Dossier

Responsible AI procurement — questions before the contract

Turn a proposed AI workflow into a reviewable purchase and an accountable service.

Describe the actual use

Procurement should begin with the users, data, decisions and consequences of the intended workflow. A general product description does not establish whether a deployment is appropriate. Have the responsible legal and security teams assess the specific use and applicable obligations.

Ask where the data goes

Request a clear account of data sources, processing locations, retention, access, subprocessors and any use for model improvement. Ask how the service separates organisations and how deletion or export is evidenced. Match these answers to the actual contract and configuration.

Demand an evaluation plan

A demonstration is not acceptance testing. Agree a representative test set, success measures, difficult cases and the human escalation route. Define what the supplier must disclose when models, retrieval sources or processing arrangements change.

Plan for incidents and exit

Name the operational owner and agree how errors are logged, investigated and communicated. Establish a fallback and test the ability to stop automated actions. Ask what can be exported and what needs rebuilding if the supplier relationship ends.

Keep the record useful

Maintain an inventory with purpose, owner, affected groups, data categories, suppliers, evaluation results and review dates. The record should support decisions and incident response, rather than becoming a checklist that nobody uses. This dossier is a preparation guide, not a legal compliance determination.

Discussion for EventChanger

Which supplier questions have changed real purchasing decisions? A shared question bank should distinguish mandatory internal requirements from negotiable preferences and evidence still to be supplied.