How to Select an AI Vendor: A 6-Step Enterprise Evaluation Framework

Why AI Vendor Selection Is a High-Stakes Decision

Unlike SaaS tools that can be swapped in days, AI vendor relationships create deep technical and data dependencies. Migrating away from an entrenched AI vendor is a project in its own right — not a configuration change.

Gartner's March 2026 research on the AI-driven future of IT services vendor selection found that AI deployments expose hidden vendor risks that traditional procurement processes consistently miss.

Switching costs fall into three distinct categories that compound quickly:

• Technical: Data migration, API rewrites, and retraining any custom models built on the vendor's infrastructure.
• Operational: Workflow disruption and staff re-onboarding on a new system and interface.
• Strategic: Lost implementation time and delayed ROI — typically 4–6 months in our experience.

AI vendor marketing is particularly prone to capability inflation. Gartner's June 2025 analysis of AI agent solutions found that prebuilt capabilities vary widely and vendor claims consistently outpace actual delivery.

In our 100+ enterprise AI implementations since 2023, the most common cause of delayed ROI was inadequate vendor evaluation at the outset — not the technology itself. A structured evaluation process is not bureaucracy; it is risk management.

For context on why AI projects fail more broadly, see our analysis of why AI projects fail — vendor misalignment is the leading cause. Buyers who need to convert this scorecard into a scoped delivery engagement typically walk through our AI implementation services catalogue before running the RFP.

The Cost of Getting It Wrong

A failed AI vendor selection does not reset cleanly. The practical reversal timeline runs: re-issuing an RFP (2–4 weeks), re-running a proof-of-concept (4–6 weeks), contract renegotiation (2–3 weeks), and data migration (variable).

Total elapsed time for a full re-procurement is typically 4–6 months. That is 4–6 months of delayed value delivery, added to the time already spent on the failed evaluation.

• Re-procurement cost: Internal staff time for a full RFP and PoC cycle is substantial — typically involving IT, legal, procurement, and the business unit simultaneously.
• Staff disruption: Teams trained on a deprecated tool require full re-onboarding, not just a briefing.
• Opportunity cost: Competitors who selected correctly are 4–6 months ahead on implementation maturity and ROI.

The business case for investing in a proper evaluation process is straightforward: the cost of a rigorous 8–12 week evaluation is always less than the cost of a failed selection. If you are building an initial shortlist of named consultancies and systems integrators, our comparison of the best AI implementation partners 2026 covers delivery models, pricing tiers, and Everest/IDC analyst positioning for the ten largest providers.

Step 1 — Define Your Requirements Before Talking to Vendors

In short

Before issuing any RFP or taking vendor calls, document your use cases, success metrics, technical constraints, and budget range — vague requirements produce incomparable vendor proposals.

The most common evaluation failure is starting vendor conversations before internal requirements are clear. This produces proposals shaped by vendor strengths rather than business needs.

The Digital Supply Chain Institute's 2026 AI vendor checklist lists business alignment as the first evaluation dimension — AI must map to defined business goals before any technical assessment begins.

A complete requirements document has four mandatory components:

• Use case definition: Specific tasks the AI must perform — not "improve efficiency" but "process 500 invoices per day with a <0.5% error rate."
• Success metrics: Measurable outcomes with a baseline (e.g., reduce invoice processing time from 4 days to under 8 hours).
• Technical constraints: Existing stack, data residency requirements, and integration points — CRM, ERP, data warehouse.
• Budget range: Total cost of ownership, not just licence fees — factor in implementation, training, and ongoing maintenance.

Getting Internal Stakeholder Alignment First

Misaligned internal stakeholders are the second most common cause of failed AI vendor selections — after poor requirements. Circulate the requirements document to IT, legal, data privacy, finance, and the sponsoring business unit before any vendor contact.

Require written sign-off from all parties before the RFP is issued. This is not a formality — it prevents requirements from shifting mid-evaluation, which forces proposal re-scoring and delays.

The EU AI Act compliance checklist introduces obligations that legal and data privacy must review before any AI system is procured, particularly for high-risk use cases. For European enterprises, this sign-off is a compliance requirement, not optional governance hygiene.

