Solutions · Buying AI

Close the gap between the vendor's terms and your requirements.

Every vendor says its AI is safe, reliable and compliant. For which use? AIQURIS works out what your deployment requires, puts the questions to the vendor, and shows where its terms fall short: gaps to negotiate into the contract, or controls you put in place yourself. You see what is missing before you sign.

For procurement, risk and the business owner, on one basis.

Vendor assessment · Provider B
AI analytics assistantAnswers management questions on sales data
YOU REQUIREVENDOR'S TERMSCLOSES THE GAP
Accuracy validated on questions like yoursBenchmarks on public datasets
NegotiateAgreed thresholds in the contract.
Notice before the model changesModels may change at any time
NegotiateA notice period in the contract.
Your data not used for trainingCustomer data not used for training
Covered
Answers traceable to the source dataNot addressed
Your controlFigures checked against the source before pricing decisions.
Gaps to negotiate into the contract, or controls you put in place yourself.
The challenge

The vendor's claims don't tell you what you need to know.

01

It depends on your deployment

The same AI assistant can be accurate for one team and wrong for the next, secure in one configuration and exposing data in another, compliant in one country and not in the next. How you configure it, which data it reaches and what you use it for decide.

02

AI cannot be fully specified

Unlike conventional software, an AI system's behaviour is not fully defined by its specification. No vendor can vouch for it in every use. Whether it is safe, reliable and compliant has to be established for yours.

03

Claims without consequence

A ticked box costs the vendor nothing. Once the contract is signed, your leverage is gone.

You carry the risk of the AI you deploy, whoever built it.

The difference

Not a questionnaire. An assessment of your deployment.

Generic vendor questionnaire
AIQURIS
The questions
A fixed list, the same for every product
Generated from your deployment's risks and the requirements that apply, each linked to its source
The answers
Yes or no, with no consequence
Specific answers and evidence, written into the contract where the vendor negotiates
Missing evidence
Often accepted as it is
Never treated as a requirement met. Less transparency means more uncertainty and additional controls
What is covered
The product, as described
The AI solution, how the vendor develops and governs it, and what stays with you
Your process
A separate AI questionnaire, filled in once
Feeds your existing supplier questionnaire and third-party risk process
The result
A completed form
Remaining (residual) risk against your risk appetite, open gaps, and who closes them

Derived from your deployment. Not from a checklist.

Example

Choosing a generative AI analytics provider.

An AI assistant that answers management questions from sales, pricing and forecast data. Three providers on the shortlist.

QUESTIONS PUT TO EVERY PROVIDER
How is access to commercially sensitive data, such as forecasts and pricing, restricted and monitored?Security
How has the system been tested against misleading or malformed questions, and with what results?Performance
How is your data kept out of the provider's model training, and where is that committed?Data protection
Who owns the generated insights, and how are they protected against third-party IP claims?Legal

Each answer requires evidence where it matters, and becomes part of the contract.

SHORTLIST, ON ONE BASIS
Provider A
18 met · 4 open
Provider B
15 met · 7 open
Provider CPREFERRED
20 met · 2 open
MetPartly metOpen24 requirements
OPEN GAPS FOR PROVIDER C
No evidence of robustness testing for this type of queryVendor closes
Log retention longer than your policy allowsVendor closes
No defined owner for wrong answers reaching managementYou close
No review step before insights inform pricing decisionsYou close
RECOMMENDATION Select, with conditions in the contract

A vendor assessment also shows what stays with you.

Traced, not templated

One risk, traced to the vendor and the contract.

Every question to the vendor exists because a risk of your deployment calls for it. That is the difference from a generic questionnaire.

RISKThe AI analytics assistant predicts wrong sales figures, and management sets prices on them
REQUIREMENT · SOURCEAccuracy validated for the intended use, against agreed thresholds · ISO/IEC 25059
QUESTIONHow has accuracy been tested on questions like ours, and with what results?
EVIDENCETest results on representative questions, against the agreed thresholds
OWNERThe vendor commits to the accuracy in the contract. You own the review before pricing decisions.

One of many chains a single assessment produces.

Accountability

Negotiate what you can. Control what you can't.

Where the vendor will negotiate, its answers go into the contract, and an answer that proves wrong becomes the vendor's problem, not your blind spot.

Where it won't, as with the largest providers, you know exactly which controls stay with you.

Built into procurement

From the tender to the renewal, on one set of requirements.

01

Before the tender

Put the AI requirements of your deployment into the RFP, so every bidder answers the same questions.

02

Selection

Every bidder assessed and compared on the same basis: what is met, what is open, and what it would take to close.

03

Contract

Gaps negotiated into the agreement, or assigned to your own controls where the vendor won't move.

04

Renewal and change

Reassess at renewal, or when the vendor changes its model or capabilities.

IEEE 3119-2025 Aligned with IEEE 3119, the standard for the procurement of AI and automated decision systems. The AIQURIS team contributed to its development.

Your supplier process stays. The AI requirements get specific.

What you get

Know what you are buying before you sign.

Vendor assessment is part of our full assessment (CONTROL+). Use it to compare providers before selection, or to assess the chosen one before roll-out. The decision stays with you, on a documented basis.

  • ✓Requirements for your deployment, each linked to its source
  • ✓A vendor questionnaire generated from them, ready for qualification or contract
  • ✓Every answer assessed: met, partly met or not met
  • ✓Remaining (residual) risk per risk domain, against your risk appetite
  • ✓Open gaps, split into what the vendor must close and what you own
  • ✓A recommendation: proceed, proceed with conditions, or not yet
  • ✓Reassessment when the vendor changes its model or capabilities, which can change your risk exposure
Start free

Your first impact screening (IMPACT+) is free.

Describe one AI deployment. See who could be affected, how badly, and how deep the assessment needs to go next. No sales call needed.

  • ✓Impact tier for your deployment
  • ✓Affected stakeholders and potential harms
  • ✓Where to go next, and how deep
  • ✓The deployment registered in your AI register
Start your free screening
Get started

Selecting an AI vendor, or about to roll one out? Assess it before you sign.

Bring the intended use, your shortlist and your decision date. In one call we scope the vendor questions, the evidence to request and the controls you will own.

New to AIQURIS? Start with an Assessment Sprint on one deployment.

Privacy Overview

We use cookies to operate our website, ensure its proper functioning, improve performance, analyse traffic, and support our marketing activities. Some cookies are strictly necessary and cannot be disabled. Others can be enabled or disabled below according to your preferences. For full details, please see our Privacy Policy.