The demo is the vendor's best day
A vendor demo is a curated artifact. The inputs were chosen because the system handles them. The dataset was cleaned. The prompt was tuned over weeks. The latency you observed came from a warm cache on a single-tenant instance with one user. None of that is dishonest, and none of it is evidence. The purchase you are considering is not the demo. It is a two-year commitment to a system running on your data, at your volume, under your failure tolerance, staffed by your people. Diligence is the work of measuring the distance between those two things before money moves.
The buyers who get burned are rarely the ones who asked too few questions. They are the ones who asked questions the vendor had already prepared answers for. "How accurate is it?" produces a number with no denominator. "Is it secure?" produces a logo. "Can it integrate with our stack?" produces a slide with your logo next to a connector icon. The questions that reveal something are the ones that force the vendor to produce an artifact: a report, a log, a contract clause, a phone number of a customer who left.
Diligence runs on four tracks that fail in different ways and are usually owned by different people: technical, commercial, security, and reference. Run them in parallel, score them separately, and do not let a strong score on one cover a weak score on another. A vendor with an excellent model and a hostile exit clause is still a bad purchase.
Where enterprise AI deals go wrong after signature
Editorial weighting from practitioner experience and public sources. Illustrative ranking, not a measured statistic.
Data: what the system needs before it does anything
Start here, because data requirements determine the real cost of the project and vendors systematically understate them. Ask what the system needs on day one to reach the performance shown in the demo. If the answer involves labeled examples, ask for the number, who produces the labels, at what cost, and what happens to accuracy at half that volume. A vendor who cannot describe the accuracy curve against training-set size has not measured it.
Ask what happens with zero of your labeled data. The cold-start answer tells you whether you are buying a product or a services engagement wearing a product's pricing. Then ask what the system does when your data distribution shifts: new product lines, a new claim type, a merger that brings in a second records system. Retraining cadence, who pays for it, and how long it takes are contract terms, not implementation details.
The other half of this question is access. A model that needs three years of history from a mainframe your team touches twice a year has a data-engineering critical path in front of it, and that path is usually longer than the model work. More AI programs stall at the extract than at the algorithm, which is why the data access step belongs in the diligence rather than the kickoff. Get the vendor to write down the exact tables, fields, refresh frequency, and volume they require, and have your own data owner sign that it is obtainable.
Evaluation: who built the test set
The single highest-value question in AI diligence is this: can we run your system, unassisted, on a held-out set that we build, and see the raw per-item output? If the answer is no, the accuracy number is a marketing claim. If the answer is yes, you now own the most reliable signal available.
Build the set yourself from your own production records. Include the hard cases your staff argue about, the malformed inputs, the edge categories that occur twice a month, and a deliberate sample spread across the last twelve months rather than the last two weeks. Two hundred to five hundred items usually separates a good system from a mediocre one and is small enough for a subject-matter expert to adjudicate in a few days. Measure inter-annotator agreement on your own labels first; if two of your experts disagree twenty percent of the time, no vendor beats that ceiling.
Then insist on three things in the results. First, a baseline: what does your current process score on the same set, and what does a simple rules-based or keyword approach score? A model that beats nothing is not a purchase. Second, error bars. A 4-point difference on 200 items is inside the noise; bootstrap confidence intervals or a paired test such as McNemar's will tell you whether the gap is real. Third, per-segment breakdowns. Aggregate accuracy hides the fact that the system is at 96% on the common class and 41% on the class that carries the legal exposure.
Ask directly whether your evaluation data, or anything resembling it, appears in the vendor's training or few-shot examples. Contamination is the quiet reason vendor benchmark scores do not reproduce. A vendor who welcomes a blind benchmark on an instrument they do not control is telling you something real about their confidence.
Failure modes: what the system does when it is wrong
Every model is wrong on some fraction of inputs. The design question is what happens next, and it separates production engineering from prototype work more cleanly than any accuracy figure. Ask the vendor to describe the abstention path: under what condition does the system decline to answer and route to a human? If there is no abstention path, every error becomes a silent error, and silent errors accumulate in your records until an auditor finds them.
