An RFP template for a generative AI deployment

Section 1 — Data handling

• Is exclusion from model training stated in the agreement? Provide the clause.
• What is the retention period for prompts and outputs? Is it configurable?
• Where is data processed? Can we select a region?
• List all subprocessors and the notification terms for changes.
• What happens to our data at termination, and on what timeline?

Section 2 — Security

• Provide your current SOC 2 Type II report and ISO 27001 certificate with scope.
• Summarise your most recent penetration test.
• Describe your incident notification process and timelines.
• Do you support SAML SSO and SCIM provisioning?
• Are audit logs exportable to a SIEM? In what format?

Section 3 — Commercial

• What is the contracting entity, and in which jurisdiction?
• What currencies and payment methods are supported? Is invoice payment available?
• What is the minimum seat count and minimum term?
• What are the terms for reducing seats mid-term?
• What notice do you give for price changes?

Section 4 — Operational

• What are the support hours, languages and escalation path?
• What is your model deprecation policy and notice period?
• What rate limits apply, and how are increases requested?
• Provide historical uptime and the incident history for the last twelve months.

Section 5 — Capability

Deliberately last, and deliberately short: ask vendors to run your evaluation set rather than describe their capabilities. Supply fifty real inputs and the criteria. A vendor unwilling to do that has told you something useful.

The quiet disqualifiers

Four answers end an evaluation regardless of how good the product is: training exclusion only in marketing material; no SCIM when you have more than a hundred seats; no invoice payment when your finance process requires it; and no answer at all on data deletion at termination.