How to evaluate an AI or LLM vendor

Unlike traditional software, the thing you bought can change without a release you control - a model is deprecated, retrained, or silently adjusted, and your outputs shift. Require contractual notice of model deprecation and material behaviour change, with a defined migration window and a tested fallback.

Two questions decide your exposure: will our inputs and outputs be used to train or improve your models, and do you indemnify us against claims that the model's training data infringes third-party rights? Get explicit, written answers. Use of customer data for training without authorisation is both a contractual and a GDPR issue.

An AI system can be 100% available and still wrong. Uptime SLAs don't capture output quality. Where it matters, negotiate acceptance thresholds on the metrics that fit your use case (precision, recall, latency, refusal rate) and a remedy when quality regresses.

Usage-based and agentic AI can run up cost fast. Require spend ceilings with auto-pause, per-tenant or per-workflow budgets, and alerting - the controls that prevent a runaway loop from becoming a runaway invoice.

On exit, what comes back? If you fine-tuned a model, do you get the weights or just lose them? Are embeddings and vector stores portable? Pin down data and artefact return for AI exactly as you would for any platform - the lock-in is subtler but just as real.

If you operate in or sell into the EU, the AI Act changes your obligations by risk tier. Confirm whether the system is high-risk, whether the vendor has completed any required conformity assessment, and whether they'll provide technical documentation and notice of changes that affect compliance. The EU's model contractual clauses for AI procurement are a useful baseline even outside the public sector.