A composite scenario assembled from documented cases: The operations director of a 38-person specialty clinic network in central Massachusetts signs a $14,400 annual order form for an "AI-powered" intake and call-summary platform. During the demo, the account executive flashes a SOC 2 Type II badge, claims "99% clinical accuracy," and promises the vendor never trains on customer data. Four months later, three gaps surface in one week. A nurse catches an invented medication allergy in a call summary, yet nobody can verify what the patient said because the vendor deletes raw audio 60 seconds after transcription. Structured intake fields arrive broken because the vendor quietly swapped its underlying foundation model for a cheaper open-weight model overnight. And when counsel pulls the click-through terms, the vendor's downstream AI subprocessor keeps prompts for 30 days under default abuse-monitoring rules, while total vendor liability is capped at three months of fees: $3,600.
The right questions to ask an AI vendor test five contract surfaces before you sign an annual order form: denominator-transparent accuracy benchmarks, exportable audit logs and source retention, zero-data-retention flow-downs across every AI subprocessor, 30-day advance notice of foundation-model or system-prompt changes, and liability carve-outs above standard 12-month fee caps. Below, you get all 15 questions paired with green-flag and red-flag answers in the ed.cafe 15-Question AI Vendor Scorecard.
Most ranking pages on evaluating AI vendors are written by AI vendors pitching features like their own. Small-team buyers at 10-to-500 person firms, clinics, and nonprofits need neutral contract math instead. Our guide sits inside the safe use of AI tools at work hub as general operational procurement guidance, not legal advice.
In IBM's 2026 Cost of a Data Breach report (Ponemon study of n = 602 breached organizations, IBM Newsroom, July 29, 2026), over 20% of surveyed organizations suffered breaches targeting AI apps, with compromised APIs and plug-ins causing 27% of those AI incidents. Meanwhile, in LangChain's State of Agent Engineering survey (n = 1,340 practitioners, LangChain, June 2026), only 52.4% of surveyed teams ran offline evaluations before shipping. Polished demos do not prove vendor testing.
Why standard SaaS security questionnaires miss how AI vendors break
Standard SaaS vendor questionnaires miss AI risk because infrastructure badges like SOC 2 Type II audit server locks while ignoring probabilistic errors, silent model swaps, and upstream API chains. Neither SOC 2 nor ISO 27001 verifies whether a tool invents refund rules, erases source audio needed to audit mistakes, or forwards customer files to a model lab that stores prompts for 30 days.
Buying an AI tool with a 2021 IT security checklist is like buying a commercial delivery van by checking only the door locks while skipping the brakes and black-box recorder. Where that physical analogy breaks down is post-sale mutability. Once a van parks in your lot, the manufacturer cannot sneak in at 2:00 a.m. and swap a six-cylinder engine for a lawnmower motor to cut fuel costs. An AI wrapper vendor can swap its backend model API in four lines of code on Sunday night, shifting error rates across your staff by Monday morning.
Three documented patterns show why buyers absorb the blast radius:
- Connector exposure: Stolen OAuth tokens from the Salesloft Drift AI integration exposed Salesforce data at 700+ firms (Help Net Security, September 2, 2025), and an Asana MCP bug exposed data across ~1,000 organizations (BleepingComputer, June 2025).
- Thin builder evals: Researchers at UC Berkeley, UIUC, Stanford, and IBM (n = 86 production systems, arXiv, February 2026) found 75% of case studies in the sample evaluated quality without formal benchmark sets.
- Buyer attribution: Enforcers knock on the deployer's door first, from Mobley v. Workday, Inc. (Clearinghouse) to the Massachusetts AG's $2.5M AI settlement with Earnest (Mass.gov, July 10, 2025).
Questions 1 to 3: How to test vendor accuracy claims and error consequences
An AI vendor's accuracy percentage means nothing without the sample denominator, grading rubric, and fabrication rate. Counsel urge buyers to measure errors by consequence, not average accuracy (Jones Walker LLP, October 7, 2026).
