The 11 questions procurement should ask every AI vendor

Eleven questions, each answered by a document rather than a sentence. A question a vendor can satisfy with reassuring words is not a control; it is a line in a file nobody reads again. The test for each one below is whether a refusal to answer would stop the purchase.

AI governance for procurement has a publishing problem. The question sets have grown from ten items to thirty to a hundred and seventy, each version longer than the last, almost all written by companies that sell the software for storing the answers. At a company of 50 to 500 people, where this work lands on an operations lead or a CFO between other things, the long version does not get run. It gets skipped, and the tool goes on a credit card.

Why the long checklist loses

Search for AI vendor diligence questions and the first page is a count auction: ten, fifteen, twenty-five, thirty, thirty-five, forty-five. The most thorough entry runs about 7,500 words and roughly 170 questions across thirteen categories, written by a credentialed privacy officer. Good work. It also assumes a reviewer who does not exist in a 200-person company.

Length costs both sides. Vendors report that a security review backed by prepared evidence takes one to two weeks, and that an AI questionnaire with no evidence base behind it takes far longer. A tool category now exists to auto-answer these documents. When the questionnaire is answered by software on one side and filed by nobody on the other, it has stopped governing anything.

The quieter failure is that these pages list questions without publishing the standard for a passing answer, leaving a non-specialist unable to tell a real answer from a fluent one. “We take data security seriously” and “we are SOC 2 aligned” both read as compliance. Neither is. What helps is a short list where each item names the document that settles it and the non-answer it catches.

Triage first: three tiers, ten minutes

Not every AI purchase deserves the same scrutiny, and pretending otherwise is how the process gets abandoned. Sort on two things: whose data the tool touches, and whether its output affects a person.

Tier	Test	What you run
Register	No customer or employee data, and a person reviews every output before it leaves the company	Questions 1, 2, 6. Log the tool and move on
Review	Processes customer, employee or confidential material, or its output reaches a client	All eleven
Review plus counsel	Influences a decision about a person: hiring, pay, promotion, credit, insurance, housing, discipline	All eleven, plus disparate-impact test evidence, then a lawyer

The third tier is where US state law has arrived. The Texas Responsible Artificial Intelligence Governance Act took effect on January 1, 2026. Colorado’s 2024 AI Act never did: it was delayed, then repealed and replaced by SB 26-189, signed May 14, 2026, which rebuilds the statute around automated decision-making technology from January 1, 2027, with enforcement waiting on state rulemaking. Consequential decisions about people are regulated; ordinary productivity tools are not. Your triage rule should match that shape.

The eleven questions

Ask for the artifact by name. A vendor with the control has the document; a vendor with only the sentence will send the sentence.

#	Question	Artifact that settles it	Reject this answer
1	Which model runs this, and whose is it?	A written list naming the model provider and our notice rights when it changes	“Best-in-class models,” “proprietary”
2	Are our inputs and outputs used to train any model, and is that the default or a setting?	The clause in the signed terms, not a marketing page	“We never sell your data”
3	How long do you keep prompts, outputs and uploaded files, and can we shorten that?	A retention schedule with numbers, and which fields we control	“As long as needed to provide the service”
4	Who else touches our data?	A subprocessor list with locations, and notice before it changes	“Trusted infrastructure partners”
5	Which of your staff can read our content, under what process?	The access policy, the emergency-access procedure, and whether it is logged	“Access is strictly limited”
6	Send the certificate.	SOC 2 Type II report, ISO 27001, ISO/IEC 42001, each with auditor and date	“SOC 2 aligned,” “NIST compliant”
7	What does the audit log capture, how long is it kept, can we export it?	The event list and export path, shown in the admin console	“Full auditability”
8	When the model changes, what are we told, and when?	A change-notification clause plus a version-deprecation policy	“Continuous improvement”
9	What has gone wrong, and how fast would we hear?	An incident-notification clause with an hours figure, plus the public incident history	“No incidents to date”
10	On the day we leave, what comes back and what is destroyed?	Export format, deletion deadline, written deletion confirmation	“Data is deleted on termination”
11	Who here can judge these answers, and who uses this on Monday?	Your own answer, in writing	Silence

Four carry more weight than the rest at a mid-market company.

