Before You Sign an AI Vendor Contract: A Buyer’s Checklist for Mid-Market Owners and Operators

Before You Sign an AI Vendor Contract: A Buyer’s Checklist for Mid-Market Owners and Operators

2026-10-24

Takeaway: The demo shows you what an AI tool can do. The contract decides what happens to your data, whether you can test the thing honestly, and how painful it will be to leave. Before you sign, settle five things in writing: data use, testing rights, change notice, exit terms, and pricing.

Most AI buying regrets aren’t about picking the “wrong model.” They come from signing paper that quietly hands away leverage you’ll want back later.

Borrow the federal government’s homework

On April 3, 2025, the White House Office of Management and Budget (OMB) issued Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government”. It’s written for federal agencies and is still listed as active on OMB’s memoranda page, but it doubles as one of the clearest public checklists for buying AI. Each section below translates one requirement into mid-market terms.

1. Pin down what the vendor can do with your data

M-25-22 tells agencies to write contracts that “permanently prohibit” a vendor from using nonpublic agency inputs and outputs to further train publicly or commercially available AI, unless the agency explicitly consents. It also says vendors should collect and keep agency data only when “reasonably necessary” for the contract.

Your version: get written answers to these questions.

  • Do you train on our prompts, files, or outputs? Does the answer change by plan tier?
  • What about usage data (how we use the product, not what we put in)?
  • How long do you keep our data, and where is it stored?

Why the fine print matters: In 2023, Zoom drew backlash over terms-of-service language about AI training. The Associated Press reported that language added that March separated “customer content” from “service generated data” and allowed the latter to be used for training AI models. Zoom revised its terms of service on August 11, 2023, to state that it does not use audio, video, chat, and similar customer content to train Zoom or third-party AI models, and explained the change on its blog. The lesson isn’t “avoid Zoom.” It’s to read the definitions: a promise about one kind of data can leave another kind open, and terms change.

2. Get the right to test it on your own work

M-25-22 says agencies must, to the greatest extent practicable, test proposed AI solutions before award. It asks for demonstrations that closely reflect the real working environment. It also requires contract terms that let agencies run their own evaluations on data the vendor can’t see, and that don’t stop agencies from sharing test results internally.

Your version: build a small test set from real work, such as a few dozen past invoices or support tickets with known correct answers, and keep the answers from the vendor. Agree in writing on what “good enough” means before the pilot starts, and tie the full rollout to hitting it.

3. Require notice before the product changes under you

M-25-22 suggests requiring vendors to notify the agency before adding new AI features. It also encourages requiring vendors to meet agreed performance standards before releasing a new version, or to roll back if a new version falls short.

Your version: ask for advance notice of model swaps, new AI features switched on by default, and new subprocessors (the other companies that handle your data on the vendor’s behalf). Ask what happens if an update makes results worse.

4. Write your exit before your entrance

M-25-22 lists protections against vendor lock-in: knowledge transfer, data and model portability, clear licensing terms, and transparent pricing. When a contract ends, it says both sides should agree on the format and usability of any data, and on a plan for transferring it. The NIST AI Risk Management Framework (January 2023) makes a related point in its GOVERN 6.2 subcategory: have contingency processes for failures or incidents in third-party AI systems you consider high-risk.

Your version:

  • What export format do we get (CSV, JSON, documented API), and does it cost extra?
  • Who owns the prompts, workflows, and custom models we pay you to build?
  • How long can we reach our data after we cancel, and will you confirm deletion in writing?
  • If you shut this product down, how much notice do we get?

5. Make pricing boringly predictable

A footnote in M-25-22 flags pricing practices that push buyers to concentrate spend with one vendor: bulk pricing arrangements, tying, minimum spend requirements, and exclusive discounts. Those can be good deals or handcuffs.

Your version: know whether you pay per seat or per use (for AI, often per “token,” a small chunk of text the model reads or writes). Ask for usage caps, overage alerts, and a cap on renewal price increases. Model a heavy month, not just an average one.

Who should be at the table

M-25-22 asks agencies to assemble a cross-functional team, naming expertise such as acquisition, IT, cybersecurity, privacy, legal, budgeting, and data. The NIST AI RMF Playbook (GOVERN 6.1) likewise suggests policies on transparency into third-party AI systems and thorough testing. For a mid-market company, that usually means four people: the leader who owns the process, whoever runs IT or security, finance, and someone who can review contracts.

The one-page checklist

  • Data: no training on our inputs or outputs without written consent; retention limits stated.
  • Testing: a pilot on our own data, success criteria agreed in advance.
  • Change: notice before model, feature, or subprocessor changes.
  • Exit: export format, ownership of what we build, post-termination access, deletion confirmation.
  • Price: unit of billing, caps, alerts, renewal limits.

The bottom line

Good AI vendors won’t flinch at these questions, and vague answers tell you something too. If you’d like a seasoned second opinion on an AI vendor shortlist or contract, that’s the kind of work a Yellow Coop fractional CTO takes on. Get in touch.

Sources