Evaluating an AI Vendor

What procurement and security officers should check before approving a tool.

Procurement~15 min

The big idea

Choosing an AI tool for OFFICIAL work is a security decision. Drawing on the DTA's AI procurement checklist and the PSPF, this lesson gives a vendor-evaluation checklist (IRAP level, HCF certification, data residency, no-training default, retention/DPA, sub-processors and FOCI, SOC 2 / ISO 42001, Zero-Data-Retention) and five plain questions to ask of any vendor's terms of service.

Key insight: The five ToS questions: Is my data used to train — by default or only on opt-in? How long is it retained, and can I shorten it? Who can access it? Where is it stored and processed? What happens if a foreign court orders production?

What you'll see

The procurement checklist and the five terms-of-service questions.

The evaluation checklist

What to verify before approving a tool. Tap to expand.

Key points to remember

Treat tool selection as a security decision, not a feature comparison.

Check IRAP, HCF, residency, no-training default, retention and ZDR.

Ask the five ToS questions of every vendor.

For AUKUS-related work, ITAR/EAR and weight nationality matter.

Prev: Safe vs Prohibited Tasks Next: Prompt Injection