Home › Blog › Questions for AI vendors

Twenty questions to ask an AI vendor

The purpose of this list is not to test the vendor but to make your own review complete. Send it as-is, get written answers, and your comparison and contract review are organised at the same time.

20 questions Written answers Becomes your table

The short answer

A verbal answer is not a contract term. What counts after an incident is the contract and written answers, so these questions assume documented replies.

And once answered, they become your comparison table: rows are these twenty questions, columns are the candidates. Fill the table and your approval document is written with it.

Data (1–6)

1 — Do you use data we submit to train or improve models? What is the default, how is it disabled, and is the disabled state stated in the contract?

2 — How long are prompts and outputs retained? For what purpose, and what is the turnaround on a deletion request?

3 — In which countries and regions is data stored? Is a Korea region available?

4 — Where does inference run? Tell us if it differs from the storage location.

5 — Do you use other model providers or sub-processors? If so, list them and their data policies.

6 — Do you provide evidence of deletion at contract end? In what formats can we export our data?

Access control and security (7–11)

7 — Do you support SSO and multi-factor authentication? From which plan?

8 — Can permissions be separated by user and team? Where documents are indexed, do permissions apply at retrieval?

9 — Do you provide audit logs? Can we query and export them ourselves?

10 — Please provide certificates and validity dates for your security certifications (ISMS-P, ISO 27001, SOC 2 or similar).

11 — Within how many hours do you notify us of a breach? Is that time stated in the contract?

Korean adoption conditions (12–16)

12 — Please specify the extent of Korean support — UI translation, input/output handling, output quality, or technical support?

13 — What are your support hours? Can you respond during KST business hours? Is there an escalation procedure?

14 — Can you issue Korean electronic tax invoices? Is KRW billing available?

15 — Can we contract through a Korean reseller or partner? If so, please provide the contact.

16 — Where the product requires regulatory certification (medical device, wireless equipment), please provide the Korean approval status.

Cost and contract (17–20)

17 — Is there usage-based billing? If so, on what basis, and can we set a monthly ceiling?

18 — Are there seat minimums or a minimum term? When can seats be reduced?

19 — Is there a cap on price increases at renewal in the contract?

20 — What is the liability cap for incidents such as a data leak? Is it negotiable upward?

How to use this list

If sending all twenty feels heavy, split it. Send 1–6 (data) and 12–14 (Korean conditions) first. Those nine usually halve the candidate list.

Send the rest to what survives. At that point the vendor answers seriously, so response quality improves.

Put the answers straight into the table. Record "needs checking" and "verbal only" as well — a refusal to answer in writing is itself a finding.

Frequently asked questions

Will a vendor answer all twenty?

At enterprise evaluation stage, generally yes. Smaller products with only self-serve plans sometimes point to public documentation instead, which is itself information.

How long does it take?

Sent as a security questionnaire, usually one to two weeks. If you are in a hurry, send the first nine — those usually come back within days.

Is this excessive for a small product?

Scale it down. The minimum is three: training use, storage location, and data exportability. Those three filter out most of the large risks.

What if the answers differ from the contract?

The contract governs. So ask for the important answers to be reflected in the contract or an annex. If they refuse, treat that item as unguaranteed.

Request document

Put your requirements in writing

The RFP generator produces a request document carrying your data and support requirements — send it alongside this question list.

Generate an RFP