The AI vendor RFP checklist

Twenty-three questions that separate vendors who can ship from vendors who demo. Print this. Take it into your next meeting. Watch the vendor's body language as you read down the list.

On the model and stack

1. Which models do you support? Can we bring our own? What's your switching procedure?
2. Where is inference run? Which jurisdictions? Can we choose?
3. Is our data used to train any models? Is that contractually verifiable?
4. How do you version prompts? Can we audit prompt changes?
5. What does your eval harness look like? Can we run our own evals against your platform?

On security and compliance

1. What certifications do you hold? (SOC 2 Type II, ISO 27001, HIPAA, GDPR DPA, EU AI Act readiness.)
2. Will you sign a BAA / DPA?
3. What's your incident response and notification policy?
4. Penetration test cadence — and can we see the most recent report?
5. What logging is retained, where, and for how long?

On reliability and operations

1. What's your SLA? What's your historical uptime over the last 12 months?
2. How do you handle model-provider outages?
3. What's the support model? Where do humans live?
4. How do you do change management on shared components?
5. What's the escalation path during a P1?

On commercials and lock-in

1. Pricing model — per-request, per-seat, per-token? Caps? Commitments?
2. What's the data export procedure if we leave?
3. What artifacts do we keep on termination — prompts, fine-tunes, evals?
4. What's the price escalation clause?

On their actual experience

1. Three reference customers in our industry, please. (Watch for hesitation.)
2. When did you most recently lose a customer? Why?
3. Show us an incident postmortem from the last 90 days.
4. What is the largest production deployment you currently support?