You have sat through the demo. The agent researched an account, drafted the email and updated the CRM while you watched. The vendor says your reps will get hours back every week.
Now you have to decide whether any of it holds up on your data, in your systems, under your contract.
Most AI vendor due diligence checklists come from procurement and security teams. They cover certificates and data storage well.
A revenue tool needs a few more questions, because it changes records your forecast depends on and sends messages your buyers read.
Here are ten questions, grouped by what they protect, with what a strong answer includes. Together they work as an AI vendor questionnaire you can send before the next demo.
What is AI vendor due diligence?
Checking the claims before the contract.
AI vendor due diligence is the work of confirming that a vendor's AI does what the demo showed, on your data, within limits you agree to.
It covers what the AI is, what it can touch, how its output is tested, what happens to your data, what it really costs, and how you leave.
For a revenue team, the stakes are specific. The tool writes to the CRM, ranks accounts and contacts prospects under your reps' names.
Watch for a buying process where the security review is thorough and nobody asked what the tool will send.
Is the AI real, or is it AI washing?
AI washing has a regulator now.
In March 2024 the SEC settled its first AI washing cases, with investment advisers Delphia and Global Predictions, for $400,000 in combined penalties over AI claims they could not support.
Six months later the FTC announced Operation AI Comply, five actions against deceptive AI claims.
The agent category has the same problem. In June 2025 Gartner estimated that only about 130 of the thousands of vendors marketing agentic AI were the real thing. It called the rest agent washing.
1. What does the AI do in this product, step by step, and what is handled by fixed rules?
A strong answer walks through one task and says which steps a model performs, which are rules, and where a person steps in. Rules are fine. Being clear about them is the point.
2. Which models does it use, and what happens to our results when the model changes?
A strong answer names the model providers, says how model updates are tested before they reach your account, and tells you how you will hear about them.
Watch for a product description that says "AI-powered" more often than it says what the product does.
What will it read, change and send in your systems?
Permissions decide the size of the worst day.
3. Which of our systems does it connect to, and which fields or records can it change?
A strong answer is a written list of systems, fields and actions, scoped to the job. A tool that updates three fields should not need admin access to the whole CRM.
In August 2025, attackers used stolen access tokens from the Salesloft Drift integration to export data from numerous companies' Salesforce instances, per Google's threat intelligence team. Connected tools carry the access you grant them.
4. What can it send to prospects or customers without a person approving it, and can we change that?
A strong answer shows the approval settings in the product, lets you start with drafts that a rep approves, and lets you widen what runs alone as trust builds.
Watch for a tool that asks for broad access during the trial and never narrows it afterward.
How is the output tested before and after you buy?
A demo is one good run.
5. How do you test the quality of the output, and can we run that test on our own data during the trial?
A strong answer describes a repeatable test set with written pass criteria, and offers to run it on a sample of your records before you sign. We wrote about how to review AI output you did not watch get made.
6. How will we know if quality drops after launch?
A strong answer covers what the vendor monitors, what you can see in the product, and how quickly they tell you when something changes. Output quality can shift when models, prompts or your own data change.
Watch for a trial scored on how impressive the best output looked.
What happens to your data?
Read the data clause twice.
TermScout data published through Stanford CodeX found that 92% of the AI vendor contracts it studied claimed data usage rights beyond what the service needed. The market average was 63%.
7. Will our data, prompts or outputs be used to train or improve your models, and can we opt out in the contract?
A strong answer is a clear yes or no, written into the contract, with the opt-out stated in plain terms.
8. What happens to our data, and anything built from it, when the contract ends?
A strong answer gives a deletion timeline, an export format you can use, and confirmation that nothing derived from your data stays in their systems.
Watch for a data policy that lives only on a web page the vendor can edit.
What will it really cost?
The subscription is one line of the bill.
9. What will we pay in year one, including usage, integration work and the time our team spends running it?
A strong answer separates the platform fee, usage-based charges, setup and integration, and the hours your team will spend reviewing output. Usage-based pricing deserves a worked example at your volumes, in writing.
Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027. Escalating cost is one of the three reasons it gives.
Watch for a quote that prices the seats and leaves usage as a footnote.
How do you leave if it does not work?
Plan the exit before the start.
10. If we cancel, what do we keep, and how long does the switch take?
A strong answer covers what you can export (configurations, prompts, scoring rules, history), the notice period, and whether renewal terms can raise the price automatically.
If you are hiring a firm to build agents for you, ownership goes further. We cover that in questions to ask before hiring an AI consultant or automation agency.
Watch for a contract with automatic renewal and an export clause that only covers raw data.
What should you ask on the reference calls?
Ask about the second month.
Ask the vendor for two customers with a team and stack like yours. Then ask them three questions.
- What surprised you after the first month?
- What did you have to change in your own process to make it work?
- What would you negotiate differently?
The useful answers come from what went wrong and how the vendor handled it.
The pattern across the ten questions
Each question asks the vendor to show you something. The model, the permissions, the test, the clause, the bill, the exit.
A vendor that is ready for your revenue team will have every one of those on hand.
---
FAQ
What is AI vendor due diligence?
AI vendor due diligence is the process of confirming an AI vendor's claims before you sign. It checks what the AI actually does, what it can access and send, how its output is tested, how your data is used, what it costs, and how you exit.
What questions should you ask an AI vendor before signing?
Ask what the AI does step by step, which systems and fields it can change, and what it can send without approval. Ask how output quality is tested on your data, whether your data trains their models, and what you keep if you cancel.
How do you spot AI washing?
Ask the vendor to walk through one task and say which steps a model performs and which are fixed rules. Vague answers are the signal.
Regulators have acted on it, with the SEC settling two AI washing cases in March 2024 for $400,000 combined.
What should an AI vendor contract say about data?
An AI vendor contract should state whether your data, prompts and outputs can be used to train the vendor's models, with an opt-out in the contract itself.
It should also set a deletion timeline and an export format for when the contract ends.
How do you evaluate AI vendors for a sales team?
Add three checks to a standard AI vendor due diligence checklist.
Find out which CRM fields the tool can change, what it can send to prospects without a rep approving, and how sending volume is limited. Then test it on your own records during the trial.
What is an AI vendor due diligence checklist?
An AI vendor due diligence checklist is a set of questions to answer before buying an AI product.
For revenue teams the ten that matter most cover the AI, permissions, sending, output testing, monitoring, data training, data at exit, total cost, cancellation and references.