Uptime percentage is the easy part of the review
Most procurement reviews of an AI vendor contract check the headline uptime SLA and move on — but for an AI-specific dependency, the operational risks that actually cause disruption tend to live in terms a standard SaaS review doesn't specifically ask about.
A silent model change can be as disruptive as an outage
An AI vendor swapping the underlying model — for cost, capability, or licensing reasons — can change output quality, behavior, or even format in ways that break a downstream integration, without the service technically going "down" in any way the standard uptime SLA would capture. A contractual commitment to advance notice before such a change is a specific, checkable term worth requiring.
Data retention and training-use terms need to be contractual, not aspirational
A vendor's general privacy page describing data handling in broad terms is not the same as a contractual commitment specific to your account and data — especially for training-use, where a general policy can change without renegotiating your specific contract, while an explicit contractual term cannot.
Wrapped third-party models are a hidden dependency
A vendor built on top of a third-party foundation model inherits that model's reliability history, pricing changes, and potential deprecations — a dependency worth knowing about explicitly, since it affects your actual risk exposure regardless of the vendor's own branding and reputation.
Exit terms matter before you're trying to use them
The moment you actually need clean data export and confirmed deletion — switching vendors, ending a contract, responding to a compliance request — is the worst time to discover the contract never specified how that works. Reviewing exit terms before signing, not after deciding to leave, is what actually protects you.
Frequently Asked Questions
A silent underlying model change can disrupt output quality or behavior without the service technically going 'down' in any way a standard uptime SLA captures — real operational risk includes terms like model-change notice and latency, not just uptime percentage.
A general privacy policy can change without renegotiating your specific contract, while an explicit contractual data-retention and training-use term specific to your account cannot — the difference matters especially for whether your data is used for model training.
A vendor built on top of a third-party foundation model inherits that model's reliability history, pricing changes, and potential deprecations — a hidden dependency that affects your actual risk exposure regardless of the vendor's own branding.
Before signing. The moment you need clean data export and confirmed deletion — switching vendors, ending a contract, a compliance request — is the worst time to discover the contract never specified how that works.
No. All scoring runs and saves in your own browser via localStorage — nothing is uploaded, making this safe to use for an internal procurement review.