Step 2 — Issue a Structured AI Vendor RFP

In short

An AI vendor RFP must go beyond standard IT procurement templates — it needs sections on model transparency, data handling, bias testing, and post-deployment support that generic RFPs omit.

A generic IT RFP template is insufficient for AI vendor evaluation. AI systems introduce specific questions around model provenance, training data, drift detection, and explainability that standard procurement processes do not capture.

Gartner's June 2025 guidance on AI agent vendor evaluation specifically calls out reasoning capability claims, autonomy boundaries, and human-in-the-loop controls as areas where vendor responses require structured challenge.

A complete AI vendor RFP must include 7 mandatory sections:

1. Company and financial stability overview — years in operation, funding status, customer base size, and employee count in AI/engineering.
2. Solution architecture and model transparency — foundation model vs. proprietary model, fine-tuning approach, and model update cadence.
3. Data handling — where is data stored, processed, and retained? Is customer data used for model training? Under what conditions?
4. Security and compliance certifications — ISO 27001, SOC 2 Type II, GDPR compliance documentation, and EU AI Act conformity assessment where applicable.
5. Integration capabilities and API documentation — REST/GraphQL API availability, webhook support, pre-built connectors, and rate limit terms.
6. Reference customers in your industry — minimum 3 references with contact details and deployment scale comparable to your use case.
7. Pricing structure — all tiers, overage costs, contractual escalation caps, and total cost of ownership over a 3-year horizon.

Questions That Challenge AI Vendor Claims

Vendor RFP responses are marketing documents unless you ask questions that require specific, verifiable answers. Include these challenge questions in every AI vendor RFP:

• What is the error rate for your system on tasks similar to our use case, measured on a held-out test set? Provide documentation.
• How does the system behave when confidence is low — does it escalate, abstain, or produce an answer anyway?
• What is the process when your underlying model is updated or deprecated? What notice period do customers receive?
• What bias testing has been conducted on the model? Provide the methodology and results.
• What is your documented SLA for P1 incidents, and what credits apply if it is missed?
• Describe your data deletion process at contract end — what is deleted, when, and how is it confirmed?

For a reusable template of these questions formatted for vendor distribution, see our AI consulting RFP template.

Setting a Realistic RFP Response Timeline

Allow vendors a minimum of 10 business days to respond to a structured AI RFP. Shorter timelines favour vendors with pre-packaged responses over those who will tailor answers to your requirements.

Require that all responses follow the same section structure. Non-conforming responses — where vendors substitute their own structure — are a red flag that the vendor is not engaging with your actual requirements.

Step 3 — Score Vendors Against 5 Core Criteria

In short

Score every vendor against the same 5-dimension framework: business fit, technical capability, security and compliance, commercial viability, and long-term support. Weighted scoring removes subjective bias from the selection decision.

Unstructured vendor evaluation defaults to the loudest internal advocate or the most impressive demo. A weighted scorecard forces objective comparison across dimensions that actually predict implementation success.

The Digital Supply Chain Institute's 2026 AI vendor criteria checklist identifies 5 evaluation dimensions. We have aligned our enterprise scorecard to these dimensions, adding specific sub-criteria developed across our 100+ implementations.

Adjust weights based on your organisation's specific risk profile. Heavily regulated industries — financial services, healthcare — should increase the Security & Compliance weight to 30% and reduce Business Fit accordingly.

How to Run the Scoring Process

Assign each evaluator a copy of the scorecard and score independently before convening. Independent scoring prevents groupthink and anchoring to the first reviewer's opinion.

• Evaluator panel: Include IT, legal, the sponsoring business unit, and a procurement representative — minimum 4 scorers.
• Score range: Use a 1–5 scale per sub-criterion. Require written justification for any score of 1 or 5 to prevent outlier inflation.
• Aggregation: Average scores per dimension, apply weights, sum to a 100-point total. The vendor with the highest weighted score advances to PoC.
• Minimum thresholds: Set a minimum score floor (e.g., no vendor scoring below 2.5 on Security advances regardless of total score). Non-negotiable compliance requirements cannot be traded off against other dimensions.

Before scoring vendors, make sure your enterprise AI strategy defines the weightings that reflect your strategic priorities. Our enterprise AI strategy framework provides a structured way to establish those priorities before vendor evaluation begins.

