Procurement in practice: ten questions and five clauses before you sign an AI contract

The demo is not the product. Every AI vendor demonstration is built on a clean example, a cooperative dataset and a presenter who knows where the tool is strongest. The contract governs what happens on an ordinary Tuesday eight months later, when the data is messy, the model has been updated and the person who championed the purchase has left.

Most mission-driven organisations have no technology procurement specialist and no in-house counsel who has read an AI addendum. They sign the standard terms, because the alternative looks impossible. It is not. A short, disciplined screen improves your position substantially: ten questions asked before selection and five clauses checked before signature.

Procurement is the last moment at which your organisation has leverage, so it is the cheapest moment to ask the awkward question.

The Ten-and-Five Screen

The questions test the vendor before you commit time. The clauses protect you after you commit money. Neither requires a lawyer to run, although a lawyer should review the final text where the data is sensitive.

Ten questions to ask before selection

Two under each of five headings, so the screen fits on one page.

• Data. What data does the tool receive, store and process, and where? Is any of it used to train or improve models, and can that be switched off in writing?
• Performance. On what evidence does the vendor claim it works for organisations like yours, and can you test it on your own awkward documents before signing? Who has reproduced the vendor's results?
• Change. How are you notified when the model, features or terms change, and can you hold a version stable for a defined period? What is the vendor's record of changes that broke customer workflows?
• Economics. What does the total cost look like beyond the licence, including usage-based charges, overage, support tiers and the staff time you will spend on verification? What happens to the price at renewal?
• Exit. How do you export your data and configurations in a usable form, and how is deletion confirmed? Who else could take over if the vendor withdrew the product?

Two deserve emphasis. Testing on your own documents is the most revealing step in selection, because vendors confident in their product welcome it and vendors who are not tend to find reasons to postpone it. And the question about cost beyond the licence connects to what a task costs once retries, checking and rework are counted.

A vendor's willingness to be tested on your documents is itself a piece of evidence.

Five clauses to check before signature

Standard terms are written for the vendor's convenience. These five are worth reading line by line and, where possible, negotiating.

• Data use and training. Your inputs and outputs are not used to train or improve models without your explicit consent, and human review of your content by the vendor is limited and defined.
• Location, sub-processors and jurisdiction. The contract lists where data is processed and stored, which sub-processors are involved, and how you are told about changes. This is the written form of the Location and Jurisdiction questions in a sovereignty assessment.
• Change notification. Advance notice of material changes to models, features, pricing and terms, with a right to object or exit without penalty if a change is unacceptable.
• Evidence and audit. Security and compliance documentation on request, incident notification within a defined period, and support for your own record-keeping obligations to funders and regulators.
• Exit and deletion. Export in a usable format, deletion within a stated period after termination, and written confirmation that deletion has occurred.

If a vendor will not move on any of the five, that is information. Record which ones they refused and weigh the tool accordingly, rather than discovering the gap in an incident review.

Where small organisations lose leverage

• Purchases that bypass procurement. A department buys with a credit card and a click-through licence. The fix is a simple rule: any tool that will touch organisational data goes through the screen, whatever its price.
• The pilot that becomes the contract. A free trial quietly converts into an annual commitment before the awkward questions are asked. Set a decision date for every pilot and finish the screen before it ends.
• Relying on the vendor's documents as the whole record. Keep your own file: the answers you received, who gave them and when.

Organisations that belong to a network, consortium or umbrella body can share screen results and negotiate common terms, which turns ten small buyers into one credible customer.

What good looks like

A completed screen fits on two pages: ten questions with dated answers marked confirmed, assumed or unknown, and five clauses marked agreed, negotiated or refused. A named owner signs it off, it is stored with the contract, and it is reviewed at renewal. That file is the kind of artefact an auditor or funder will value.

Questions for your next leadership meeting

• How many AI tools handling organisational data were bought without any review, and who could tell us?
• For our three largest AI contracts, which of the five clauses do we actually have?
• Do we set a decision date for every pilot, so that trials do not turn into contracts by default?

The bottom line

Before signing any AI contract, ask ten questions before selection and check five clauses before signature, and keep the two-page record, because procurement is the last moment you have leverage.

Your next step

Take your three largest AI contracts and mark each of the five clauses as present, absent or unknown. Raise the gaps at the next renewal, and put a decision date on every running pilot.

Sources

No external statistics cited. The Ten-and-Five Screen is a framework proposed by M.A.I. Consulting. The sovereignty cross-reference draws on the Four Locks framework from the same series.