Use this before you buy, and again at renewal.
Your data
- - Where is our data stored and processed, and in which country?
- Is our data used to train any model, yours or anyone else's?
- Who at your company, and at your suppliers, can see it?
- How long do you keep it, and how do we get it deleted?
The model
- - Which AI models power the product, and who supplies them?
- Will you tell us before you change or replace a model?
- How do you test for accuracy, and can we see the results?
Control and evidence
- - Can we see logs of what went in and what came out?
- Can we audit you, or see independent assurance reports?
- How and how quickly will you notify us of an incident?
Dependence
- - Which other providers does your product depend on?
- What happens to our service if one of them fails?
- If we leave, how do we get our data out, in what format, and how long does it take?
The contract
- - Does the contract cover audit rights, model changes, incident notice and data handling?
- What does the contract say about who is responsible when the AI is wrong?
APRA's April 2026 letter points to the same issues: visibility of the AI supply chain, contracts that give transparency and auditability, and credible exit arrangements. (APRA letter)