Question 2 separates the products that are safe to standardize on from the ones that are not, and the honest answer is now usually good. On business and enterprise tiers, customer inputs and outputs are excluded from model training by default: OpenAI states this for ChatGPT Business, Enterprise, Edu and the API, and Anthropic writes the same exclusion into its commercial terms for Claude Team, Enterprise and the API. Consumer tiers run the opposite default. That gap, not the product choice, is the exposure, and it is the argument for paying for business accounts rather than tolerating personal logins.

Question 3 catches the distinction most buyers miss: “not used for training” and “not stored” are different claims. Content can be excluded from training and still sit in retention for abuse monitoring, which matters if what you pasted was a client file.

Question 9 is the one vendors answer worst. A clean incident history from a two-year-old company tells you nothing; an incident with a clear post-mortem and a notification clock in the contract tells you a lot. Ask for the clause, not the record. Question 10 is where lock-in hides: the OECD’s work on AI in public procurement treats restrictive data licensing as a governance failure in itself, because it leaves the buyer unable to move its own data.

Four contract terms, borrowed from the federal government

You do not have to draft AI clauses from nothing. OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government, was issued on April 3, 2025, rescinded the earlier M-24-18, and attaches to federal solicitations from September 30, 2025. Four of its terms transfer cleanly to a private buyer:

1. Intellectual property is settled in writing before signature: who owns the outputs, and who owns anything built on them.
2. Licensing is scoped to prevent lock-in, so leaving is a commercial decision rather than a technical impossibility.
3. Vendor data collection is limited to what is reasonably needed to deliver the service.
4. Non-public inputs and outputs may not be used to further train publicly or commercially available models without explicit consent, permanently.

Lift the fourth term from the memo itself. It beats the usual “we will not train on your data” assurance because it covers outputs as well as inputs, and because it survives the vendor’s next pricing-tier reshuffle.

The certification question that cannot be answered

Nearly every published checklist asks vendors to confirm alignment with the NIST AI Risk Management Framework, NIST AI 100-1, published January 26, 2023, which sorts AI risk work into four functions: Govern, Map, Measure and Manage. NIST added a generative-AI profile, NIST AI 600-1, on July 26, 2024.

It is voluntary guidance, and NIST certifies no one against it. No certificate, no auditor, no registry, so “yes, we align with NIST” cannot be disproved and every vendor says it. The framework earns its place as shared vocabulary across legal, security and buying conversations. It is worthless as a screening question.

The certifiable standard is ISO/IEC 42001, published in December 2023 for AI management systems. Accredited bodies audit against it, certificates run on a three-year cycle, and AWS, Anthropic and Microsoft already hold one. Replace the unanswerable question with a specific one: send the ISO/IEC 42001 certificate, with the certifying body and issue date, or tell us you do not hold it. Both answers are useful, and a no is still common enough not to be disqualifying on its own.

What a review costs, and where to stop

Honest numbers, which no vendor-published checklist offers:

• Register tier: under thirty minutes, mostly the terms page and admin settings.
• Review tier: about half a day to read the artifacts and run one vendor call, plus one to two weeks of vendor turnaround if the evidence is ready. Expect longer from a young vendor assembling it for the first time, and treat that delay as information.
• Review plus counsel: a few hours of outside legal time on the three negotiable clauses.

Stop when the next question cannot change the decision. If a tool fails question 2 and the vendor will not move, questions 3 through 10 are academic. If it passes all ten vendor-facing questions and your team still cannot use it safely, the diligence was the easy part.

The eleventh question is about you

A perfect set of vendor answers governs one sanctioned tool. It does not govern the person who finds that tool slow and opens a personal account instead, and the measured scale of that behavior is why question 11 is on the list.

The 2025 KPMG and University of Melbourne study Trust, attitudes and use of artificial intelligence surveyed 48,340 people across 47 countries. It found that 57% of employees hide their AI use and present AI-generated work as their own, and 48% had put potentially sensitive company information or copyrighted material into public AI tools. Alongside those: only 47% had received any AI training, and only 40% said their workplace had any guidance on generative AI at all.

Those four figures describe one situation: people using capable tools without instruction, under a rule they half-remember, concealing it because disclosure carries no upside. No vendor questionnaire reaches that. Closing it is the subject of the safe AI use playbook, and the instruments that work are mostly not surveillance, as the case against monitoring your way to compliance sets out. Your clients and insurers are starting to run the same review on you, the mirror image covered in what your insurer and clients now ask about your AI controls.

