AI Supplier Selection Checklist

Before you search

• •Define the business problem in plain English.
• •Name the process owner and intended users.
• •Record the current baseline for time, cost, quality or risk.
• •Define the outcome and how it will be measured.
• •Agree the budget range and desired timetable.
• •Separate must-have requirements from preferences.

Capability

• •The supplier can demonstrate the intended use case.
• •Current capability is distinguished from roadmap promises.
• •Limitations and unsuitable uses are explained.
• •Users can review, correct and reject outputs.
• •Exceptions and low-confidence outputs are handled safely.
• •The product supports required languages, formats and volumes.

Technical fit

• •Required integrations are available and documented.
• •API limits and additional charges are understood.
• •Identity, access and permission controls meet requirements.
• •Hosting and data-residency locations are acceptable.
• •Performance, availability and scalability have been assessed.
• •Export, backup and business-continuity arrangements are clear.

Data and responsible AI

• •Required data sources and quality standards are understood.
• •The lawful basis for using personal data has been considered.
• •Model-training and data-reuse terms are acceptable.
• •Retention and deletion controls are documented.
• •Human oversight is appropriate to the level of risk.
• •Bias, accuracy and harmful-output testing are explained.
• •Important outputs can be traced or explained sufficiently.

Security and compliance

• •Relevant certifications are current.
• •Independent audit evidence is available.
• •Subprocessors and model providers are disclosed.
• •Incident response and notification times are contractual.
• •A suitable Data Processing Agreement is available.
• •Sector-specific regulatory requirements are addressed.

Evidence

• •Claims are supported by documents, demonstrations or references.
• •Case studies relate to comparable organisations and uses.
• •Outcome metrics have clear definitions and baselines.
• •Reference customers can discuss implementation as well as results.
• •Evidence gaps are recorded with an owner and deadline.

Implementation and adoption

• •Responsibilities are divided clearly between buyer and supplier.
• •Data preparation and integration work are included in the plan.
• •Training and user support are adequate.
• •Change-management requirements are recognised.
• •Milestones, dependencies and acceptance criteria are agreed.
• •There is a plan for monitoring quality after launch.

Commercial and contractual

• •Total first-year and ongoing cost is understood.
• •Usage, model, integration and support charges are included.
• •Renewal pricing and price-increase mechanisms are clear.
• •Service levels and remedies are appropriate.
• •Intellectual-property and output-ownership terms are acceptable.
• •Exit, notice, data return and deletion terms are workable.
• •The contract does not rely on unverified roadmap commitments.

Final decision

• •Every must-have requirement has passed.
• •Weighted scores use the same criteria for every supplier.
• •Risks and mitigations are documented.
• •Procurement, security, legal and business owners have reviewed relevant evidence.
• •The preferred supplier offers the best supported fit, not merely the best presentation.
• •The decision and reasons are recorded for future review.

A failed must-have should not be hidden by a high overall percentage. Pause the decision until the requirement is met, changed deliberately or accepted as a documented risk.