How to pick an AI vendor

AI vendor selection follows the same pattern as any third-party risk decision — but with one extra layer that's specific to AI: how the vendor handles your data once it's in their system.

The discipline has six checks. (1) **Data handling**: enterprise tier with no-training guarantees in writing, data residency commitments, retention policies, and audit-trail availability. Free tiers and consumer tiers fail this check by default. (2) **Compliance posture**: SOC 2 Type II report current, BAA available for healthcare, signed third-party documentation suitable for OCC 2023-17 / FDIC FIL-29-2023 if you bank, AIS Program documentation for NAIC IGD-H1 if you write insurance. (3) **Sub-processor disclosure**: which downstream processors does the vendor use? Most use OpenAI / Anthropic / Microsoft / Google as the underlying model, but the layer between you and them is where data handling actually happens. (4) **Roadmap and stability**: 12-month roadmap visible, funding runway communicated, customer references in your sector. AI vendor mortality is real; mid-market companies need vendors that will be around. (5) **Contract terms**: indemnification for IP claims, liability caps, exit data portability, termination assistance. (6) **Customer references in your sector**: not generic case studies — actual reference calls with similar-sized companies in your industry.

Questions vendors don't love that you should ask first: 'Show me the data flow diagram for my data.' 'Who has access to logs containing my prompts?' 'What's your incident-response SLA for a confirmed data leak?' 'When you say no-training, is that a default-on toggle or contractually guaranteed?' 'Show me a customer in [my industry] of [my size] that you'd let me reference-call.' Vendors that handle these crisply tend to be the ones who've been examined and survived. Vendors that get defensive about them are signaling something.