Checklist for procuring AI

The market for AI solutions is growing fast, and most demos look impressive. The differences only show when you ask the right questions, and when you try it with your own documents instead of the supplier’s examples. This checklist gathers the essentials. You do not need every answer yourself, but you do need to ask the questions.

Start with the need

Before comparing solutions, decide what you want to achieve. Which tasks take the most time today, and which documents are needed to handle them? Which group should benefit first, and how will you know it works? A clear first task makes evaluation easier, and makes the value easier to show when the decision needs support.

Decide too which requirements are absolute and which are preferences. That your data is never used to train models may be absolute. A particular interface may be a preference. That distinction makes the comparison much clearer.

The questions to ask

• Can the whole chain run in our own environment, including the language model, and fully isolated with an air gap when needed?
• Do we get a separate installation, or do we share an environment with other customers?
• If the supplier hosts it, where is the installation and under which agreement?
• Is our data used to train models or to improve the service for other customers?
• Does sign-in work with our existing accounts via SSO, with MFA?
• Is access controlled by role (RBAC), and can we limit which documents each assistant may read?
• Do sensitive changes require approval from two people?
• Is there a tamper-evident audit log that can be connected to our SIEM?
• Is traffic encrypted with TLS and stored data with AES-256?
• Can we set retention per type of data, and is legal hold supported?
• Can data be exported and erased per user under GDPR?
• Does the solution answer from our own documents, and does every answer show which documents it is based on?
• Can we write our own instructions for how the assistant answers?
• What happens to our data when the contract ends, and how is deletion confirmed?

Try before you choose

A demo with the supplier’s examples says little about how it works for you. Ask to run a short pilot with defined material and a small group of users. Decide in advance what to assess. Answer quality, how easy it is to get started and how well the solution fits your security requirements.

Think about usability too. A tool nobody uses protects nothing. Is the solution where people work, on desktop and on mobile? How long does it take to get a first assistant running? If your own tool is awkward, people will find something else, and the procurement will not have solved what it set out to.

Do not forget the exit. It is easy to overlook when everything is new, which is exactly why it belongs in from the start. If you know where the data is and how it is exported and deleted, you stay in control all the way.

A pilot also shows how the supplier works with you. How quickly do they answer questions, and how well do they understand your organisation? That often says as much as the product itself.

How it works in iSearch

The whole chain in iSearch can run in your own environment, fully isolated when required, or be hosted by us in a separate installation. Every customer gets its own installation, and your data is never used to train models.

SSO, MFA, role-based access, the four-eyes principle, a tamper-evident audit log and legal hold are included. Traffic is protected with TLS and stored data with AES-256. Every answer shows which documents were read, and data can be exported and erased per user.

Read more about security, see the product or book a walkthrough.