The demo was good. The team liked it. The price is within budget and the vendor wants a decision this month. Somewhere between that meeting and the signature there is a set of questions that, if nobody asks them, become expensive in year two rather than year one. They are not technical questions. Most of them are finance questions wearing technical clothes, which is why the finance director is the right person to ask them.
Key Takeaways
- The licence is usually the small number. Integration and internal staff time are the large ones, and neither appears on the quote.
- Exit cost is the most underpriced line in AI procurement. It is negotiable before signature and not afterwards.
- A low score on these questions is not a reason to walk away. It is a list of clauses to put in the contract.
- A vendor who will not answer in writing has told you something more useful than the answer would have.
- Score the product you are buying, not the company. Brand is not one of the questions, deliberately.
1. Where does our data physically go?
Most AI tools sold in this market process data outside the country. That is not automatically wrong. Not knowing is.
Ask for the country or region where data is stored and where it is processed, including any sub-processors, and ask to be told if that changes. Get it in writing. Uganda’s Data Protection and Privacy Act 2019 places conditions on the processing of personal data outside the country, and the obligation sits with your organisation rather than with the vendor.
A good answer names a region and appears in the contract. An acceptable answer appears in the documentation. A verbal assurance from a salesperson is not an answer, and neither is a privacy policy that describes the vendor’s website.
2. Is there a written data processing agreement, and has anyone read it?
A data processing agreement is the document that says what the vendor may and may not do with your data. It is not the privacy policy and it is not the terms of service. Ask for it, and then have someone actually read it before signature rather than after, because the questions it raises are the cheapest ones you will ever ask.
The three clauses to look for: whether your content may be used to improve the vendor’s systems, how long it is retained after deletion, and whether sub-processors can be added without your agreement.
3. Can a person override it on decisions that affect a person?
Credit, hiring, eligibility, discipline, grading, pricing. If the answer is no, the tool is a liability regardless of how accurate it is, because the question after an incident is not whether the system was right. It is who decided, and whether they can explain it.
The strong version of this answer is that a named person can review and reverse any output before it takes effect, and that the reversal is logged and reviewed. The weak version is that it is possible in theory. Ask which one is being sold.
4. Is there an audit trail we can access and export?
Without logs you cannot investigate an incident, and you cannot prove you did not do the thing you are accused of. Ask whether you can access a record of activity in your account, whether you can export it, and how long it is retained.
This question is boring until the first time somebody needs it, at which point it is the only question that matters.
5. If we leave in year two, what do we take with us?
This is the single most underpriced line in AI procurement and it is entirely negotiable before signature.
Ask what you can export, in what format, within what period, and at what cost. Ask what the vendor deletes and when. The answers range from “nothing, it all lives with us” to “data, configuration and documentation, exportable by you at any time”, and the difference between those two positions is worth more than a year of discount.
The reason this gets skipped is psychological. Nobody negotiating a new relationship wants to open with how it ends. Do it anyway, and do it early, because a vendor who is relaxed about exit at the proposal stage is telling you something real about how they intend to keep your business.
6. What is the total annual cost, including our own time?
Build the number yourself rather than accepting the quote as the answer:
| Line | Who usually forgets it |
|---|---|
| Licences and seats, per year | Nobody |
| Usage or metered charges | Frequently forgotten, and the line most likely to surprise you in month four |
| One-off integration and setup | Often quoted separately, sometimes not at all |
| Our own staff time, year one | Almost always omitted, and usually one of the two largest lines |
| Training | Cut first, which is why so many deployments are unused within a quarter |
| Verification time on outputs | Essentially never counted, and it directly reduces the saving being claimed |
Then ask the vendor which of their lines can increase without your agreement. Metered pricing is normal and not sinister, but a budget built on a licence figure alone will be wrong.
7. Is there support in our timezone, and can you name the person?
A ticket queue answered from another continent is not support when the system is down on a payday. Ask for named contacts and hours that overlap yours. If the honest answer is that support is elsewhere, that is workable, but it should shape what you use the system for rather than being discovered during the first outage.
8. Have you done this exact thing, for an organisation like ours?
A reference in another sector on another continent tells you the company exists. It does not tell you the thing works here, on data like yours, with staff like yours, on connections like yours.
Ask for a reference customer you can call, in a comparable setting. Then call them, and ask one question that vendors do not prepare people for: what surprised you.
9. Which model sits underneath, and what happens when it changes?
Most AI products are built on models the vendor does not own, and those models are updated. Silent changes alter outputs, quality drops, and nobody can explain why for several weeks because nobody knew a change had occurred.
Ask which model or models the service uses, and ask for a commitment to notify you before a change that could affect output quality. Vendors who take this seriously will say so. Vendors who describe it as proprietary are telling you that your quality is not under your control.
10. What does it cost us to find out this was the wrong choice?
The last question, and the one that reframes the other nine. If this does not work, what have we spent, what have we lost, and how long does it take to be free of it? An organisation that can answer that comfortably can afford to be wrong, which is the only sustainable position given how quickly this market moves.
How to use the answers
Send the questions by email rather than raising them in a meeting, and send them as questions rather than as objections. A vendor who answers all ten in writing has just improved your contract for free. A vendor who deflects has given you the most useful data point in the process.
Then turn every weak answer into a clause. Data location named. Export rights and format. Log access and retention. Change notice on the underlying model. Named support contact. None of that is unusual and most vendors will agree to it in writing when someone finally asks.
Keep the completed sheet with the signed contract. In two years, when something breaks or when the person who ran the procurement has moved on, it will be the only record of what you were told.
A closing note on scoring the product rather than the company
A large, reputable vendor can still sell you a product with no export path and no audit trail. A small local supplier can score higher on everything that actually matters to your organisation. Brand deliberately does not appear in these ten questions, because brand answers a different question: whether the company will still exist. That is worth knowing too, but it is not a substitute for any of the above.