The Alice Labs Vendor Evaluation Framework — 12 Criteria with Weighted Scoring

In short

The Alice Labs 12-criteria enterprise AI vendor scoring rubric extends the 5-dimension baseline into an operational scorecard covering EU AI Act readiness, data residency, security certifications, model performance, 3-year TCO, integration surface, commercial terms, indemnification, roadmap alignment, exit portability, support SLA, and vendor stability — refined across 100+ implementations since 2023.

The 5-dimension scorecard above is the minimum viable evaluation. For deployments handling regulated data or exceeding €250,000 in 3-year TCO, we run a 12-criterion scorecard developed across 100+ Alice Labs implementations. Each criterion has a defined evidence requirement — a vendor cannot score above 3/5 without documented proof. Buyers who want us to run this scorecard for them engage our AI implementation consultant practice. The public canonical copy of this rubric lives at our AI vendor selection framework reference page.

Before applying the rubric, confirm the strategic scope with your AI strategy consulting lead — weighting decisions must reflect enterprise strategy, not procurement defaults.

RFP Checklist for Enterprise AI Training Data Vendors — 20 Items

In short

A rigorous RFP for enterprise AI training data vendors covers 20 items across data provenance, licensing scope, quality metrics, privacy and IP indemnification, security certification, and operational continuity. Use this checklist verbatim in the RFP body — vendors unable to answer any single item in writing should be disqualified.

Training data licensing is the highest-risk procurement decision in the AI stack — it determines model performance ceiling, IP exposure, and regulatory defensibility. The checklist below is the RFP body we send on client engagements at Alice Labs. Every item requires a written vendor answer with supporting documentation.

Data provenance and licensing (items 1–6)

1. Source disclosure: Name every upstream data source (public web domain, licensed publisher, synthetic pipeline, human-labelling vendor). No "proprietary aggregation" answers — buyers require named sources.
2. Chain of custody: Documented ingestion, transformation, and storage lineage for every dataset. Include cryptographic hashes of the delivered corpus.
3. Licensing scope: Perpetual vs term, exclusive vs non-exclusive, permitted derivatives (fine-tuning, distillation, evaluation only).
4. Permitted model uses: Explicit list — pre-training foundation models, task-specific fine-tuning, RLHF/DPO, evaluation only. Silent categories default to prohibited.
5. Downstream distribution rights: Whether models trained on this data may be commercially distributed, offered as SaaS, or embedded in customer products.
6. Synthetic data proportion: Disclosure of any synthetic data proportion above 5%, including the generation methodology and validator model.

Data quality and evaluation (items 7–11)

7. Quality metrics: Documented completeness, deduplication rate, label agreement statistics with sampling methodology.
8. Contamination testing: Whether the vendor has decontaminated against public benchmarks (MMLU, HumanEval, GSM8K, HELM) and holdout sets.
9. Bias assessment: Demographic representation analysis, methodology, and mitigation steps applied to the corpus.
10. Freshness and update cadence: Recency distribution, refresh schedule, and whether stale data is retired or reweighted.
11. Golden evaluation set: Vendor-provided held-out evaluation set with reference answers, or documented rejection of this practice with rationale.

Privacy, IP, and indemnification (items 12–16)

12. Copyright indemnification: Uncapped indemnification for copyright infringement claims arising from training on the licensed corpus.
13. Privacy indemnification: Cover for GDPR, CCPA, and analogous claims from PII inadvertently present in the corpus.
14. GDPR Article 30 records: Full processing records for any EU-sourced data, including lawful basis for processing.
15. Opt-out and takedown workflow: Contractual SLA for removing data at rights-holder request, with re-training or unlearning commitment where feasible.
16. Personal data handling: Documented PII redaction pipeline, validation methodology, and residual-PII rate estimate.

Security, operations, and continuity (items 17–20)

17. Security certifications: Current SOC 2 Type II and ISO 27001 reports; ISO 42001 preferred; penetration test within 12 months.
18. Audit rights: Annual right to audit the vendor's data-handling controls, plus emergency audit right after any reported incident.
19. Delivery format and portability: Standard machine-readable formats (Parquet, JSONL, WebDataset), no vendor-proprietary containers.
20. Business continuity and exit: Continued licence access for at least 12 months after vendor insolvency; escrow of the corpus and licensing contracts.

