Questions to ask an AI vendor before you sign

The questions to ask an AI vendor sort into five groups, people, price, safety, ownership and data, and five of the twenty below decide most of it: who does the work by name, what the 12-month total is in one shape, who approves the output before it is sent, what you own on the day you leave, and which country the model runs in. The test is not technical: an answer that is a number or a written policy is worth something, one that is a percentage about the vendor’s own work is worth nothing, and any vendor can give you a day-30 stopping condition before you sign.

Picture the finance head of a freight forwarder in Colombo 15, working from an RFP template last edited in 2019. She changed the title to say artificial intelligence and sent it to four firms. Three replies listed the same eleven capabilities, reordered. One was a rate card. She is invented, the template is not, and the template is the problem: it asks what the software does, never who does it.

Every US dollar figure below converts at LKR 328.75, the Central Bank of Sri Lanka’s indicative USD/LKR spot rate for 10 September 2026. This is commercial information, not legal advice.

Why AI RFPs fail before anyone answers them

Ask ten firms whether they do document extraction, workflow automation and chatbots and ten will say yes, truthfully, and you will have learned nothing you can score. A feature list is the easiest thing to agree with.

The UK Office for Artificial Intelligence reached the same conclusion in its Guidelines for AI procurement of 8 June 2020. Guideline 6: “Tell suppliers about the situation or challenge, and let them propose a solution that meets your needs.” Guideline 8 is the whole of AI vendor due diligence in six words: “Avoid Black Box algorithms and vendor lock in.” Sri Lanka has no such guidance, so ordinary law does the work here. Ask the twenty out loud: good and bad are audible in seconds.

People: who is actually going to do the work

A firm cannot deliver judgement it does not have on staff.

1. Who does the work, by name, and can I meet them this week? Good: two names and a slot on Thursday. Bad: “our delivery team”.
2. How many people are in the firm, and how many on my account? Good: a number and a number. Bad: forty faces on a team page.
3. Who wrote this proposal, and will they be on the delivery calls? Good: the writer is on the call. Bad: a salesperson who vanishes at signature.
4. What happens when that person is on leave or resigns? Good: a named second, and where the spec lives. Bad: “we have depth”, a mood not a term.

Price: what is published before the call

A price you can only get after disclosing your revenue is not a price. It is an assessment of what you can bear.

5. What is the twelve-month total, one currency, one shape, support included? Good: one figure, and what month 13 costs. Bad: a rate and “it depends on scope”.
6. Which prices are published, and where can I read them? Good: a URL. Bad: a rate card on request.
7. What is excluded, and what triggers a change order? Good: written exclusions, a named approver. Bad: silence, an invoice in month four.
8. What does the fifth year cost? Good: licence, support and staff time separated, because an AI system needs support all its life. Bad: a build price alone.

Safety: who approves, and what gets measured

Most AI RFP questions skip this group, and it decides whether anything wrong reaches a customer.

9. Who approves the output, by name, before anything is sent? Good: your job title, in the proposal. Bad: “it has guardrails”.
10. What single number says it is working, and who computes it? Good: one your staff produce on your systems. Bad: one the vendor produced.
11. What is the day-30 baseline, and what if it does not move? Good: a measure, a date, a consequence, offered before you ask. Bad: “we would review”.
12. Which accuracy claims here did you measure yourself? Good: none, and why: see an AI agent’s approval rate and how to run an AI pilot. Bad: 97%, with a chart.

Ownership: the spec, the prompts, the data, the exit

The UK guidelines tell buyers to decide “whether you or the supplier should own any new intellectual property” and to prefer “open standards, royalty-free licensing agreements, and public domain publication terms”. Settle it in the RFP.

13. Who owns the specification and the prompts at the end? Good: you do, in a clause, with files named. Bad: “that is our methodology”.
14. Where does it run, in my accounts or behind your login? Good: your accounts, your billing, your admin. Bad: a vendor platform, a rental sold as a build.
15. Can my staff change it without you, and will you train them? Good: a handover session and documentation, on a date. Bad: a ticket per change.
16. On the day we leave, what do you hand over, and in how many days? Good: a list and a number. Bad: an answer that arrives only after notice, the failure mode in You Bought the Contractor.

