The questions to ask before buying an AI product or service. Where does the data go, is it used for training, what is the retention, who has access, what evidence of testing exists, what happens if the model changes, and what happens if you want to leave. Most of these are contractual rather than technical.
Technical view
An assessment should cover data flows and processing locations, training use and opt-out, retention and deletion including derived artefacts, subprocessor lists and change notification, security certifications, model version stability and deprecation notice periods, evaluation evidence and documentation, incident notification, liability and indemnity terms, and exit provisions including data and configuration export. Ask for a model card and the results of safety testing.
Related
Part of AI Terminology Index, section: Governance, Law and Regulation.