# Questions to ask an AI vendor before signing

Use a structured interview to expose scope, security and support gaps.

Updated 2026-10-29. Also on the [web page](https://aiagencies.fyi/guides/questions-to-ask-ai-vendors).

Send these questions with your project brief. Ask for written answers that become part of the scope. A sales call can clarify an answer, but it should not replace the record.

## Business and delivery

What task should this system perform? What should it refuse to do? What is the current baseline? Which part needs AI, and which part can use rules or ordinary search? Who supplies data, labels and domain review? Who approves the final result?

Ask what is outside the fee. Request the delivery roles, dependencies and assumptions. Ask what happens if the data is incomplete or access takes longer than expected. Require a change process that shows the effect on cost and delivery.

## Data and permissions

Where will our data travel? Which providers and subcontractors can see it? What is retained in logs? Can a model provider use it for training? How do you separate clients and limit tool access? Who can revoke access during an incident?

The ICO's AI guidance is useful for UK personal-data questions. It does not replace a review of the laws that apply to your business and users.

## Evaluation and operations

How do you test answers that sound correct but are wrong? How do you test document permissions? What evidence will we receive at acceptance? Who monitors quality after a model, prompt or source document changes? What is the fallback if the service is unavailable?

## Ownership and exit

Who owns the code, prompts, test data and deployment accounts? Which dependencies need separate licences? Can our staff run the system without your team? What is exported at termination, and how is deletion confirmed?

Record each answer, its evidence and the responsible person. Unanswered questions are risks to resolve before a contract.

## Sources

- [ICO, Artificial intelligence guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/). Public page fetched 2026-10-29.
- [NCSC, Guidelines for secure AI system development](https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development). Public page fetched 2026-10-29.

## Questions

### Is this a supplier recommendation?

No. Use this guide to prepare a brief and check the supplier evidence yourself.