An AI procurement checklist should not stop at a vendor’s privacy banner. Buyers need evidence about system purpose, data flow, updates, oversight, exit paths and responsibility when the output is wrong.
Define the decision you are buying
Start with the user job, input sensitivity, affected people and acceptable error rates. A note summarizer and a tool that denies financial access should not go through identical approval paths.
Pin facts to a specific product scope
Request the exact service, model version or update policy, geographic hosting options, human-review mechanism and known limitations. Enterprise and consumer privacy terms often differ. Do not carry one product tier’s assurance across the whole vendor portfolio.
Follow the data and access
Capture controller/processor or equivalent roles where relevant, training reuse, retention, deletion, backups, subprocessor access, logs and export formats. A region picker alone may not define support access or all processing locations.
Demand testable assurance
Use a realistic sample set with failure cases, bias/accessibility checks and misuse scenarios. Vendor demonstrations are not independent benchmarks. Verify claims with a customer-owned acceptance record and a documented stop rule.
Contract for change and exit
Specify notification for material model or subprocessor changes, incident support, evidence preservation, retention after termination and portable exports. Choose an alternative workflow if essential controls are technically unavailable.
Governance after signature
Assign control owners, recurrence of reviews and escalation for failures. NIST AI RMF and ISO/IEC 42001 supply nonstatutory governance structures; actual legal duties depend on sector and jurisdiction.
Sources & Further Reading
- NIST AI Risk Management Framework — National Institute of Standards and Technology.
- ISO/IEC 42001 artificial intelligence management system — ISO.
Jurisdiction/scope: Global; sector laws vary. This is educational information and does not constitute legal or other professional advice. No hands-on product test is claimed.