Entity and contracting party
Confirm legal name, registration, address type, signing authority, insurance where relevant, and the entity receiving data and payment.
Enterprise AI procurement
How should an enterprise verify an AI vendor before signing?
Evaluate the provider, the delivery system, and the exit path separately. A polished demo is useful evidence of possibility, but it does not identify who will deliver, how production risk is controlled, or what the buyer owns at termination.
By Onyx Devs Lab · Published · Updated
Named providerLegal entity, team, and subcontractors
Production controlsData, authority, evaluation, and operations
Exit-readyOwnership, portability, and termination support
Verify the provider behind the proposal
The buyer should know exactly who is making each claim and who will be accountable for delivery.
Named delivery team
Request roles, relevant work, availability, location, replacements, subcontractors, and which people will attend discovery and production reviews.
Reference boundaries
Distinguish public facts, provider-authored claims, client-confirmed outcomes, and independent sources; record what each reference actually proves.
Verify delivery, operations, and exit
Ask for evidence from the complete operating workflow, not only a model response.
Production system
Review data provenance, tenant separation, permissions, evaluation sets, logs, monitoring, fallbacks, incident response, and human takeover.
Commercial model
Expose implementation assumptions, third-party fees, model and infrastructure usage, support, change control, taxes, and expected recurring cost.
Ownership and exit
Specify source, configuration, prompts, evaluation assets, documentation, data return and deletion, portability, knowledge transfer, and termination assistance.
How to run the evidence review
Issue one evidence request
Give all candidates the same workflow, constraints, test cases, response fields, and evidence-source classifications.
Validate the source class
Check whether each item is public, first-party, client-confirmed, or independently verifiable, and retain its exact limitation.
Run a bounded technical review
Inspect one representative workflow end to end, including forbidden actions, failures, recovery, logs, and operating cost.
Close gaps contractually
Turn accepted claims, controls, tests, ownership, service levels, and exit obligations into signed requirements.
Frequently asked questions
Is a strong demo enough?
No. It shows a configured example can work. It does not establish representative quality, production controls, accountable staffing, full cost, or the exit path.
Do certifications replace due diligence?
No. Certifications may support a defined control claim, but buyers still need to verify scope, current applicability, architecture, workflow-specific risks, and operational evidence.
How should client references be used?
Ask what was delivered, who verified the outcome, the measurement period, the reference’s role, and what cannot be disclosed. Do not generalise one client result to another workflow.
Is this legal or procurement advice?
No. Adapt this provider-authored checklist with legal, privacy, security, procurement, finance, and sector specialists.
Start with one concrete operating problem.
We will first clarify the workflow, evidence, data boundary, and outcome standard before recommending the next step.
Contact Onyx