Data: where it lives, and who can see it

Sri Lanka’s regulator is the Data Protection Authority, and the duties fall on you as controller, not on the vendor.

17. Which fields will the agent read, and who wrote that list? Good: one page, agreed before switch-on, since section 7 of the Personal Data Protection Act, No. 9 of 2022 requires data to be “adequate”, “relevant” and “proportionate”. Bad: whole-database access.
18. Are you a controller or a processor, and on what written instructions? Good: processor, instructions attached. Bad: a shrug. Section 22(2) deems such a processor a controller.
19. Which country does the model run in, and which sub-processors see the data? Good: a region and a list. Bad: “it is in the cloud”. The Amendment Act, No. 22 of 2025 redefined a third country as “any other territory or country other than Sri Lanka”, so anyone citing the 2022 adequacy regime is citing a repealed section.
20. What is deleted, when, and will you erase or return our data? Good: a retention window in writing and section 22(1)(d) in the contract. Bad: logs kept by default, the point of what the Act means for an AI agent.

The five groups, and the answer that should end the meeting

Group	A good answer sounds like	A worrying answer sounds like	Why it matters
People	Two names, their roles, a meeting this week	“Our delivery team”, plus a slide	Judgement has a name and a calendar
Price	One twelve-month total, support included	A rate and “it depends on scope”	Unpriced scope returns as a change order
Safety	A named reviewer, a day-30 measure and consequence	An accuracy percentage the vendor measured	The vendor picked its own test set
Ownership	Your accounts, your prompts, a handover date	“That is our methodology”, or a vendor login	Guideline 8: avoid black box and lock in
Data	A region, a field list, a deletion window	“It is in the cloud”, no instructions	You are the controller; section 38 penalties reach LKR 10 million

Our answers to our own twenty

specshop.dev is an AI consultancy and AI agency in Colombo, Sri Lanka, led by Janaka Ediriweera, Principal AI and Product Management Consultant. Our own answers, weakest first.

People. We are seven, in Colombo, Muscat and Dubai. If you need a hundred developers on standby or a panel agreement, we are the wrong shape and say so on the free call. We are a newer brand with a short directory history, so the reference-checking in how to shortlist AI companies counts against us.

Price. Published before you speak to us. A workflow mapping sprint is US$2,300, about LKR 756,125, with a written report in 48 hours, credited in full against the recruitment fee if you hire within 30 days. Salaries run from US$1,225 a month, about LKR 402,700, to US$3,000, about LKR 986,250, for the delivery engineer. The recruitment fee is US$9,500 one-off, about LKR 3,123,125, half to begin. No hourly rates. The workshop price goes to an interest list, not the site, a fair mark against us on question 6.

Safety. A named reviewer approves every draft, and the only performance number we publish is the approval rate: the share that reviewer approves untouched, scored weekly across a 30-day probation. If it has not improved on its day-one baseline by day 30, you do not confirm the hire and the balance is never invoiced.

Ownership. The agent runs in your accounts, the fee covers connection to your inbox, WhatsApp and tools, and agents go live within 72 hours. Our published wording is that everything the agent learns belongs to your firm, in writing. Ask for that sentence in a contract, not on a web page.

Data. You are the controller, we are the processor, the field list is written before switch-on and the deletion window agreed, not defaulted. Question 19 is our unflattering one: where the model runs depends on the provider you choose, and some process outside Sri Lanka. We name the region in writing, then you take it to a lawyer.

The block you can paste into an email

Send these to three firms, then score the replies against the table.

1. The two people who will do this work, and their roles.
2. One workflow you automated like ours, and who reviewed its output daily.
3. A twelve-month total, one currency, support included, and the exclusions.
4. The day-30 number, who computes it, and what happens if it does not move.
5. What we own at the end, and how long handover takes.
6. The processing region, the sub-processors, and what is deleted when.

What to do this week

Do not write an AI vendor RFP template from scratch. Take those six lines, add the workflow you want fixed in three sentences, and send it today. Read the replies for what is missing: the absences are the terms you pay for later.

