Vendor checklist

Increasingly the AI in your business arrives as a feature in software you already have. Send these before the demo.

The nine questions

Which model provider sits behind this feature, and is that in writing?
Is our content used to train or improve any model, theirs or a third party's?
What's retained, for how long, and what does deletion actually delete?
Where is it processed and stored, and which jurisdictions can compel access?
Who can review our content, under what circumstances, and is it logged?
Can the feature be turned off per user, and does that stop processing or just hide it?
What happens to our data if we leave, or if you're acquired?
What does the contract say about breach notification, and on what timeline?
Has this been assessed against the Australian Privacy Principles, and can we see it?

Reading the answers

Specific, written, quick — they've done the work.
Reassurance without detail — they haven't, or they can't say.
“Enterprise-grade security” as an answer to a data-use question — not an answer.
A refusal to put it in writing — the most informative response available.

Their compliance is not your compliance

A vendor's assessment covers their obligations. Yours still sit with you, which is why the written answers matter more than the assurance.

The same five principles applied to the two tools we teach: tiers and what happens to your data.

Using it in the actual call

Vendor demos are built to answer questions you didn't ask. The checklist works best read out loud, in order, with the answers written down — partly for the answers, partly because a vendor who can't answer question one has told you something important.

The two most people skip: whose model is underneath, and what happens to your setups when you stop paying. Both are awkward to ask and both materially change the decision.

What a good answer sounds like

Specific, and slightly boring. "It's built on [named model], your content isn't used for training, retention is X days, and here's the export" is a good answer. "We take security very seriously and use enterprise-grade encryption" is not an answer to any of the questions on the list.

The other test worth applying: what does this do that a general tool plus a good setup wouldn't? Sometimes the answer is real — genuine domain structure, the forms and formats a regulator expects. Sometimes you're paying a subscription for vocabulary. More on that under questions to ask any AI vendor.

Weighing up a specific product? We have no stake in which way that goes, which is the point.

Start an enquiry

Get a training plan built for your business. Nine questions about how your business actually runs. You get a plan ordered for your work, a reading on where you're exposed, and one clear place to start. No account needed. Build your plan.