AI Vendor Risk · A Buyer’s Checklist.
PH—019
Most AI vendors sell you a dependency. Here is the checklist every buyer should run before signing. Twelve questions that separate software you can keep from software that leaves when the vendor does.
I The Dependency Problem
Enterprise AI procurement, in most forms, produces a dependency. You pay a monthly license. The model runs on the vendor’s infrastructure. Your data moves through it. If the vendor disappears, your capability disappears with them.
This is not unique to AI. It is more acute in AI because the vendor landscape is younger, the capability is more central to the business, and the switching costs are steeper. A buyer who signs without a clean answer to the following questions has bought an option, not an asset.
II The Twelve Questions
- Does our data stay in our tenancy? — If no, what processing happens elsewhere, under what agreement?
- What happens to the software if your company disappears? — Is there an escrow? A perpetual license? Source access?
- Who operates the software day to day? — Is it your team or does it require the vendor’s continued involvement?
- Is the software inspectable at the decision level? — Can my compliance team trace individual outputs to their inputs?
- What happens when the underlying foundation model changes? — Do we have to re-validate? Does the vendor handle it transparently?
- What is the exit path? — Can we leave in thirty days, ninety days, never?
- Is the pricing predictable? — Does compute cost flow through to us? Is there a cap?
- Is there an audit trail? — Native to the product, not an add-on?
- Who owns the derived data? — Outputs, fine-tunes, learnings from our install?
- How do you handle a major model provider policy change? — Has it happened before? What did you do?
- What regression protection do you run when you ship an update? — Four gates? One? None?
- What is the team retention structure? — If the engineer who built my install leaves, what happens?
III Two Answers That End the Call
Some answers to the above are negotiable. Two are not.
If the answer to question two (“what happens if your company disappears?”) is “we will always be here,” end the call. Every company answering that question today has said that question at some point. Some of them were correct. You do not know which ones yet.
If the answer to question four (“is the software inspectable?”) is “we do not expose that,” end the call. The vendor is telling you they cannot help you if a regulator asks what the system did. That is not acceptable at enterprise scale.
IV What Perpetual License Actually Means
Our own answer to the checklist is that Terrein ships with a perpetual license on the software and a live service contract on the refresh cadence. The service can lapse. The software cannot. If we disappear, the last version of the OS you installed keeps running in your tenancy indefinitely. Your operations team can maintain it. You can hire any competent ML ops engineer to keep it running.
This is not a marketing position. It is a technical architecture. The system is designed to survive our absence. That is what “no vendor lock” means when it means something.