Tools · Governance starter set · 2 of 3
Twelve questions before you sign with an AI vendor.
Every AI vendor has a data page and most of them are reassuring. This scorecard turns the page into twelve answers you can compare, scored so that two people in the business reach the same conclusion, and it names the four answers that should stop a purchase on their own.
ScorecardReviewed 4 September 2026Score each 0, 1 or 2No email asked for
01
How to score
For each question: 2 if the vendor answers clearly in writing and the answer is acceptable; 1 if the answer is acceptable but only given verbally or is vague; 0 if the answer is unacceptable or the vendor will not say. Total out of 24. Under 14, do not proceed. Any zero on a starred question stops the purchase regardless of total.
02
Data
| Question | Acceptable answer |
|---|---|
| 1 ★ Where are prompts and uploads stored, in which country? | Named country; Australia or a jurisdiction your clients would accept |
| 2 ★ Are prompts or outputs used to train the vendor’s models? | No, in writing, for your plan |
| 3 How long is data retained after the session, and can you set it? | Days not years; configurable |
| 4 Can you delete everything on request, and how is deletion confirmed? | Yes, within a stated period, with confirmation |
| 5 Who at the vendor can read your data, and under what process? | Named roles, logged access, on request only |
1 ★ Where are prompts and uploads stored, in which country?
Acceptable answer
Named country; Australia or a jurisdiction your clients would accept
2 ★ Are prompts or outputs used to train the vendor’s models?
Acceptable answer
No, in writing, for your plan
3 How long is data retained after the session, and can you set it?
Acceptable answer
Days not years; configurable
4 Can you delete everything on request, and how is deletion confirmed?
Acceptable answer
Yes, within a stated period, with confirmation
5 Who at the vendor can read your data, and under what process?
Acceptable answer
Named roles, logged access, on request only
03
Control
| Question | Acceptable answer |
|---|---|
| 6 ★ Can the tool act on your systems (send, write, delete), and can that be switched off per user? | Yes, granular, off by default |
| 7 Is there an audit log of what the tool did, exportable by you? | Yes, exportable, retained |
| 8 What happens when the model changes underneath you? | Notice given, versions pinned or a changelog |
| 9 Can you set what the tool is allowed to read? | Yes, by folder, system or label |
6 ★ Can the tool act on your systems (send, write, delete), and can that be switched off per user?
Acceptable answer
Yes, granular, off by default
7 Is there an audit log of what the tool did, exportable by you?
Acceptable answer
Yes, exportable, retained
8 What happens when the model changes underneath you?
Acceptable answer
Notice given, versions pinned or a changelog
9 Can you set what the tool is allowed to read?
Acceptable answer
Yes, by folder, system or label
04
Commercial
| Question | Acceptable answer |
|---|---|
| 10 ★ Who owns the outputs, the prompts and any configuration you build? | You do, in the contract |
| 11 What does exit look like: export format, notice period, what survives? | Export in a standard format; nothing lost; notice under 60 days |
| 12 What is the total cost at your likely usage, including per seat and per token charges? | A written estimate at your numbers, not the pricing page |
10 ★ Who owns the outputs, the prompts and any configuration you build?
Acceptable answer
You do, in the contract
11 What does exit look like: export format, notice period, what survives?
Acceptable answer
Export in a standard format; nothing lost; notice under 60 days
12 What is the total cost at your likely usage, including per seat and per token charges?
Acceptable answer
A written estimate at your numbers, not the pricing page
05
Reading the score
- 20 to 24: proceed, and file the answers with the contract
- 14 to 19: proceed only if every starred question scored 2, and revisit in six months
- Under 14, or any starred zero: do not proceed; ask the vendor to answer in writing and score again
Want the answers read by someone who has signed a few of these?
The IT and digital spend review reads every vendor line you already pay for, with the same questions, and says which to keep.