Step 4 — Run a Paid Proof-of-Concept on Your Own Data

In short

A paid PoC on your actual production data is the single highest-signal evaluation step. It reveals real capability, real integration complexity, and real performance — none of which a demo or RFP response can substitute.

Generic demos use vendor-curated datasets optimised to showcase the product. A PoC on your data reveals whether the system performs on the inputs, edge cases, and quality levels your organisation actually produces.

In our 100+ enterprise AI implementations, every case where a PoC was skipped to save time resulted in either a failed deployment or a costly mid-implementation scope change. The PoC is not optional.

How to Design a High-Signal PoC

A poorly designed PoC produces misleading results. Apply these four design principles to ensure the PoC is evaluative, not confirmatory:

1. Use real production data — including messy, incomplete, and edge-case examples. A curated "clean" dataset does not reflect production conditions.
2. Define success criteria before the PoC starts — agree with the vendor in writing on the exact metrics that will determine pass/fail. Metrics set after the fact can be gamed.
3. Include failure mode testing — deliberately submit inputs the system is likely to struggle with. How the system fails is as important as how it succeeds.
4. Measure integration reality, not just model performance — the PoC should require the vendor to connect to at least one of your live systems. Integration complexity surfaces at this stage, not in production.

PoC Duration and Scope

A meaningful AI PoC requires a minimum of 4 weeks. Two weeks is insufficient to surface integration issues, data quality problems, or model drift on realistic input volumes.

• Week 1–2: Environment setup, data ingestion, and initial model performance benchmarking.
• Week 3: Integration testing, edge case evaluation, and failure mode documentation.
• Week 4: Scorecard evaluation, vendor debrief, and go/no-go recommendation.

For context on how PoC findings feed into a broader implementation plan, see our AI implementation roadmap — the PoC output directly informs Phase 1 scoping.

Alice Labs practitioner team

Step 5 — Negotiate the Right Commercial and Legal Terms

In short

AI vendor contracts require non-standard clauses covering data residency, model versioning, SLA response times, and exit rights — generic MSAs from vendors omit protections that enterprise deployments require.

Most vendor-provided Master Service Agreements are written to protect the vendor. A properly negotiated AI contract shifts key risks and controls back to the enterprise.

For European enterprises, the EU AI Act compliance guide identifies specific contractual obligations that must be in place before deploying AI systems classified as high-risk. These are not optional clauses — they are legal requirements.

Mandatory Contract Clauses for AI Vendors

Every AI vendor contract must address these 8 areas. Missing any of them creates material risk that cannot be resolved without a contract amendment — which vendors resist post-signature.

• Data residency and sovereignty: Specify the exact geographic jurisdiction where data is stored and processed. Do not accept "EU region" without specifying the country and cloud provider.
• Data training restrictions: Explicit prohibition on using your data to train, fine-tune, or improve the vendor's shared models — unless you have explicitly consented.
• Model versioning and change notice: Require minimum 90-day advance notice before any model version change that may affect output quality or behaviour.
• SLA response times: Define P1 (critical), P2 (major), and P3 (minor) incident response times with financial credits for SLA breaches — not just "best efforts."
• Uptime guarantees: Minimum 99.5% monthly uptime for production systems. Planned maintenance windows must be pre-notified and excluded from SLA calculations with a defined cap.
• Audit rights: The right to audit security controls, data handling practices, and compliance certifications annually or following a security incident.
• Exit and data portability: Upon contract termination, you receive all your data in a standard, machine-readable format within 30 days. Vendor retains no copies beyond this period.
• Price escalation caps: Annual price increases capped at a defined percentage (typically CPI + 2–3%). Uncapped escalation clauses are a frequent source of vendor lock-in.

Reviewing the Full Pricing Structure

AI vendor pricing is frequently modular and usage-based. A low headline licence fee can escalate rapidly once usage overages, additional integrations, and support tiers are included.

• Request a 3-year total cost of ownership model from the vendor, not just Year 1.
• Clarify overage costs: what happens when you exceed the contracted usage tier by 20%? By 100%?
• Confirm which features require paid add-ons — audit logs, SSO, advanced analytics, and dedicated support are commonly excluded from base pricing.
• Benchmark the pricing model against at least one alternative vendor shortlisted from the RFP stage — this creates negotiation leverage.

