An AI proposal for a government, healthcare or financial-services organisation needs to address more than the feature itself. Reviewers will want to understand the information involved, who remains accountable and what happens when the system produces an unsuitable result.
The questions below are a starting point for a procurement conversation, not a complete compliance checklist. Ask your organisation's security, data-protection, legal and relevant domain specialists to identify the requirements for the actual use case.
Record each system the information would pass through: application, model provider, region, subprocessors and any monitoring or logging service. Establish the permitted uses, retention periods, access controls and arrangements at contract end.
Check those answers against the selected service, configuration and contract. Terms such as enterprise, in-region or zero retention need supporting detail; do not assume they describe every request, feature or log. Resolve gaps before using real customer, patient or staff information.
Distinguish drafting or summarising for a person from taking an action that affects someone. State where human review occurs, what information the reviewer sees and how they can reject or correct an output. A person who lacks the time or authority to challenge the result is not a useful control.
Ask the organisation's advisers which rules and approvals apply to the proposed decision. Agree the permitted actions and the access needed to carry them out, rather than giving the system wider authority for convenience.
Define representative evaluation cases, success criteria and unacceptable errors with the people responsible for the process. Include difficult inputs, missing information and cases the system should escalate. Record how the test data was selected and which limitations remain.
A focused prototype or technical experiment can investigate those questions. Its findings should support a decision about further work; they do not by themselves establish that a live service is ready for every workload.
Agree who investigates an incorrect output, how users report a problem and when the service should fall back to an existing process or be stopped. Plan the evidence needed for an investigation, including relevant changes to models, prompts and source information.
Balance that evidence with data minimisation. Logging every prompt and response without considering its contents can create another sensitive data store. Agree access, redaction and retention as part of the design.
Name the business and technical owners. Agree who approves changes, who monitors the result and how the feature will be withdrawn if it no longer meets the requirements. Include supplier changes and the continued work needed to maintain evaluation data.
Our internal Watchkeeper security-evidence tool has a deliberately limited role: it reviews reports and flags items for people to investigate. People remain responsible for server changes and baseline approvals.
Ask for relevant delivery examples, secure development practices, access arrangements and the scope of any current certifications. Establish what each example demonstrates and which project-specific checks still need to be carried out.
Our technical assurance approach explains how we discuss testing, security and operating responsibilities. The requirements for your application need to be agreed alongside that general approach.
Include usage charges, integration, evaluation, human review and ongoing support in the operating budget. Test the assumptions at expected and higher workloads. Ask which costs could change if the provider or model changes.
Agree what your organisation can retain or export, including its data, application code and evaluation records, and what is specific to the selected provider. Document the handover and deletion arrangements before they become an exit problem.
Record an answer, evidence and an owner for each relevant question. Some gaps may need investigation or may prevent the proposed use; they should stay visible in the decision to proceed.
Our AI readiness assessment guide helps frame the initial investment decision. If you need help with that assessment or an agreed implementation, our AI consulting and automation service describes the available starting points.