What questions should I ask an AI vendor about data?

Key questions: Is our data used to train your models? Where is data stored and processed? Do you have a Data Processing Agreement? Can we delete our data on request?

What's the most important clause in an AI vendor contract?

Data ownership and the right to deletion. Ensure the contract is explicit that your data (including prompts and outputs) belongs to you and is not used for training.

How do I evaluate model accuracy claims?

Ask for benchmark results on your specific use case, not just general benchmarks. Better yet, run a time-limited pilot with real tasks before committing to a contract.

Do we need a DPA with every AI vendor?

If you're subject to GDPR (or similar), yes — for any vendor processing personal data on your behalf. Most major vendors publish a standard DPA or build it into their commercial terms, as Anthropic, OpenAI and Mistral do.

Vendor Evaluation

AI Vendor Evaluation for Small Teams

Choosing an AI vendor is a governance decision, not just a procurement one. This hub covers the questions every small team should ask before signing a contract, from data handling to model transparency.

Start here

Pillar guide

AI Vendor Due Diligence Questionnaire: 30-Minute Gate

AI vendor due diligence questionnaire: 5 gate questions, 8 deep questions, the evidence to file and a 1-3 scoring sheet, run on OpenAI and Anthropic terms.

13 min read

Related guides

News · 9 min

Australia AI Committee Letter: 11 Safeguards, What to Ask Vendors

What do the 11 Joint Select Committee on Artificial Intelligence safeguards mean for you? Copy our vendor questions on incidents, evaluators and data.

News · 9 min

USA Today Sues OpenAI: $250M Claim Over ChatGPT News Summaries

$250M USA Today OpenAI lawsuit targets ChatGPT news summaries from 19 papers. Does OpenAI's indemnity cover your team? Check your plan.

Guides · 11 min

ICO Agentic AI Call for Evidence: What Developers Changed

The UK ICO named 10 AI developers that changed data practices and opened an agentic AI call for evidence closing Nov 20, 2026. Tracker and checklist.

News · 9 min

Utah Pro-Human AI Executive Order 2026-08

Utah's Gov. Cox signed EO 2026-08 on Oct 6: AI literacy training, human review and documented AI inputs. What it requires and a vendor checklist.

News · 10 min

Governor AI Executive Orders Tracker 2026

4 governor AI executive orders in 6 days. Which ones change state procurement? Compare CA, IL, OR and VA deadlines and copy a vendor safety attestation.

News · 10 min

AI Agent Liability Tracker, October 2026

Senate bill, House bill and California lawsuit on AI agent hacking, side by side. See who is liable, what is unknown, and 3 contract clauses to add now.

News · 9 min

OpenAI Agent Incident Tracker, Sept 2026

5 OpenAI agent incidents timeline, May to Sept 2026: see the disclosure lags, copy an incident-notice clause, and ask vendors 6 risk questions.

News · 5 min

Weekly: CA AI Laws, OpenAI Agents, Astra

Newsom signed SB 947 and SB 951, OpenAI disclosed agent incidents and cancelled GPT-6.1 Astra. Three actions for employers and AI buyers this week.

guides · 10 min

Who Enforces When Your AI Vendor Fails? DOJ vs States (2026)

Who enforces AI vendor failures? DOJ, Treasury and 15 state AGs disagree. See the enforcement map and contract clauses your team needs.

View all 43 related posts →

Frequently Asked Questions

What questions should I ask an AI vendor about data?: Key questions: Is our data used to train your models? Where is data stored and processed? Do you have a Data Processing Agreement? Can we delete our data on request?
What's the most important clause in an AI vendor contract?: Data ownership and the right to deletion. Ensure the contract is explicit that your data (including prompts and outputs) belongs to you and is not used for training.
How do I evaluate model accuracy claims?: Ask for benchmark results on your specific use case, not just general benchmarks. Better yet, run a time-limited pilot with real tasks before committing to a contract.
Do we need a DPA with every AI vendor?: If you're subject to GDPR (or similar), yes — for any vendor processing personal data on your behalf. Most major vendors publish a standard DPA or build it into their commercial terms, as Anthropic, OpenAI and Mistral do.