Step 6 — Identify Red Flags That Disqualify a Vendor

In short

Specific vendor behaviours during the evaluation process reliably predict implementation failure. These red flags should trigger disqualification regardless of how strong the demo or pricing appears.

A vendor's behaviour during the sales and evaluation process is the most accurate predictor of their behaviour as an implementation partner. Dismissiveness, vagueness, or evasion at this stage does not improve after contract signature.

The following red flags, drawn from our experience across 100+ enterprise AI implementations, are disqualifying — not negotiable points to work through.

Assessing Vendor Financial Stability

An AI vendor that closes or pivots during your implementation creates a crisis: data migration, emergency re-procurement, and potential compliance gaps if the system handles regulated data.

• Request audited financial statements or funding documentation for any vendor that is not a publicly listed company or a subsidiary of one.
• Assess runway: For VC-backed vendors, ask about current runway and when the next funding round is planned. A vendor with less than 12 months of runway is a material risk for a multi-year implementation.
• Source code escrow: For mission-critical deployments, negotiate a source code escrow arrangement that releases the codebase to you in defined circumstances — vendor insolvency being the primary trigger.
• Customer concentration: A vendor where your contract represents more than 20% of revenue has an incentive to prioritise your needs — but also collapses disproportionately if your engagement ends.

For a broader view of how vendor risk fits into enterprise AI governance, our AI risk management framework covers vendor dependency as a specific risk category.

The 8–12 Week Enterprise AI Vendor Evaluation Timeline

In short

A properly structured enterprise AI vendor evaluation takes 8–12 weeks minimum. Processes shorter than 8 weeks consistently produce poor vendor selections because they cannot accommodate a meaningful PoC.

Compressed evaluation timelines are the single most common process failure in AI vendor selection. Internal pressure to move fast produces a selection that takes significantly longer to reverse.

Alice Labs recommends an 8-week minimum for straightforward use cases and up to 12 weeks for complex, multi-system deployments or regulated industry contexts. This is based on outcomes data across our 100+ enterprise implementations — not a conservative default.

When to Involve External AI Advisors

Organisations running their first enterprise AI vendor selection benefit significantly from external advisory support. Internal teams without prior AI procurement experience consistently underestimate the complexity of model transparency, data handling, and EU AI Act compliance requirements.

An experienced AI implementation partner can reduce the evaluation timeline without reducing rigour — because they bring pre-built scorecards, RFP templates, and reference data from prior evaluations. See our guide to how to choose an AI consultant for the selection criteria that apply to advisory partners specifically.

• First evaluation: External advisor recommended — the learning curve on AI-specific procurement is steep and the cost of mistakes is high.
• Regulated industry: External legal and compliance review of AI vendor contracts is mandatory, not optional, under the EU AI Act for high-risk deployments.
• Multi-vendor evaluation: If evaluating 4+ vendors simultaneously, an external coordinator prevents scope creep and keeps scoring consistent across evaluators.

Before You Select a Vendor: The Build vs. Buy Decision

In short

AI vendor selection assumes a 'buy' decision has been made. Before investing 8–12 weeks in vendor evaluation, confirm that buying rather than building is the right strategic choice for your use case.

Not every AI capability should be procured from an external vendor. For use cases where your data is the primary differentiator, building on open-source or foundation model infrastructure may deliver better long-term control and lower total cost.

Our detailed build vs. buy AI analysis covers the decision framework in full — including the cost crossover point where building becomes cheaper than a sustained vendor licence.

The conditions that favour buying from a vendor over building internally are:

• Commodity capability: The AI function is not a competitive differentiator — invoice processing, meeting transcription, document classification.
• Speed to value: A vendor solution can be deployed in weeks; an equivalent internal build would take 6–18 months.
• Internal capability gap: The organisation lacks ML engineering or MLOps capability to build, deploy, and maintain a custom model. For context on what MLOps entails, see our what is MLOps explainer.
• Regulatory requirements: A certified vendor solution reduces compliance burden compared to a custom-built system requiring independent conformity assessment.

The Open-Source Alternative

Open-source AI frameworks have matured significantly. For organisations with internal engineering capability, deploying on open-source infrastructure eliminates vendor lock-in and data residency risk entirely.

