AI supplier question sheet
Ten questions to take to any supplier meeting, with space to write the answers and a note on what a good and a worrying answer sounds like.
Print this, take it to the meeting, and write the answers down. A sales call is not a contract, and you will not remember which of three suppliers said what.
The reasoning behind each question is in questions to ask an AI supplier. That guide has nine; this sheet splits training and human review into two, because suppliers routinely answer the first and skip the second.
Supplier: [NAME] Product: [NAME] Plan quoted: [PLAN]
Who we spoke to: [NAME AND ROLE] Date: [DATE]
1. Where is our data held?
Good: a named country or region, and whether UK residency is available and on which plan. Worrying: “in the cloud”, “on secure servers”.
[ANSWER]
2. Do you use our data to train your models?
Ask about the exact plan you are buying. Consumer and business plans usually differ completely.
[ANSWER]
3. Can any human at your company read our data?
This is a different question from training, and suppliers often answer only the first. Some do not train on your data but allow staff or contractors to review it for abuse monitoring.
[ANSWER]
4. Will you sign a data processing agreement, and can I see it now?
Good: yes, here it is, or it is built into our commercial terms. Worrying: “we can look at that at contract stage” — you are being asked to trial with real data before the contract exists.
[ANSWER] Copy received? [YES / NO]
5. What certifications do you hold, and which products do they cover?
The scope is the important half. Certifications often cover only the business tier. Ask about UK Cyber Essentials specifically.
[ANSWER]
6. Can you help with our DSPT return?
Good: they know what it is and have done it before. Worrying: “what’s that?” — not disqualifying, but it tells you how much of the explaining will fall to you.
[ANSWER]
7. Is your product “CQC approved”?
There is no such thing. CQC says it does not assess or approve specific technologies. Good: “no, CQC doesn’t approve tools — here’s how we help you meet the regulations”. Worrying: “yes”.
[ANSWER]
8. What happens when it gets something wrong?
Ask what the tool is bad at. A supplier who cannot name a single weakness has either not looked or will not say.
[ANSWER]
9. What does it cost, fully?
Does the price include VAT? Does it need another licence underneath? What is the minimum term? What does integration cost?
[ANSWER]
10. Who else in social care uses this, and can I speak to them?
Ask for reference sites of roughly your size and type. A large council team is a different setting from a twelve-person domiciliary service.
[ANSWER]
After the meeting
- Got the important answers in writing, not just verbally
- Data processing agreement received and read
- Answers copied into our DPIA
- Noted today’s date — supplier terms change
- Compared against the same questions asked of [OTHER SUPPLIER]
Our decision: [PROCEED TO TRIAL / DO NOT PROCEED / ASK AGAIN]
Why: [REASON — write this down while it is fresh]
Decided by: [NAME] Date: [DATE]