There is a formal version of the duty. If you place or use AI systems in the European market, Article 4 of the EU AI Act has required providers and deployers to take measures supporting AI literacy among their staff since February 2, 2025. That one points at the buyer, not the seller.

AI enablement is the half procurement cannot buy. Licenses and clauses are purchasable in a quarter; the judgment to use them well is built, which is the argument in why buying licenses is not the same as building capability.

Running this inside one buying cycle

1. Week 1 — Triage the request. Name one owner and one technical reviewer, because split across legal, IT and the requesting team this gets finished by nobody. Send the artifact list for the tier in one email, asking for documents rather than answers.
2. Week 2 — Read what arrives. Score each question pass, fail or unanswered. Unanswered is a finding, not a gap in your process.
3. Week 3 — One call on the failures only. Negotiate the three clauses that move.
4. Week 4 — Sign or decline, record the decision and evidence in one place, and diary the re-read for renewal. Then train the people who will use it, because that is the control no contract supplies.

Frequently asked questions

How many questions should an AI vendor questionnaire have?

Few enough to be run every time. Eleven works for a company without a dedicated risk function, because each question maps to a document a real vendor already has. A forty-question pack is better on paper and worse in practice: the version that gets skipped governs nothing.

What if the vendor refuses to answer a question?

Treat the refusal as the answer and record it. A vendor who will not name its model provider, state its retention period or send a certificate has told you where its controls end. For a register-tier tool that may be acceptable. For anything touching client data it is a decline.

Is NIST AI RMF certification a real thing?

No. The framework is voluntary guidance and NIST issues no conformance certificate, so any vendor can claim alignment and none can prove it. Ask instead for ISO/IEC 42001, which accredited bodies do certify, alongside SOC 2 Type II and ISO 27001 for the security layer underneath.

Do the major AI assistants train on our company data?

On business and enterprise tiers, generally not by default. OpenAI excludes business inputs and outputs from training on ChatGPT Business, Enterprise, Edu and the API, and Anthropic writes the same exclusion into its commercial terms. Consumer tiers run the opposite default, so the account people log into matters more than the brand on it. Verify both against the current terms before relying on it.

Does the EU AI Act apply to a US company of 200 people?

Only if you place AI systems on the European market or use them there, which catches more US companies than expected once an EU subsidiary or EU customers are in scope. Where it applies, the Article 4 literacy duty has bound both providers and deployers since February 2, 2025, and a deployer must obtain the provider’s instructions for use before putting a system into service.

Can we reuse our existing SOC 2 security questionnaire?

Partly. The security, access and subprocessor sections carry over. What it does not ask: whether your content trains a model, how long prompts are kept, what happens when the model changes, and who is accountable when the output is wrong. Those four are the AI-specific additions.

How do we handle AI features added to software we already bought?

Re-triage at renewal and ask question 8. The common surprise is not a new AI vendor; it is an AI feature switched on by default inside an existing tool, under terms that changed quietly. Keep a list of which tools have AI enabled and who turned it on.

What should we do about contractors using their own AI tools?

Extend the same data rules to them in writing, since your vendor controls stop at your own staff. That is a separate exercise, covered in extending your AI policy to contractors and freelancers.

What does AI governance for procurement cost to set up?

Little in software, real time in attention. The triage rule, the artifact list and the four contract terms are a morning’s work and reusable for every purchase after. The recurring cost is the half-day per review-tier vendor, plus the training spend that makes the controls hold, where the market range for hands-on workshop programs runs roughly $2,000 to $15,000.

Key takeaways

• The published checklists keep growing because the publishers sell questionnaire software. A short set that gets run every time governs more than a long one that gets skipped.
• Ask for the artifact, not the assurance: every question should name the document that settles it.
• Question 2 is the screen that matters: are our inputs and outputs excluded from training, by default, in the signed terms.
• Copy the four contract terms from OMB M-25-22, above all the permanent ban on training public models with your non-public inputs and outputs.
• Drop “are you NIST-aligned” and ask for the ISO/IEC 42001 certificate: one is certifiable, the other is not.
• Vendor answers govern one tool. Capability governs behavior, and the training gap is wide enough that diligence alone is theater.

Running this review for the first time and want a second pair of eyes on the questions, the artifact list, or the training that follows the signature? Book a free AI-readiness call. Thirty minutes, no deck.