For a current comparison of open-source options, see our open-source AI agent frameworks comparison 2026. The trade-off is internal maintenance burden — open-source is not free; it is self-supported.

Frequently Asked Questions: AI Vendor Selection

In short

Common questions about how to select an AI vendor, what criteria matter most, and how long the process takes.

How long does AI vendor selection take for an enterprise?

A properly structured enterprise AI vendor evaluation takes 8–12 weeks minimum. This includes 1–2 weeks for requirements definition, 1 week for RFP issuance, 2 weeks for response review, 4 weeks for a paid PoC, and 2–3 weeks for contract negotiation. Processes shorter than 8 weeks consistently produce poor outcomes because they cannot accommodate a meaningful proof-of-concept.

What should be in an AI vendor RFP?

An AI vendor RFP must include 7 sections: company and financial stability overview, solution architecture and model transparency, data handling practices, security and compliance certifications, integration capabilities, reference customers in your industry, and full pricing structure including overages and escalation caps. Generic IT RFP templates miss the model transparency and data handling sections that are critical for AI evaluation.

What are the most important criteria for AI vendor evaluation?

The 5 core AI vendor evaluation dimensions are: business fit (25%), technical capability (25%), security and compliance (20%), commercial viability (20%), and long-term support (10%). Weights should be adjusted for your industry risk profile — regulated sectors such as financial services and healthcare should increase the security and compliance weight to 30%.

Do I need a proof-of-concept when selecting an AI vendor?

Yes — a paid PoC on your own production data is the single highest-signal evaluation step and should never be skipped. Generic demos use vendor-curated datasets. A PoC on your data reveals real model performance, real integration complexity, and real failure modes. Budget 4 weeks and €5,000–€20,000 depending on scope.

What contract terms must an AI vendor agreement include?

AI vendor contracts must explicitly address: data residency and sovereignty, prohibition on using your data for model training, model versioning and change notice (minimum 90 days), SLA response times with financial credits, uptime guarantees of at least 99.5%, audit rights, data portability and deletion at contract end, and annual price escalation caps. Vendor-provided MSAs routinely omit or weaken several of these protections.

How do I avoid AI vendor lock-in?

Vendor lock-in is driven by three mechanisms: proprietary data formats, custom model weights tied to the vendor's infrastructure, and non-standard APIs. Mitigate lock-in by requiring standard data export formats in the contract, maintaining your own data pipelines independently of the vendor, negotiating data portability terms upfront, and assessing open-source alternatives before committing to a proprietary platform.

How many AI vendors should I evaluate at once?

Issue your RFP to 4–6 vendors to ensure meaningful competition without creating an unmanageable evaluation workload. Shortlist 2–3 vendors for the scored evaluation stage based on RFP responses, then run a paid PoC with the top 2. Evaluating more than 3 vendors through a full PoC is rarely productive — the marginal information from a third PoC is low relative to the cost.

How does the EU AI Act affect AI vendor selection?

The EU AI Act (in force from 2024) introduces compliance obligations that affect vendor selection for European enterprises. For high-risk AI use cases, enterprises must ensure their vendor can provide conformity assessments, technical documentation, and human oversight controls before deployment. Legal and data privacy sign-off on the vendor contract is a compliance requirement — not optional governance. See our EU AI Act compliance checklist for a full breakdown of procurement obligations.

What are the biggest red flags when evaluating AI vendors?

Seven red flags that should trigger immediate disqualification or serious reassessment: inability to answer data training questions in writing, no industry-relevant reference customers, refusal to conduct a paid PoC, no documented model versioning policy, SLA terms defined as "best efforts" rather than hard commitments, financial instability with less than 12 months of runway, and compliance claims without supporting documentation.

How do you evaluate AI vendors?

Evaluate AI vendors against a 12-criterion weighted scorecard covering compliance (EU AI Act readiness, data residency, SOC 2 / ISO 27001), performance (benchmarks on your data, integration surface, 3-year TCO), commercial terms (pricing caps, indemnification, roadmap), and continuity (exit portability, support SLA, vendor stability). Score with written evidence, apply weights, require minimum floors on compliance and exit-portability criteria, then validate the top two with a paid proof-of-concept on production data. Budget 8–12 weeks end to end.

