Use this AI procurement checklist when you buy an AI product or add AI features to an existing contract. It makes sure the commercial, legal, security and governance boxes are ticked before you sign.
Before you talk to vendors
- ☐ Business problem and success measures written down.
- ☐ Budget and number of users agreed.
- ☐ Data the tool will need classified (public, internal, confidential, personal).
- ☐ Shortlist built from the right category, with SafeScores checked.
During evaluation
- ☐ Pilot with real tasks and dummy or approved data.
- ☐ Vendor questionnaire completed.
- ☐ Risk assessment completed.
- ☐ Security review: SOC 2 / ISO 27001 report, SSO, audit logs, pen test summary.
- ☐ Accessibility and language support checked if relevant.
Contract terms
- ☐ No training on our data, written into the contract.
- ☐ Data processing agreement signed; sub-processors listed.
- ☐ Data location, retention and deletion on exit.
- ☐ Security incident notification within an agreed time (e.g. 72 hours).
- ☐ Ownership of outputs and IP indemnity.
- ☐ Notice of material changes to models, sub-processors or terms.
- ☐ Uptime commitment, support levels and service credits.
- ☐ Price protection and clear limits on usage-based charges.
- ☐ Termination rights and data export in a standard format.
- ☐ EU AI Act duties allocated between provider and deployer, where they apply.
After signing
- ☐ Tool added to the AI risk register and approved list.
- ☐ Training off and SSO on, confirmed in the admin settings.
- ☐ Users trained on the acceptable use policy.
- ☐ Review date set (3 to 12 months).