Push on calibration. A confidence score is only useful if 0.9 means the answer is right about nine times in ten. Ask for a reliability curve on your evaluation set. Ask what threshold they recommend for auto-approval, what volume that leaves for human review, and what the review time per item is. That last number, multiplied by your volume, is a headcount line in your business case that vendors almost never surface.
Then ask about the audit trail. For any decision the system influenced, can you reconstruct the inputs, the model version, the configuration in force, the retrieved source documents, and the output, six months later? Federal buyers document that chain under the NIST AI Risk Management Framework 1.0 (January 2023) and its Generative AI Profile; buyers in the EU market face phased obligations under the AI Act through August 2026. An immutable, queryable log satisfies both.
Latency and cost at the volume you will actually run
Demo latency is single-user latency. Production latency is your ninety-fifth percentile at peak concurrency with retries included. Ask for p50, p95, and p99 at a stated request rate, and ask what happens when you exceed it: queue, throttle, or degrade. Ask about rate limits imposed by whatever foundation-model provider sits underneath, because those limits are the vendor's constraint and they become yours. Ask what the fallback is when the upstream provider has an incident, and whether that fallback model has ever been evaluated on your task.
On cost, refuse to reason in cost per API call. The number that matters is fully loaded cost per resolved unit of work: per claim adjudicated, per document processed, per ticket closed. Build it from the vendor's own figures. Average input plus output tokens per unit, times the number of model calls per unit (retrieval, generation, verification, and agentic retries each count), times unit price, plus the platform fee amortized over volume, plus the human review time established above. Then ask what that number does at three times today's volume.
| Question | The demo-day answer | The answer you need in writing |
|---|---|---|
| Accuracy | "About 95%." | Score on our held-out set, with baseline, confidence interval, and per-segment breakdown. |
| Latency | "Sub-second." | p95 and p99 at our peak requests per minute, retries included, with the SLA credit schedule. |
| Cost | "Per seat, per month." | Fully loaded cost per resolved unit at year-two volume, including human review minutes. |
| Security | "We're SOC 2." | Type II report, period covered, systems in scope, Section 4 exceptions, and the user-entity controls. |
| Data handling | "Your data is never used for training." | The clause number, the subprocessor list, retention periods, and the deletion certification process. |
| Exit | "You can export anytime." | Format, completeness, delivery time, wind-down assistance, and price after termination. |
Pricing models and where the meter runs
Four pricing shapes dominate AI contracts, and each hides its risk somewhere different. Per-seat pricing is predictable, decouples price from value, and punishes broad rollout. Consumption pricing (per token, per call, per document) tracks value but exposes you to the vendor changing the number of model calls per unit of work with no change to your workflow. Outcome pricing sounds ideal and usually collapses under the definition of the outcome. Platform fee plus consumption is the common hybrid, where the fee is the real commitment and the consumption is the surprise.
Whichever shape you take, negotiate four terms: an annual price-increase cap written into the contract, protection against unit-price changes during the term, a monthly true-up so overages surface early, and the right to reduce committed volume at renewal without losing the discount tier. Ask what the price is if you keep the product and stop buying professional services, then ask which parts of the demo were services.
Lock-in and the exit you negotiate on day one
Exit terms are cheap to negotiate before signature and impossible after. Six items belong in the agreement. Data return: full export of your source data and all system-generated outputs in a documented, non-proprietary format, delivered within a stated number of days, at no charge, including after termination for cause by either party. Derived artifacts: fine-tuned model weights, adapters, embeddings, prompt libraries, configuration, and labeled data your staff produced. If the vendor will not hand over weights trained on your data, get in writing that they may not use those weights for any other customer.
Then: intellectual property in derivative work, defined so that improvements built specifically for you do not silently become the vendor's roadmap; transition assistance for a defined period at a defined rate after termination, which is the clause that prevents a hostage situation; escrow of source and model artifacts if the vendor is small enough that continuity is a real risk; and termination for convenience with a stated notice period. Federal buyers have an additional layer, since data rights are governed by FAR 52.227-14 and, on defense contracts, DFARS 252.227-7013 and 252.227-7014, and a commercial vendor's standard terms will not match those clauses without negotiation.
