Selling AI to a regulated buyer: the questions procurement will ask

What's changing

Regulated buyers used to ask about security and uptime. Now they also ask about AI. The questions vary, but they cluster around the same handful of themes, and they tend to arrive late in the deal, when a slow answer costs you the quarter.

The questions that come up

Where does the data go? Which model providers touch customer data, in which countries, for how long, and whether it's used for training. Expect to name every sub-processor.

How do you know it works? How you test, how often, on what data, and what the failure rate is. Having an evaluation set and the results to show is a major advantage.

What happens when it's wrong? Who can override it, how errors are caught, and how a user can appeal a result.

Can you explain it? For decisions about people, can you say why the system reached an outcome.

Who's accountable? A named owner, an incident process, and how a customer is told when something goes wrong.

What happens if a provider changes? Whether you can swap models, and what that does to your guarantees.

Build an answer pack once

Write the answers down once, keep them current, and attach evidence. A short document that covers each theme above, with links to your test results, data flow diagram and incident process, will answer most questionnaires.

What to do this month

1. Draw your data flow. One page showing where customer data goes, including every vendor.
2. Summarize your testing. What you test, how often, and the latest results.
3. Write your override and escalation process. In plain words.
4. Name an accountable owner. One person, with a backup.
5. Run a mock questionnaire. Ask someone outside the team to try to answer it from your documents. The gaps are your to-do list.