What is the best AI vendor evaluation framework?

The best framework is the one that combines an industry-standard baseline with enterprise-specific weightings. Alice Labs uses a 12-criterion rubric that extends the Digital Supply Chain Institute's 5-dimension checklist and aligns with Gartner's AI Magic Quadrant evaluation axes, Forrester's Wave scoring for AI platforms, and the NIST AI Risk Management Framework governance categories. The framework's value is not the criteria list but the discipline of requiring written evidence, minimum floors on non-negotiable criteria, and blind independent scoring by 4+ evaluators before consolidation.

What is the typical cost per user for enterprise AI?

Enterprise AI cost per user in 2026 ranges from €25/user/month for AI copilots (Microsoft 365 Copilot, Google Duet AI) to €80–€150/user/month for agentic workflow platforms (Glean, Writer, ServiceNow AI), with vertical AI platforms (Harvey for legal, Hippocratic AI for healthcare) reaching €300+/user/month. Inference-metered pricing (per million tokens) has replaced per-seat pricing for RAG and agent workloads — budget 3-year TCO on peak-plus-30% inference volume rather than average. Cache-hit rebates and reserved-capacity discounts typically reduce sticker price by 20–35% at negotiation.

SOC 2 vs ISO 27001 for AI vendors — which matters more?

Both matter for enterprise AI vendors, and they cover different scopes. SOC 2 Type II is an operational-controls audit (typically 6–12 month observation window) that evidences the vendor actually operates the controls it claims — favoured by North American buyers. ISO 27001 is a management-system certification that evidences the vendor has a functioning Information Security Management System — favoured by European buyers and increasingly required by procurement. For AI-specific governance, ISO 42001 (published Dec 2023) is now the emerging standard covering AI management systems. Require SOC 2 Type II or ISO 27001 as a floor, ISO 42001 as a differentiator, and a penetration test summary within 12 months.

Should we self-host or use SaaS for enterprise AI?

The self-host vs SaaS decision hinges on data sensitivity, workload predictability, and internal MLOps capability. Choose SaaS when the workload is bursty, the data is not regulated, and the organisation lacks a dedicated MLOps team — SaaS delivers faster time-to-value and lower operational burden. Choose self-hosted (VPC or on-prem) when data cannot leave a defined boundary (defence, banking, national healthcare), workload is steady-state at high volume (making per-token pricing uneconomic), or the organisation already runs GPU infrastructure. Many enterprises adopt a hybrid pattern: SaaS for common capabilities plus VPC or on-prem deployment of open-weight models for regulated workloads.

How do you score an AI vendor's security posture?

Score AI vendor security posture across seven evidenced factors: current SOC 2 Type II and ISO 27001 audit reports with no material exceptions (20 points); penetration test summary within the last 12 months (15 points); documented data-encryption at rest and in transit with key-management approach (15 points); model-training data-isolation guarantee in writing (15 points); incident response plan with named CISO contact and 24-hour breach notification SLA (10 points); evidence of DPIA and threat modelling for the AI product specifically (15 points); and public bug-bounty programme or coordinated disclosure policy (10 points). A vendor scoring below 60/100 fails the security floor regardless of total scorecard.

How do you avoid AI vendor lock-in in 2026?

Prevent AI vendor lock-in with five contract and architecture patterns: require MCP-compatible tool and retrieval interfaces (or a documented migration path); keep prompt libraries, evaluation sets, and RAG indices under your own version control rather than in vendor-managed stores; require the return of fine-tuned weights or adapters in a standard format on exit; keep data pipelines and identity (SSO, RBAC) independent of the vendor platform; and assess at least one open-weight model alternative during procurement to preserve the credible option of leaving.

What should an RFP for AI vendors contain in 2026?

An AI vendor RFP in 2026 must contain the 7 baseline sections (company overview, solution architecture and model transparency, data handling, security and compliance, integration, references, pricing) plus five 2026-specific extensions: EU AI Act GPAI conformity documentation (in force from 2 August 2026), MCP or equivalent tool-protocol support, token-metered pricing schedule with cache-hit rebate policy, ISO 42001 status or roadmap, and consolidation-risk continuity clauses (contractual guarantees if the vendor is acquired). See the AI vendor selection framework for the full template.