Continuity of service during a dispute
Invoice disputes and renewal standoffs are ordinary. What is not ordinary is losing access to the system that runs your intake queue while the lawyers work. Add a clause that suspends termination and preserves service at the current price for a defined period once either party raises a dispute in writing, with data export rights unaffected. It costs nothing at signature and it removes the vendor's strongest lever at renewal.
Security review beyond the logo on the slide
"We are SOC 2 certified" is not a finding. SOC 2 is an attestation against the AICPA Trust Services Criteria, and the details determine whether it means anything for your purchase. A Type I report describes whether controls were suitably designed at a single point in time. A Type II report tests whether they operated effectively across a period, typically three to twelve months. Ask for the Type II under NDA and read four things: the period covered (if it ended eleven months ago, ask for a bridge letter), the systems and criteria in scope (availability and confidentiality are often excluded), the exceptions in Section 4, and the complementary user entity controls, which are the security obligations the report quietly assigns to you.
Then look past SOC 2 to the AI-specific surface. ISO/IEC 27001 covers the information security management system; ISO/IEC 42001, published in December 2023, covers an AI management system and speaks to model governance directly. Ask for the latest third-party penetration test summary and the remediation status of its findings, vulnerability-remediation service levels by severity, SSO and SCIM deprovisioning, encryption in transit and at rest with customer-managed key options, and a software bill of materials for anything installed in your environment. If the vendor ships containers into your cluster, what is inside that image becomes your risk the moment it runs.
Regulated buyers add their own gates. Health data requires a business associate agreement under 45 CFR 164.504(e). Federal cloud services require an authorization through the FedRAMP program. Defense contracts handling controlled unclassified information carry NIST SP 800-171 obligations and the CMMC program requirements codified at 32 CFR Part 170, effective December 16, 2024. None of these are things a vendor grows into after signature.
Data residency, subprocessors, and training rights
Three questions, asked precisely, resolve most of the data-governance risk in an AI purchase.
Where does the data physically sit, and who can reach it? Storage region is the easy half. Processing and support access is the harder half: many vendors store data in one region and staff support from another, so a person in a third country can open a ticket and see a record. Put region pinning in the contract, ask where support and engineering personnel sit, and ask whether inference calls leave the stated region under failover.
Who are the subprocessors? Demand the current list by name, including every foundation-model provider, every vector database or search service, every observability platform that receives prompt and response payloads, and every offshore annotation vendor. Under GDPR Article 28 a processor needs authorization to engage subprocessors and must give notice of changes; put the same right in the contract regardless of jurisdiction, with a notice period and a right to object. The observability question catches people, because prompt-logging tools often hold the most sensitive text in the whole stack.
What happens to the data after the call? Get the retention period for prompts and outputs at every layer, including the model provider. Get an explicit clause that your data is not used to train or fine-tune models serving other customers, and check whether the vendor has flowed that same restriction down to their own model provider, since a promise the vendor cannot enforce upstream is not a control. Ask for zero-retention or short-retention configuration where it exists, and ask how deletion is certified.
Reference checks that actually reveal problems
Vendor-supplied references are selected, coached, and often compensated with discounts. They are still worth taking, if you change the questions. Ask to speak to the engineer or operations manager who runs the system daily, not the executive sponsor who bought it. Sponsors describe strategy; operators describe the 2 a.m. behavior.
Six questions that produce signal: What broke in the first ninety days? How many of your own people work on this that you did not plan for? What did the first full year invoice come to against the original quote, as a ratio? What did you end up building yourself that you expected to get from the product? How long does a P1 support ticket actually take to resolve? Would you buy it again at 1.5 times the price? The last one is the most useful question in reference checking, because it forces a value judgment instead of a courtesy.
Then find one reference the vendor did not give you. Ask directly for a customer who did not renew and note whether they can produce one; a vendor with real customers has churn and can discuss it. Failing that, professional networks and industry user groups will surface someone who evaluated the product and passed. The reason they passed is the fastest diligence available.
