Vendor Questions That Cut Through the Noise

The 12-question core set

1. What exact tasks are model-driven vs rules-driven?
2. What training data is used (sources, coverage, and update cadence)?
3. How do you measure performance, and can we see results?
4. How do you handle edge cases and “unknowns”?
5. What human oversight is required for defensible outputs?
6. What explainability features exist (why did it flag X)?
7. Where is data stored and processed (regions, residency)?
8. Do you use our data for training? If yes, how is consent handled?
9. What security certifications do you maintain (SOC 2, ISO 27001)?
10. What is your breach notification process and timeline?
11. How do we export our data on exit (format, timeline, cost)?
12. What support and implementation resources are included?

Pro tip

If a vendor can’t answer these clearly, you’ve learned something important.