12 questions to ask any AI vendor

About your data

1. What data of ours is used to train or improve your models, and can we opt out?

2. Where is our data processed and stored, and which subprocessors touch it?

3. How long do you retain our prompts, uploads, and outputs?

4. What happens to our data if we cancel — and can you prove deletion?

About the system's behavior

5. What is the system designed to do, and what is it explicitly not for?

6. How do you test it — accuracy, failure modes, misuse — and can we see summary results?

7. How does it behave when it does not know or fails? Does it say so, or guess?

8. Can a human on our side review or override outputs before they reach customers?

About accountability

9. Which regulations have you assessed this product against (for example the EU AI Act, if it applies to us or to you)?

10. What documentation do you provide for our own compliance work — system descriptions, risk information, instructions?

11. If the AI causes us harm through error, what does the contract say — liability, indemnity, service credits?

12. How will you tell us about major model or feature changes, and how much notice do we get?

How to use the answers

You do not need perfect answers — you need written answers. Vendors who cannot or will not answer in writing are telling you something.

Keep the answers with your vendor records. They become evidence in your own AI governance file and save real time in any future assessment.