- Q1 (Denominator & rubric): Ask for
n, task type, and hallucination breakdown. In a UC Davis audit of n = 356 clinical notes (JMIR Med Inform, 2026), 11.5% of notes in the study held hallucinations; a NeurIPS 2026 audit of n = 565 scribe notes (NeurIPS 2026) found verified failures in 31.3% of audited records. - Q2 (Abstention rate): Ask what percentage of benchmark prompts abstain cleanly when facts are missing from uploaded files.
- Q3 (50-row ZDR pilot): Require a 14-day synthetic trial before annual lock-in, using our 50-example spreadsheet method.
Questions 4 to 9: Audit logs, source retention, training rights, and ZDR subprocessors
If an AI tool deletes source inputs before verification or skips Zero Data Retention (ZDR) on upstream model APIs, your team cannot audit errors or prove privacy compliance.
First, reject "privacy by instant deletion." An AP hospital investigation (AP via KMPH, October 2024) cited Koenecke et al.'s finding that OpenAI's Whisper invented unspoken text in ~1% of tested audio segments, with 38% of hallucinations in that study carrying explicit harms (arXiv:2402.08021). When one vendor erased raw audio immediately, doctors lost ground truth to verify invented symptoms. Require a 14-to-30 day review window before auto-purge, plus CSV/JSON log export.
Second, close 30-day subprocessor logs. Startups wrapping OpenAI, Anthropic, or Bedrock APIs can say "We never train" while upstream APIs keep prompts for 30 days unless ZDR endpoints are active; compare plan tiers in our personal versus work AI accounts guide. Lock down Q4 (free CSV/JSON prompt/chunk/model/output log export), Q5 (configurable source retention + legal hold), Q6 (no training/router tuning on inputs, outputs, or clicks), Q7 (named AI subprocessors with 0-day ZDR endpoints), Q8 (per-tenant vector isolation + real-time user ACLs), and Q9 (<=30-day exit purge certificate).
Questions 10 to 12: Silent model swaps, prompt changes, and 30-day notice clauses
Per-token costs tempt SaaS vendors to swap or quantize models silently, and even frontier updates regress: OpenAI documented a GPT-4o sycophancy regression in May 2025 (OpenAI), and Anthropic detailed Claude Code runtime/prompt regressions on April 23, 2026 (Anthropic). Pair our 10-prompt canary set with Q10 (30-day written notice before model-family, quantization, or source swaps), Q11 (dated changelog + 30-day version pinning), and Q12 (pro-rata refund exit if an unfixed update drops your pilot pass rate >10 points).
Questions 13 to 15: Indemnities, liability caps, and regulatory cooperation
Standard SaaS terms cap vendor liability at 3 to 12 months of fees. On a 30-seat, $25/month contract ($9,000/yr ACV), a 6-month cap pays $4,500 max. If a vendor subprocessor leak exposes 201 CMR 17.00 data on 250 Massachusetts clients, forensics, credit monitoring ($37,500), and counsel ($35,000) hit $72,500+, leaving $68,000 uncovered (93.8% of the loss in this scenario), especially where ISO AI exclusions (CG 40 47, IIABA) apply; check our CG 40 47 renewal guide. Require Q13 (>=$250k or 3x-ACV super-cap on DPA, confidentiality, and training breaches), Q14 (output IP indemnity covering edited prompts), and Q15 (10-day audit/notice cooperation under laws like Colorado SB 26-189, Legal 500).
