In short
- Get written answers on four areas before signing: data location, access, contract exit and how results are measured.
- Do not accept "that's standard" or "we'll sort it out later". Ask for a specific answer and the clause in the contract where it appears.
- Take the list to the meeting, go through it with the vendor, and record each answer with the date and the name of the person who gave it.
Take this checklist to your meeting with an AI vendor. Before you sign, it shows you where your data will go, who can reach it, what is left of it when the relationship ends, and how you will know the solution works.
For every question, ask for a specific answer, preferably in writing. If the vendor answers in generalities, note it and ask again. Next to each answer, record where it appears in the contract or its annexes.
1. Where your data lives
| Question | Vendor's answer | Contract clause |
|---|---|---|
| In which country and with which hosting provider will our data be stored? | ||
| Are our documents or queries sent to a third-party service (for example, the provider of the language model)? Which one? | ||
| Does the vendor or its partners use our data to train or improve models? | ||
| Is our data separated from other customers' data? How? | ||
| How is data encrypted at rest and in transit? | ||
| How long are prompts and agent responses (logs) retained? | ||
| Which of the vendor's partners (subprocessors) will touch our data? Will we get a list and notice of changes? |
A language model is the program that generates the answers. It often runs at a different company from your vendor, so ask about the whole chain.
2. Who has access
| Question | Vendor's answer | Contract clause |
|---|---|---|
| Which people at the vendor can access our data? In what role? | ||
| Which of our data will the AI agent be able to access? Can we restrict it by folder, system or person? | ||
| Does the agent see only what the user asking it is allowed to see? | ||
| Can the agent change, delete or send data out (email, orders)? Who approves that? | ||
| Is there an access log showing who accessed what and when? Can we get it on request? | ||
| How fast, and through which channel, will you tell us about a breach or incident? | ||
| Who on our side grants and revokes access? |
An AI agent is a program that does more than answer: it takes steps on its own, such as reading documents, searching and writing emails. The more it is allowed to do, the more precisely its limits must be defined.
3. What happens when the contract ends
| Question | Vendor's answer | Contract clause |
|---|---|---|
| In what format and by what date will you return all our data? | ||
| Within how many days after termination will you delete it, including backups and logs? | ||
| Will we receive written confirmation of deletion? | ||
| Who owns the configuration, rules and texts we created for the agent (instructions, templates, integrations)? Will we receive them? | ||
| Do we own what the agent produced from our data (summaries, indexes, search databases)? | ||
| How long is the notice period, and what are the fees for early termination? | ||
| What happens if the vendor shuts down or is acquired? | ||
| Will the solution keep working after we leave, or are we dependent on you? |
4. How results are measured
| Question | Vendor's answer | Contract clause |
|---|---|---|
| What specific result should the solution deliver (time saved, cases handled, error rate)? | ||
| What is the baseline today, and who will measure it before launch? | ||
| Who will measure the result, and from what data? Will we see that data too? | ||
| How will we find out when the agent makes a mistake? Who fixes it, and by when? | ||
| Who reviews the agent's answers in the first weeks, and by what procedure? | ||
| Is there a pilot period? How long is it, and on what terms can we exit without a fee? | ||
| What is the total annual cost, including licences, usage volume and customisation? | ||
| What happens if the agreed result is not achieved? |
How to use the checklist
- Send the questions to the vendor in advance so they have time to answer precisely.
- In the meeting, fill in the answers column. Write down the name of the person who answered and the date.
- In the last column, add the contract clause. If you cannot find one, ask for it to be added to the contract or an annex.
- Do not sign a contract that leaves a blank next to the questions on data deletion, access or measuring results.
- Have a lawyer read the contract before signing. If customer or employee personal data is involved, also ask about a data processing agreement (required under GDPR where it applies).
Meeting notes
Date: ____________ Vendor: ____________________
Attendees from our side: ____________________
Attendees from the vendor: ____________________
Open items and deadline for resolving them:
- ______________________________________
- ______________________________________
- ______________________________________
Decision: ☐ sign ☐ sign after open items are resolved ☐ do not sign
AI agent use cases for companies by industryData security when you deploy AI in your company
Prepared by AI. Adapt it to your company before use. Not legal advice.