Procurement Red Flags When Buying AI Tools

Ask the vendor to explain, in plain terms, how the product actually learns and improves. I have seen SMEs pay AI-tier prices for what is, underneath, a set of if-then rules built a decade ago and rebranded. If the answer comes back full of jargon and no substance, that is your answer.

Ask where the benchmark numbers in the deck come from. A statistic with no primary source behind it, dressed up with a logo from a trade press feature, is marketing, not evidence. If a number matters to your decision, insist it gets written into the contract as a representation, not left sitting in a slide nobody can hold the vendor to.

Ask what happens when you want a pilot. Two weeks, your own data, a fixed and reasonable cost. A vendor confident in their product agrees to this without a fight. A vendor who refuses, or who wants full contract value for a trial, is protecting themselves from what a real test would show you.

Standard SaaS contracts were not built for AI. Clauses on data ownership, liability and audit rights assume a static product. An AI tool does not stay static; the model gets retrained, updated, sometimes replaced entirely, and your contract needs to say what happens when it does.

Check data portability first. Can you get your data out in a usable format if you leave, or does the contract only promise reasonable efforts? Reasonable efforts clauses have cost SMEs weeks of unpaid consultancy time during a forced migration.

Check what happens if the vendor deprecates the model you originally bought. Some contracts let a vendor swap the underlying model with no notice and no credit for any drop in performance. Others require notice and a proportional refund if the replacement underperforms. Know which one you are signing before you need to find out the hard way.

Check the sub-processor clause. Many AI vendors route your data through third-party infrastructure and model providers you have never heard of. If the contract lets them add sub-processors without your consent, your data protection obligations become someone else's decision, not yours.

Ask directly: is our data used to train your models for other clients? If the answer is anything other than a clear no, or a clear opt-out you control, treat that as a live risk to your IP and your customers' data, not a technicality to sort out later.

Ask for the SOC 2 report, or equivalent, and the data processing agreement at the point of the first serious conversation. If the answer is 'we are working on it' or 'we can send that after signature,' you are being asked to sign first and find out what you agreed to second. Do not.

Ask how the vendor handles prompt injection and adversarial inputs, especially if the tool will touch customer-facing systems. Most vendors have never been asked this. Their answer, or their silence, tells you how seriously they take security once you are past the marketing page.

Before you shortlist a vendor, write down the three or four things that would make you walk away, and hold every vendor to them the same way. Do not let a good demo lower your standard for the contract.

Put your procurement lead, or a lawyer who understands data contracts, in the room before signature, not after a problem surfaces. The cost of an hour's contract review is smaller than the cost of an unplanned migration eighteen months in.

If you want a working checklist to run your next AI purchase against, use our procurement resource for this. It is the difference between finding a lock-in clause now, or finding it the day you try to leave.