Side-by-side table: All 15 vendor questions with green-flag vs red-flag sales answers
Use the ed.cafe 15-Question Vendor Decoder live during sales demos to separate contract commitments from pitch polish:
| # | Check | Green-flag answer (verifiable) | Red-flag sales dodge (walk or escalate) |
|---|---|---|---|
| 1 | Eval denominator. | Shares written report naming n, task rubric, and failure breakdown. | "We are 99% accurate out of the box across every industry." |
| 2 | Abstention rate. | Shows clean refusal rate when facts are missing from uploaded docs. | "Our AI always gives a complete answer to every question." |
| 3 | 50-row pilot. | Grants 14-day sandbox under signed ZDR addendum before annual lock-in. | "Sign the 12-month order form first; Customer Success tunes it." |
| 4 | Audit log export. | Self-serve CSV/JSON export of prompts, chunks, model IDs, and outputs. | "Logs require our Enterprise Plus add-on (+$18,000/yr)." |
| 5 | Source retention. | Admin sets source retention (14-30 days) for verification + legal hold. | "For privacy, we delete raw audio in 30 seconds automatically." |
| 6 | Training ban. | DPA bars training, fine-tuning, and router tuning on inputs, outputs, clicks. | "We only use anonymized telemetry to improve model quality." |
| 7 | ZDR subprocessors. | Named subprocessors + active 0-day Zero Data Retention API endpoints. | "Standard OpenAI/Anthropic APIs don't train." (Leaves 30-day logs.) |
| 8 | RAG isolation. | Per-tenant namespaces + real-time user ACL permission checks. | "Data sits in one bucket protected by our system prompt." |
| 9 | Exit purge SLA. | Purges prompts, vectors, and backups <= 30 days with signed certificate. | "Delete workspaces in the UI; backups age out eventually." |
| 10 | 30-day swap notice. | Commits to 30-day written notice before model-family or source swaps. | "Our router silently swaps models hourly to save cost." |
| 11 | Version pinning. | Publishes dated changelog + allows 30-day workspace version pinning. | "All accounts run on one continuous stream; no model IDs." |
| 12 | Regression exit. | Pro-rata refund exit if unfixed update drops pilot pass rate > 10 pts. | "Outputs are 'AS IS' with zero performance remedies." |
| 13 | Liability super-cap. | >= $250k or 3x-5x super-cap on DPA, confidentiality, and training breaches. | "Total cap for all claims including breaches is 3 months' fees." |
| 14 | Output IP indemnity. | Covers third-party IP claims on outputs in normal documented use. | "Void if a user modifies a preset prompt or uploads files." |
| 15 | Regulator help. | Delivers audit, bias, and notice records within 10 business days. | "Regulatory compliance is 100% Customer's sole responsibility." |
Match your contract floor to spend and data tier:
| Spend & data sensitivity | Minimum pass score | Mandatory contract riders before signing |
|---|---|---|
| <$5,000/yr, Green public/synthetic data. | >= 18 / 30 (monthly billing). | Q6 (no training) + Q9 (30-day exit purge). |
| $5,000-$25,000/yr, Yellow internal files. | >= 22 / 30 + 50-row pilot pass. | Q4 (logs), Q6-Q8 (ZDR + ACLs), Q10 (swap notice), Q13 ($250k DPA cap). |
| Any spend touching Red PII, HR, or PHI. | >= 26 / 30 + BAA / WISP DPA. | All 15 items, including Q5 (verification window), Q7 (0-day ZDR), Q12, Q13, Q15. |
Copy and score: The ed.cafe 15-Question AI Vendor Scorecard & Red-Flag Decoder
Copy the ed.cafe 15-Question AI Vendor Scorecard into your procurement folder and paste Section B into order-form emails before signing.
--------------------------------------------------------------------
THE ED.CAFE 15-QUESTION AI VENDOR SCORECARD & ORDER-FORM RIDER
Vendor / Product: ______________________ Annual Spend: $___________
Data Tier: [ ] Green (Public) [ ] Yellow (Internal) [ ] Red (PII/HR/PHI)
Evaluator & Date: ______________________ 50-Row Pilot: ____________
--------------------------------------------------------------------
SECTION A: SCORE (0 = Refused | 1 = Hedged | 2 = In Contract/Docs)
*AUTO-HOLD: Any "0" on Q6, Q7, Q8, or Q13 for Yellow/Red = DO NOT SIGN.*
[__/2] Q1. Benchmark sample size (n), task rubric, and failure rates.
[__/2] Q2. Clean abstention rate when facts are missing from sources.
[__/2] Q3. 14-day sandbox pilot under ZDR before annual lock-in.
[__/2] Q4. Self-serve CSV/JSON export of prompts, chunks, model, output.