If the workflow needs writing down first, that is what the mapping sprint is for, and the thirty-minute call with our AI consultancy in Sri Lanka is free. Terms sit where you hire an AI agent, or hire an AI consultant in Colombo for mapping alone.

// questions

Questions people actually ask.

What questions should I ask an AI vendor?

Ask about five things in this order: who will do the work by name, what the twelve-month total is in one currency and one shape, who in your business approves the output before it is sent, what you own on the day the engagement ends, and which country the model runs in. Everything else is detail, and a vendor who cannot answer those five in one call is not a shortlist candidate yet.

What should be in an AI RFP?

One workflow described in three sentences, the outcome you want rather than the technology you imagine, and six questions covering people, price, approval, ownership and data. The UK Office for Artificial Intelligence put the same principle in its 2020 procurement guidelines: tell suppliers about the situation or challenge, and let them propose a solution that meets your needs.

How do I check an AI vendor's claims?

Ask which claims the vendor measured itself, and discount those to zero, because the vendor chose the test data, the prompt and the run that got reported. Then call two references the vendor did not nominate, and ask each of them one question: who on your side read the output every morning, and how often did they have to change it.

Should an AI vendor give a fixed price?

They should give you a total you can put in a budget, which is either a fixed engagement fee or a monthly figure, with support and exclusions written down. Our own prices are published before the first call, from US$2,300, about LKR 756,125, for a workflow mapping sprint to US$9,500, about LKR 3,123,125, for a one-off recruitment fee, and we do not charge hourly or day rates.

What should I own at the end of an AI project?

The specification, the prompts, the accounts the automation runs in, the documentation, and your own data returned or erased on request. The UK guidelines tell buyers to decide up front whether they or the supplier should own new intellectual property and to prefer open standards and royalty-free licensing, and section 22(1)(d) of Sri Lanka’s Personal Data Protection Act is where the return or erasure of personal data belongs in your contract.

How do I choose an AI vendor if all the proposals look the same?

Stop reading the proposals and score them against a five-group AI vendor evaluation checklist instead, people, price, safety, ownership and data, one line per firm per group and no credit for anything you cannot check. Proposals converge because they are written to converge, while answers about named people, a twelve-month total, a day-30 consequence, a handover list and a processing region diverge immediately.

Sources

Guidelines for AI procurement, Office for Artificial Intelligence, UK Government, 8 June 2020 — guideline 6, “Tell suppliers about the situation or challenge, and let them propose a solution that meets your needs”; guideline 8, “Avoid Black Box algorithms and vendor lock in”, with “Highly ‘explainable’ outputs from your AI system will be able to be interpreted by your team, and by other suppliers. This will also make it more likely for you to be able to engage with other suppliers to continue or build upon your AI system in the future, limiting the risk of vendor lock-in” and “Good practice could involve adopting open standards, royalty-free licensing agreements, and public domain publication terms”; on intellectual property, “whether you or the supplier should own any new intellectual property and who can best exploit the IP generated”; on lifecycle management, an AI system “may need continued support throughout its lifecycle” and support gaps “both come at a cost”. Fetched 11 September 2026.
Personal Data Protection Act, No. 9 of 2022, Parliament of Sri Lanka — section 7 requiring personal data to be “adequate”, “relevant” and “proportionate” to the purpose; section 9 on retention “only for such period as may be necessary”; section 22(1)(d) on erasure or return of personal data; section 22(2) deeming a processor that determines purposes and means to be a controller; section 38(1) penalty “which shall not exceed a sum of rupees ten million for each non-compliance”; section 56 definitions of controller, processor and processing. Fetched 10 September 2026.
Personal Data Protection (Amendment) Act, No. 22 of 2025, documents.gov.lk — certified 30 October 2025; replacement of section 26 of the principal enactment on cross-border processing, and the redefinition of “third country” as “any other territory or country other than Sri Lanka”. Fetched 10 September 2026.
Daily Indicative USD/LKR Spot Exchange Rates, Central Bank of Sri Lanka, 2026 — the indicative rate of LKR 328.75 per US$1 on 10 September 2026, used for every conversion in this post.