Start with the workflow outcome
Describe the repeatable legal job, users, source systems, output, destinations, accountable reviewer and prohibited actions. Give bidders representative volumes, languages and evidence requirements without disclosing live client data. Separate required capabilities from optional connectors, memory, browsing and external actions.
Require the seller and architecture
Ask who contracts, hosts, processes, supports and subcontracts each component. Require regions, identity, keys, administrators, encryption, network path and support access. A familiar cloud brand does not establish where the underlying model runs. Request the document chain and a responsibility map.
Control model lifecycle and safeguards
Require exact model IDs, alias behavior, active or preview status, lifecycle and deprecation evidence, default and optional safeguards, evaluation limits and the route for restricted capabilities. Ask how a customer discovers which model handled a run. Require time to test material changes, rollback or suspension and a support path when a prior version disappears.
Make data and audit answers testable
Ask separately about training, product improvement, service retention, abuse or safety logs, files, caches, feedback, human access, subprocessors and customer copies. Require export and deletion procedures for each relevant feature. For audit, require identity, model, input reference, source set, tool request, permission decision, approval, result, destination, error and final disposition.
Price the completed service and the exit
Request seats, usage, tools, grounding, storage, support, minimum commitments and reviewer effort in comparable units. A low token rate is not a low completed-task cost. Require usable export of content, configuration and audit records, transition support, deletion evidence, post-termination duties and continued access during a defined exit.
Score a proposal only after blocking evidence requirements pass. This guide explains the evidence shape; counsel adapts contract language and jurisdictional requirements.
FAQ
Should procurement name a preferred model?
It may identify tested candidates, but the durable requirement is the route, capability, evidence and change process.
Can a SOC report replace product testing?
No. Review scope and period, then test the customer controls the workflow depends on.
What is the most useful commercial comparison?
Completed-task cost under the same workflow, sources and review standard, plus exit and change risk.
Sources checked
- AI Risk Management Framework, checked 2026-09-03.
- ABA Formal Opinion 512, checked 2026-09-03.
- OpenAI Services Agreement, checked 2026-09-03.
- Anthropic Commercial Terms, checked 2026-09-03.
- Gemini API Additional Terms, checked 2026-09-03.
Operational information, not legal advice. Verify current terms, account configuration and applicable professional duties before use.