[__/2] Q5. Source audio/docs kept for review; auto-purge + legal hold.
[__/2] Q6. Bars training and router tuning on inputs, outputs, clicks.
[__/2] Q7. Names all AI subprocessors + enforces 0-day ZDR endpoints.
[__/2] Q8. Per-tenant vector isolation + real-time user file ACLs.
[__/2] Q9. Purges prompts, vectors, backups <= 30 days with certificate.
[__/2] Q10. >= 30 days written notice before model or source swaps.
[__/2] Q11. Dated changelog + 30-day workspace model version pinning.
[__/2] Q12. Pro-rata refund exit if unfixed update drops pilot > 10 pts.
[__/2] Q13. >= $250k or 3x-ACV super-cap on DPA, secrecy & training.
[__/2] Q14. Third-party IP indemnity on outputs in documented use.
[__/2] Q15. Regulatory/bias/notice records delivered <= 10 business days.
TOTAL: [__/30] -> 26-30: Red/Yellow | 22-25: Yellow | 18-21: Green | <18: REJECT
--------------------------------------------------------------------
SECTION B: COPY-PASTE ORDER FORM RIDER (SEND BEFORE SIGNING)
"Notwithstanding anything to the contrary in the Agreement: (1) No Training
& ZDR: Vendor and subprocessors shall not use Customer Inputs, Outputs, or
feedback to train, fine-tune, or evaluate shared models, and shall process
Customer Data solely via Zero Data Retention (0-day) subprocessor endpoints;
(2) Logs & Notice: Customer may export prompt/output logs in CSV/JSON at no
extra fee, and Vendor shall give 30 days' written notice before changing the
foundation model family; (3) Regression Exit: If a Vendor update drops pass
rates on Customer's acceptance set by >10 percentage points and is uncured
after 15 business days, Customer may terminate for a pro-rata refund of
prepaid fees; (4) Super-Cap: Breaches of Section (1), the DPA, or secrecy
carry a cap of the greater of 3x annual fees or $250,000."
--------------------------------------------------------------------Where this stops being true
The 15-question buyer framework above fits 10-to-500 person organizations buying commercial SaaS tools, and four boundaries change the rules:
- Self-serve $25/month plans: Vendors rarely redline contracts under $5,000/yr. Verify no-training and ZDR in the published Business DPA, restrict Red data, and stay on monthly billing.
- HIPAA, FERPA,
42 CFR Part 2, and201 CMR 17.00: Patient charts, substance-use files, student records, or Massachusetts SSN/financial data require a signed HIPAA BAA, statutory privacy terms, or a WISP addendum vetted by counsel. - Regulated hiring or EU systems: Hiring tools in Illinois (
HB 3773), Colorado (SB 26-189), NYC (LL144), or California (FEHA ADS), and outputs used in the EU (Reg. (EU) 2026/1744), carry non-waivable statutory duties. - Operational guidance, not legal advice: Research by
ed.cafeeditors at No Worker Left Behind is general procurement education; have counsel review high-exposure contracts. Pull free team materials in the ed.cafe Staff Room.
Questions people ask
What are the most important questions to ask an AI vendor before buying?
Start with five non-negotiables: (1) the sample size and failure breakdown behind accuracy claims, (2) whether full prompt-and-output audit logs export in CSV or JSON, (3) whether Zero Data Retention flows down to every upstream model API subprocessor, (4) whether you get 30 days' written notice before backend model swaps, and (5) whether confidentiality and unauthorized-training breaches sit above a 12-month fee cap.
Is a SOC 2 Type II report enough to prove an AI vendor is safe?
No. A SOC 2 Type II audit verifies traditional infrastructure security controls such as access management, encryption, and change logging, but it does not measure hallucination rates, test prompt-injection defenses, block upstream API 30-day log retention, or stop a vendor from swapping foundation models silently. Treat SOC 2 as a baseline floor and run an AI-specific contract and pilot check on top.
What does Zero Data Retention (ZDR) mean when buying from an AI startup?
