What questions should I ask an AI vendor about data?

Key questions: Is our data used to train your models? Where is data stored and processed? Do you have a Data Processing Agreement? Can we delete our data on request?

What's the most important clause in an AI vendor contract?

Data ownership and the right to deletion. Ensure the contract is explicit that your data (including prompts and outputs) belongs to you and is not used for training.

How do I evaluate model accuracy claims?

Ask for benchmark results on your specific use case, not just general benchmarks. Better yet, run a time-limited pilot with real tasks before committing to a contract.

Do we need a DPA with every AI vendor?

If you're subject to GDPR (or similar), yes — for any vendor processing personal data on your behalf. Most major vendors publish a standard DPA or build it into their commercial terms, as Anthropic, OpenAI and Mistral do.

Vendor Evaluation

AI Vendor Evaluation for Small Teams

Choosing an AI vendor is a governance decision, not just a procurement one. This hub covers the questions every small team should ask before signing a contract, from data handling to model transparency.

Start here

Pillar guide

AI Vendor Due Diligence in 30 Minutes (Questions + Scoring Sheet)

AI vendor due diligence in 30 minutes: 5 pass/fail gate questions, 8 deep questions, a 1-3 scoring sheet, and a copy-paste procurement email. No dedicated security team required.

9 min read

Related guides

News · 9 min

Utah Pro-Human AI Executive Order 2026-08

Utah's Gov. Cox signed EO 2026-08 on Oct 6: AI literacy training, human review and documented AI inputs. What it requires and a vendor checklist.

News · 10 min

Governor AI Executive Orders Tracker 2026

4 governor AI executive orders in 6 days. Which ones change state procurement? Compare CA, IL, OR and VA deadlines and copy a vendor safety attestation.

News · 10 min

AI Agent Liability Tracker, October 2026

Senate bill, House bill and California lawsuit on AI agent hacking, side by side. See who is liable, what is unknown, and 3 contract clauses to add now.

News · 9 min

OpenAI Agent Incident Tracker, Sept 2026

5 OpenAI agent incidents timeline, May to Sept 2026: see the disclosure lags, copy an incident-notice clause, and ask vendors 6 risk questions.

News · 5 min

Weekly: CA AI Laws, OpenAI Agents, Astra

Newsom signed SB 947 and SB 951, OpenAI disclosed agent incidents and cancelled GPT-6.1 Astra. Three actions for employers and AI buyers this week.

guides · 10 min

Who Enforces When Your AI Vendor Fails? DOJ vs States (2026)

Who enforces AI vendor failures? DOJ, Treasury and 15 state AGs disagree. See the enforcement map and contract clauses your team needs.

News · 7 min

Google Agents Escaped Sandbox: Disclosure Gap -- 3 Vendor Checks

Google agents escaped a CTF sandbox in May 2026, found real credentials, and went undisclosed for months. The pattern is bigger than OpenAI. 3 checks.

News · 7 min

China AI Export Controls: Qwen and Doubao at Risk -- 3 Vendor Checks

China may restrict overseas access to Qwen, Doubao, and GLM in its September decision window. 61% of OpenRouter tokens. 3 enterprise access questions now.

News · 7 min

Trump-Xi AI Summit Sept 24: Chip Loophole and Distillation

China called Amodei's AI pacing plan fearmongering on Sept 14, ten days before Xi's Sept 24 White House visit. Chip loophole, distillation, vendor checks.

View all 42 related posts →

Frequently Asked Questions

What questions should I ask an AI vendor about data?: Key questions: Is our data used to train your models? Where is data stored and processed? Do you have a Data Processing Agreement? Can we delete our data on request?
What's the most important clause in an AI vendor contract?: Data ownership and the right to deletion. Ensure the contract is explicit that your data (including prompts and outputs) belongs to you and is not used for training.
How do I evaluate model accuracy claims?: Ask for benchmark results on your specific use case, not just general benchmarks. Better yet, run a time-limited pilot with real tasks before committing to a contract.
Do we need a DPA with every AI vendor?: If you're subject to GDPR (or similar), yes — for any vendor processing personal data on your behalf. Most major vendors publish a standard DPA or build it into their commercial terms, as Anthropic, OpenAI and Mistral do.