# AI vendor and agency RFP questions

Template v1 - 2026-10-18 - MiniAI Labs - https://miniailabs.in/resources/templates/
Free to use and adapt for your own projects. Generic questions for any vendor, including us.

Paste the sections you need into your request for proposal and delete the rest. Each question carries a note on what a complete answer contains, so everyone scoring on your side uses the same bar.

Scoring: 0 = not answered, 1 = vague, 2 = specific, 3 = specific and backed by evidence (a document, a demonstration on your data, a named person).

## A. Understanding of the problem

1. Describe our problem back to us in your own words, including what you would leave out of scope.
   A complete answer restates the task, the users and the measure of success, and names at least one thing it would not do.
2. What do you need from us before you can give a fixed price?
   A complete answer lists specific inputs (sample documents, system access, volumes), not only "a discovery phase".
3. Which part of this project do you consider riskiest, and how would you reduce that risk early?
   A complete answer names one risk and a cheap early test of it.

## B. Approach and architecture

4. Draw the system: its components, the data flow between them, and which parts run in our accounts.
   A complete answer is a diagram you could hand to your own IT team.
5. Which models and providers would you use, and why those? What happens if one is retired or changes its price?
   A complete answer names the choice, the reason, and how a switch would be tested.
6. Where does the system act on its own, and where does a person review or approve?
   A complete answer lists each action and its approval rule.
7. What will the first usable release do, and when will real users see it?

## C. Data handling

8. List every place our data will be stored or processed, including model providers, logs, backups and your own tools.
9. Does any provider use our inputs or outputs to train its models? Show the setting or contract term and the date it was checked.
10. How long is each kind of data kept (conversations, logs, documents, recordings), and who can delete it?
11. How is personal data kept out of prompts, logs and test sets where it is not needed?

## D. Quality and evaluation

12. How will you test quality before launch? Who writes the test cases, and what result counts as a pass?
    A complete answer describes a test set built from our real examples and a pass rule agreed before the first run.
13. How is a change (to a prompt, a model or the data) tested before it reaches users?
14. What will you report to us after launch, and how often?

## E. Safety and misuse

15. How do you defend against prompt injection, such as instructions hidden in a document or email the system reads?
16. Which actions can the system take, with which permissions? How is the damage limited if the model is wrong?
17. What does the system do when it does not know the answer?
    A complete answer shows the refusal or hand-off behaviour, not a promise that it will always know.

## F. Security and access

18. Which accounts, keys and repositories will exist, and in whose name?
19. Who on your team will have access to our systems and data, and how is that access removed at the end?
20. How and how soon will you tell us about a security incident?
21. Which certifications, audit reports or policies can you share? Ask for the documents, not the claim.

## G. Ownership and exit

22. Who owns the code, prompts, workflows, test sets and documentation at the end of each milestone?
23. What do we receive at handover, and could another team run and change the system with it?
24. If we stop working with you, what do we need to do, and what would stop working?

## H. Team and continuity

25. Who exactly will do the work, and who reviews it? What happens if that person is unavailable?
26. What do you need from our team, in hours per week and from which roles?

## I. Price and change

27. Break the price down by phase and deliverable. Which running costs (models, hosting, platforms) are ours, and are they passed through at cost?
28. How are scope changes priced and approved?
29. What is included after launch, for how long, and what does ongoing support cost?

## Red flags in answers

- No architecture drawing, or one that hides where data goes.
- An accuracy figure promised before the vendor has seen your data.
- Accounts, keys or code that stay in the vendor's name after handover.
- No answer to "what happens when it does not know".
- Certifications claimed without a document you can read.

Scoring sheet: one row per question, one column per vendor, plus a notes column for the evidence behind each 3.

Sending this RFP to MiniAI Labs: https://miniailabs.in/company/request-for-proposal/