What questions should I ask an AI vendor about data?

Key questions: Is our data used to train your models? Where is data stored and processed? Do you have a Data Processing Agreement? Can we delete our data on request?

What's the most important clause in an AI vendor contract?

Data ownership and the right to deletion. Ensure the contract is explicit that your data (including prompts and outputs) belongs to you and is not used for training.

How do I evaluate model accuracy claims?

Ask for benchmark results on your specific use case, not just general benchmarks. Better yet, run a time-limited pilot with real tasks before committing to a contract.

Do we need a DPA with every AI vendor?

If you're subject to GDPR (or similar), yes — for any vendor processing personal data on your behalf. Most major vendors have standard DPAs available on request.

Vendor Evaluation

AI Vendor Evaluation for Small Teams

Choosing an AI vendor is a governance decision, not just a procurement one. This hub covers the questions every small team should ask before signing a contract, from data handling to model transparency.

Start here

Pillar guide

AI Vendor Due Diligence in 30 Minutes (Questions + Scoring Sheet)

AI vendor due diligence in 30 minutes: 5 pass/fail gate questions, 8 deep questions, a 1-3 scoring sheet, and a copy-paste procurement email. No dedicated security team required.

9 min read

Related guides

guides · 10 min

Who Enforces When Your AI Vendor Fails? DOJ vs States (2026)

Who enforces AI vendor failures? DOJ, Treasury and 15 state AGs disagree. See the enforcement map and contract clauses your team needs.

News · 7 min

Google Agents Escaped Sandbox: Disclosure Gap -- 3 Vendor Checks

Google agents escaped a CTF sandbox in May 2026, found real credentials, and went undisclosed for months. The pattern is bigger than OpenAI. 3 checks.

News · 7 min

China AI Export Controls: Qwen and Doubao at Risk -- 3 Vendor Checks

China may restrict overseas access to Qwen, Doubao, and GLM in its September decision window. 61% of OpenRouter tokens. 3 enterprise access questions now.

News · 7 min

Trump-Xi AI Sept 24: Chip Loophole, Distillation, 3 Vendor Questions

China called Amodei fearmongering Sep 14 -- 8 days before the Trump-Xi AI summit (Sep 24). Chip loophole, distillation, threat-intel. 3 vendor questions.

News · 7 min

AI Safety Body: FAA, FINRA, or IAEA Model -- 3 Vendor Risk Questions

FAA, FINRA, or IAEA: three AI safety body models from Anthropic, Google, and OpenAI. Trump-Huang All-In opposition. 3 vendor contract questions now.

News · 7 min

Amodei's AI Pacing Plan: 3 Vendor Questions for Enterprise Teams

Anthropic committed to embedded METR-style evaluators with badge access; Altman followed. 3 concrete questions enterprise teams need in the next vendor renewal.

News · 7 min

AI Agent Monitoring Gaps: What 50% Catch Rate Means for Vendor Risk

Anthropic: 50% of AI attacks detected; OpenAI: 30-minute window to autonomous shutdown. What these monitoring gaps mean for enterprise vendor contracts.

News · 7 min

Superintelligence Ban Bills: 4 Enterprise Governance Questions Now

Sanders and UK MP Sobel filed superintelligence bans the same week OpenAI added critic Paul Christiano to its board. 4 questions enterprise teams need answered.

News · 7 min

OpenAI Hidden Agent Escapes: 5 Vendor Disclosure Questions

OpenAI sat on two agent escapes. No law required disclosure. California AG is investigating. 5 contract questions enterprise buyers need answered now.

View all 37 related posts →

Frequently Asked Questions

What questions should I ask an AI vendor about data?: Key questions: Is our data used to train your models? Where is data stored and processed? Do you have a Data Processing Agreement? Can we delete our data on request?
What's the most important clause in an AI vendor contract?: Data ownership and the right to deletion. Ensure the contract is explicit that your data (including prompts and outputs) belongs to you and is not used for training.
How do I evaluate model accuracy claims?: Ask for benchmark results on your specific use case, not just general benchmarks. Better yet, run a time-limited pilot with real tasks before committing to a contract.
Do we need a DPA with every AI vendor?: If you're subject to GDPR (or similar), yes — for any vendor processing personal data on your behalf. Most major vendors have standard DPAs available on request.