The scored diligence checklist
Score each item on the evidence produced, not on the answer given. Full credit requires an artifact you can put in a folder. Half credit is a credible verbal answer with a commitment to produce the artifact before signature. Zero is anything else. Total the weights.
| Diligence item | Weight | What full credit looks like |
|---|---|---|
| Blind evaluation on your data | 15 | Per-item results on your held-out set, with baseline, confidence interval, and per-segment scores. |
| Data requirements and cold start | 10 | Named tables and fields, labeled-volume requirement, accuracy curve against training-set size. |
| Failure handling and escalation | 10 | Abstention thresholds, reliability curve, review volume and minutes per item, full audit log. |
| Cost per resolved unit | 10 | Model calls and tokens per unit, priced at year-two volume, with human review time included. |
| Data return and exit mechanics | 10 | Export format, completeness, delivery window, transition assistance rate, post-termination terms. |
| Subprocessors, residency, training rights | 10 | Named subprocessor list with notice rights, region pinning, retention and no-train clauses flowed down. |
| SOC 2 Type II scope and exceptions | 8 | Current report read under NDA, with exceptions and user-entity controls assigned to owners. |
| Latency and throughput at peak | 8 | p95 and p99 at your rate, upstream limits disclosed, SLA with credits and a tested fallback. |
| References, including one that left | 7 | Two operator-level calls plus one non-renewing or evaluating-and-passed customer. |
| Pricing terms, caps, and minimums | 7 | Uplift cap, unit-price protection, monthly true-up, defined volume flexibility at renewal. |
| IP in derivative work | 5 | Written allocation of rights in fine-tunes, prompts, labels, and anything built for you. |
85 and above. Sign. Carry any half-credit items into the contract as conditions precedent.
70 to 84. Sign only with the gaps written as remediation milestones tied to payment, and a short initial term.
Below 70. Do not sign an enterprise agreement. Buy a scoped, paid pilot with an exit, and re-score at the end of it.
Running it in three weeks
Diligence stalls when it has no schedule. Fifteen business days is enough for a serious review if the tracks run in parallel and the evaluation set is built first.
A 15-business-day diligence sequence
Walk-away triggers
Some answers end the evaluation regardless of how good the rest of the package looks. These are not negotiating positions; they are structural.
- The vendor will not let you run a blind evaluation on your own data.
- The subprocessor list is described as confidential.
- The SOC 2 report cannot be produced under NDA, or the only report is a Type I.
- Data export is available "on request" with no format, timeline, or price stated.
- No customer has ever left, and no operator-level reference is available.
- The accuracy number changes when you ask how it was measured.
Bottom line
The buyers who do this well share one habit: they convert every claim into an artifact before signature and treat anything that cannot become an artifact as unverified. That single move filters most of the risk out of an AI purchase, and it costs three weeks. Our engineers sit on both sides of this table, building the systems that have to survive a buyer's evaluation and running the evaluations that decide whether someone else's system gets bought. The systems that hold up are the ones whose builders expected to be tested on data they had never seen.
Frequently asked questions
Whether you can run their system, unassisted, on a held-out test set you build from your own production data, and see the raw per-item output. Every other technical claim is downstream of that answer. A vendor who declines has told you the accuracy figure was measured somewhere you cannot check.
No. SOC 2 is a useful baseline, but read the Type II report itself: the period covered, the systems and criteria in scope, the exceptions in Section 4, and the complementary user entity controls it assigns to you. Then add the AI-specific questions on subprocessors, retention, training rights, and residency, which SOC 2 does not answer.
Compute fully loaded cost per resolved unit of work rather than cost per call. Multiply model calls per unit by tokens per call by unit price, add the amortized platform fee, then add the human review minutes implied by the vendor's own confidence thresholds. Re-run the figure at three times current volume before you sign.
Data return in a documented open format within a stated window at no charge, ownership or use restrictions on fine-tuned weights and labeled data your staff produced, IP allocation for derivative work, paid transition assistance at a fixed rate after termination, termination for convenience with notice, and continuity of service during a dispute.
About fifteen business days for an enterprise purchase, if the technical, commercial, security, and reference tracks run in parallel and the evaluation set is built in the first week. Longer than that usually means the evaluation data was never assembled and the process is running on meetings instead of measurement.