulatory environment (GDPR, HIPAA, FedRAMP, financial services, etc.)?
Section 2: Commercial Terms and Pricing
GenAI pricing models vary enormously — from per-seat subscriptions to token-based consumption models to outcome-based pricing. Each model carries different cost predictability profiles and negotiation dynamics. Our guide to AI usage-based pricing covers the cost management dimension in detail.
Pricing and Commercial Structure
- Pricing model clarity: Is the pricing model fully documented — unit prices, volume tiers, overage rates, and all applicable fees — with no undefined "future pricing" references?
- Cost caps: For consumption-based models, is there a contractual monthly or annual cost cap that prevents runaway expenditure?
- Price stability: Are current rates locked for the contract term, or does the vendor have unilateral rights to increase pricing? If increases are permitted, is there an annual cap (e.g., CPI + 3%)?
- Benchmarking rights: Does your contract include the right to benchmark pricing against market rates annually and renegotiate if you are materially above benchmark?
- Commitment flexibility: If you have committed to minimum spend or usage, are there clauses allowing commitment adjustment if your use case requirements change materially?
- Infrastructure cost pass-through: Are any underlying infrastructure costs (cloud compute, storage, API gateway) included in the quoted price, or are these pass-through variables?
- Marketplace vs direct: If purchasing via cloud marketplace, is there a documented analysis of total cost including marketplace surcharges vs direct agreement pricing?
Section 3: Data Rights and Privacy
Data rights provisions are the highest-risk area in AI contracts. For the detailed framework on what to demand, see our guide to AI data rights in vendor contracts. The checklist below covers the minimum questions that must be answered before signature.
Data Rights, Privacy, and Sovereignty
- Training data exclusion: Is there explicit contractual language confirming your data will not be used to train or improve the vendor's models without your explicit written consent?
- Output ownership: Does the contract confirm that all outputs generated from your data and prompts are owned by your organisation?
- Sub-processor disclosure: Has the vendor provided a complete list of sub-processors who will access your data, and is there a prior-notice obligation for changes?
- Data residency: Are the specific geographic regions for data storage and AI inference processing documented in the contract?
- GDPR/Privacy compliance: Has the vendor provided a Data Processing Agreement (DPA) compliant with applicable data protection laws, including GDPR Article 28 requirements?
- Data minimisation: Does the vendor have documented data minimisation practices — collecting only the data necessary for service delivery?
- Breach notification: Is there a contractual commitment to notify your organisation within 72 hours of any confirmed data breach involving your data?
- Data return/destruction: Is there a documented process for certified data return or destruction within 30 days of contract termination?
Section 4: Security and Compliance
Security Certifications and Controls
- SOC 2 Type II: Has the vendor provided a current SOC 2 Type II report (issued within the last 12 months) covering the services you will use?
- ISO 27001: Is the vendor certified to ISO 27001 or equivalent information security standard for their AI service infrastructure?
- Penetration testing: Does the vendor conduct annual third-party penetration testing of their AI platform, with results available to enterprise customers under NDA?
- Tenant isolation: For cloud-based AI services, is your data logically and cryptographically isolated from other tenants in the same infrastructure?
- Access controls: Does the platform support enterprise SSO, role-based access control, and audit logging sufficient for your compliance requirements?
- Vulnerability disclosure: Does the vendor have a documented vulnerability disclosure policy with defined remediation timelines?
- Sector compliance: For regulated industries — has the vendor provided sector-specific compliance documentation (HIPAA BAA, FedRAMP authorization, PCI DSS, etc.) as applicable?
Section 5: Performance and Governance
AI systems introduce performance dimensions not present in traditional software: output quality, model accuracy, and the risk of model changes degrading performance. For the full framework on AI SLA negotiation, see our guide to AI Model Performance SLAs.
Performance SLAs and AI Governance
- Availability SLA: Is there a contractual uptime commitment (minimum 99.9% for production systems) with defined measurement methodology and financial remedies for breaches?
- Response time SLA: Are API response time commitments documented, with P95 and P99 latency targets appropriate for your use case?
- Model change notification: Is there a minimum 30-day advance notice requirement before significant model updates that may affect output quality or behaviour?
- Model rollback rights: Can you request continuation of a previous model version if a new version materially degrades performance for your use case?
- Output quality standards: For regulated use cases, are there documented accuracy benchmarks and a process for remediation if outputs fall below agreed thresholds?
- Bias and fairness: Has the vendor provided documentation of bias testing methodology and results for models used in consequential decision-making contexts?
- Explainability: For regulated use cases (credit, hiring, healthcare), does the platform support the level of output explainability required by applicable regulations?
Section 6: Exit Provisions and Portability
Exit Rights and Data Portability
- Termination for convenience: Can you terminate the agreement for convenience with reasonable notice (30–90 days), without penalty beyond the committed term?
- Data export: Is there a documented process to export all your data — inputs, outputs, fine-tuning data, configuration — in machine-readable formats within 30 days of termination?
- Fine-tuned model weights: If you have fine-tuned models using the vendor's platform, can you export the fine-tuned model weights?
- API continuity: Is there a transition period (minimum 6 months post-termination) during which API access remains available to support migration?
- Change of control: Do you have termination rights if the vendor is acquired by an entity whose data practices are materially different from the current vendor?
- Transition assistance: Is the vendor contractually obligated to provide reasonable transition assistance — including documentation and support — for a defined period post-termination?
Section 7: Post-Signature Governance
Procurement is not complete at contract signature. GenAI deployments require ongoing governance to ensure the vendor continues to meet obligations and the deployment continues to deliver value.
Ongoing Governance and Review
- Quarterly business reviews: Is there a contractual commitment to quarterly executive-level reviews covering usage, performance, roadmap, and commercial optimisation?
- Usage monitoring: Do you have access to real-time usage dashboards covering consumption, costs, and model performance metrics?
- Audit rights: Does your contract include annual rights to audit the vendor's compliance with data protection, security, and service obligations?
- Contract renegotiation rights: Are there defined trigger points (e.g., significant price increases, material changes to service terms, model quality degradation) that require renegotiation?
- Internal governance: Has your organisation established an AI governance committee with responsibility for overseeing the deployment against defined policies and escalation criteria?
- Renewal strategy: Is there a documented renewal strategy and timeline — with independent benchmarking and competitive analysis — initiated at least 6 months before contract expiry?