An AI procurement policy establishes criteria for evaluating AI vendors, risk assessment requirements before purchase, contractual safeguards for compliance and data protection, and ongoing vendor management obligations.
AI Procurement Policy Template: Evaluation Criteria and Contract Requirements (2026)
Policy Purpose and Scope
This policy template establishes requirements for evaluating, selecting, and managing AI systems procured from external providers. It applies to all AI system purchases, subscriptions, and service agreements, ensuring that procured AI meets the organization's compliance, security, and governance standards.
Vendor Evaluation Criteria
| Category | Evaluation Questions | Weight |
|---|---|---|
| Regulatory compliance | EU AI Act conformity status? Risk classification documented? Conformity assessment completed? | High |
| Technical capability | Performance benchmarks available? Explainability features? Monitoring capabilities? | High |
| Data governance | Training data documentation? Data processing locations? Retention policies? | High |
| Security | Security certifications? Penetration testing? Incident response capability? | High |
| Transparency | Model documentation available? Bias testing results shared? Limitation disclosures? | Medium |
| Support and maintenance | Update frequency? SLA commitments? Human support availability? | Medium |
| Financial stability | Company viability? Escrow arrangements? Transition support? | Medium |
Pre-Procurement Risk Assessment
Before initiating procurement, conduct a risk assessment covering the intended use case and its risk classification under the EU AI Act, the personal data processing implications, the potential impact on individuals if the system fails or produces biased outputs, and the organization's readiness to deploy and manage the AI system.
Contract Requirements
Essential Clauses
- EU AI Act compliance obligations and warranties
- Right to audit the vendor's AI practices
- Incident notification requirements and timelines
- Data processing agreement aligned with GDPR
- Model update notification and approval procedures
- Performance and fairness SLAs with remedies
- Intellectual property ownership and license terms
- Exit and data portability provisions
- Liability allocation for AI system failures
- Indemnification for regulatory non-compliance
Due Diligence Checklist
- Request and review the vendor's AI governance policy
- Obtain EU AI Act conformity documentation
- Review third-party audit or certification reports
- Assess training data practices and bias testing results
- Evaluate security posture through questionnaires and certifications
- Check references from similar deployments
- Assess financial stability and business continuity plans
- Review the vendor's incident history and response capability
Ongoing Vendor Management
After procurement, maintain ongoing oversight including periodic performance reviews against SLAs, regular compliance status updates from the vendor, annual vendor risk reassessment, monitoring of regulatory changes affecting the vendor's obligations, and review of model updates and their impact on compliance.
Approval Authority
Define approval authority levels based on the AI system's risk classification. High-risk AI procurement should require approval from the AI governance committee and senior management. Standard-risk procurement may be approved at department level with governance office review.
Check your AI compliance readiness — free.
Take the Readiness Check 3 minutes · 10 questions · no signup requiredThis article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.