Zero Data Retention means neither the application vendor nor its upstream foundation-model API provider (such as OpenAI, Anthropic, or Google) writes prompts or completions to persistent abuse-monitoring logs, even for 30 days. Many startups disable model training via commercial APIs without requesting formal ZDR endpoints, leaving sensitive customer inputs sitting on subprocessor servers for a month.
Why should an AI contract require 30-day advance notice of model changes?
AI SaaS vendors pay per token on backend model calls and routinely swap or quantize models to cut compute costs. Even minor model or system-prompt updates by OpenAI and Anthropic in 2025 and 2026 caused unexpected behavioral regressions. Thirty-day notice plus workspace version pinning gives your team time to re-run a 10-to-50 prompt canary sheet before client workflows break.
Why is immediate deletion of source audio sometimes a red flag for AI transcription vendors?
When an AI meeting or clinical scribe vendor deletes raw source audio seconds after generating a summary, your staff loses the only ground truth capable of proving the AI invented a quote, number, or symptom. Instead of instant unreviewable deletion, require private, encrypted retention for a short review window (such as 14 to 30 days) followed by automated purge.
What should small buyers do when an AI vendor refuses to negotiate standard contract terms?
Refuse multi-year or annual prepaid lock-in unless the published Data Processing Addendum already guarantees zero model training, named subprocessors, and self-serve log export. Switching to monthly cancel-anytime billing caps your commercial downside at 30 days of fees, and restricting the tool to Green or low-risk Yellow internal data keeps statutory exposure out of the workspace.
Key terms
- Zero Data Retention (ZDR): API mode and contract rule ensuring prompts/outputs run in memory only and never sit in 30-day abuse logs.
- AI subprocessor: Any downstream model lab, GPU host, or vector service processing customer data for the vendor.
- Silent model swap: Unannounced backend switch between models, quantization levels, or system prompts shifting errors overnight.
- Denominator transparency: Disclosing exact sample size (
n), dataset, and grading rules behind an accuracy claim. - Version pinning: Locking a workspace to a dated model snapshot rather than an auto-updating alias.
- Super-cap: Elevated liability ceiling (such as 3x ACV or $250,000 minimum) for DPA, secrecy, and training breaches.
- RAG ACLs: Access checks ensuring AI retrieval surfaces only internal files the signed-in user already has permission to view.
Sources
- IBM & Ponemon Institute, "Cost of a Data Breach Report 2026 (n = 602 breached organizations)" (July 29, 2026): IBM Newsroom.
- LangChain, "State of Agent Engineering Survey (n = 1,340 practitioners)" (June 12, 2026): LangChain Report.
- UC Berkeley, UIUC, Stanford & IBM Research, "Measuring Agents in Production (n = 86 systems)" (February 3, 2026): arXiv:2512.04123v3.
- Associated Press, "Researchers Say an AI-Powered Transcription Tool Used in Hospitals Invents Things No One Ever Said" (October 2024): AP via KMPH.
- Allison Koenecke et al., "Careless Whisper: Speech-to-Text Hallucination Harms" (ACM FAccT, June 2024): arXiv:2402.08021.
- UC Davis Health / JMIR Med Inform (n = 356 notes, 2026) & NeurIPS 2026 Scribe Audit (n = 565 notes): JMIR Med Inform and NeurIPS 2026.
- Jones Walker LLP, "Your Chatbot Does Not Need Authority to Create an Obligation" (October 7, 2026): Jones Walker.
- Help Net Security (Salesloft Drift OAuth breach, September 2, 2025) & BleepingComputer (Asana MCP exposure, June 2025): Help Net Security and BleepingComputer.
- OpenAI (GPT-4o Sycophancy Postmortem, May 2, 2025) & Anthropic (April 23 Postmortem, April 23, 2026): OpenAI and Anthropic.
- Civil Rights Litigation Clearinghouse (Mobley v. Workday, Inc.) & Reinhart on Colorado SB 26-189 (2026): Clearinghouse and Legal 500.
- Massachusetts Attorney General ($2.5M Earnest AI Settlement, July 10, 2025) & IIABA (
CG 40 47AI Exclusions, 2026): Mass.gov and IIABA.
