Our Services / AI Services / AI Security / Vetting a Vendor
- Nine Questions, Asked in Writing
How to Vet an AI Vendor
The demo will be impressive. These are the nine questions that determine whether you can actually use the product on your data, and the answers you should refuse to accept.
BEFORE THE DEMO CONVINCES ANYONE
Ask in Writing, Accept in Writing
Every question below has a version a salesperson can answer reassuringly on a call and a version they have to answer accurately in a document. Send them in an email and ask for written responses. A vendor who will not put an answer in writing has told you the answer.
The reason to be this careful is that AI vendor terms are unusually fluid. Products are new, business models are unsettled, and the clause governing what happens to submitted content is exactly the clause most likely to change at the next revision. What you are buying is not just today’s behavior but a commitment about tomorrow’s.
We review AI vendors on behalf of Dallas businesses that have no procurement function and no time to read a data processing agreement. From Plano, we look at where the data goes, whether the vendor trains on it, and what happens to it if you cancel, and we answer in plain language.
THE NINE QUESTIONS
What to Ask, and What a Bad Answer Sounds Like
1
Is our content used to train your models, or anyone else's?
You want an unqualified no for your tier, in the contract rather than the marketing page.
Bad answer: “We don’t train on customer data” without specifying tier, the free tier of the same product frequently does.
2
How long is our data retained, and can we set that to zero?
Retention for abuse monitoring is normal; indefinite retention with no control is not.
Bad answer: “Data is retained as long as necessary to provide the service.”
3
Will you sign a business associate agreement?
For any medical practice or home health provider, this is a gate rather than a question. No BAA means PHI does not go near it, see HIPAA & AI.
Bad answer: “We’re HIPAA compliant”, compliance is a property of your arrangement, not a badge a vendor holds alone.
4
Which subprocessors see our data, and where?
Most AI products are built on someone else’s model. You are contracting with a chain, and you are entitled to see it.
Bad answer: vagueness about which underlying model provider is used, or refusal to commit to notice when it changes.
5
Can staff sign in with personal accounts?
If the product allows a personal login on a company device, your enterprise terms are one click away from being irrelevant.
Bad answer: “That’s a policy matter for you”. Ask specifically whether tenant restriction can be enforced.
6
What admin visibility and audit logging do we get?
You need to see who used it, when, and against what. Both for governance and for the day something goes wrong.
Bad answer: logging available only on a tier far above the one being quoted.
7
How will we be told if the terms change?
The single most overlooked question. Ask for advance written notice of material changes to data handling, with a right to exit.
Bad answer: “Updates are posted to our website.”
8
What happens to our data if we leave?
Export format, deletion timeline, and written confirmation that deletion occurred, including from backups.
Bad answer: a deletion promise with no stated timeline and no confirmation.
9
Do we already own something that does this?
Ask us, not them. A meaningful share of AI purchases duplicate capability already included in a license the business pays for.
We check this first, because the cheapest approved tool is the one already in your tenant. See Microsoft 365 Copilot.
FAQS
Frequently Asked Questions
What comes up when businesses run this list for the first time.
A vendor answered everything well. Are we safe?
Safer, and in a much better position to demonstrate diligence. But the answers describe the arrangement, not how your staff will use it. Configuration and training still determine whether regulated data ends up somewhere it should not.
We are twelve people. Will a vendor really answer these?
More often than you would expect, because most of it is already documented for larger buyers and simply not surfaced to small ones. Where a vendor will not engage at all, that itself is the finding, and there is usually a competitor who will.
Which question matters most?
Seven, how you will be told if the terms change. Everything else describes a moment in time. That one determines whether you find out before or after your data handling quietly becomes something you never agreed to.
BK
Written and reviewed by Bob Kehr, President & Founder of Kehr Technologies, Plano City Council member, and Plano Chamber Small Business Person of the Year 2022. He has sent this list to vendors on clients’ behalf, and knows which questions get answered in writing.
Last reviewed August 2026 · Questions we have not answered here? Call 214-444-3583. Kehr Technologies is based in Plano, Texas, and works with businesses throughout the Dallas area.