Buy AI Services With a Complete Data Map

02An assistant summarising public product manuals has different data needs from a service answering questions about employee absence.

03Define the first task, its intended users and the records it needs.

04List the actions the tool may perform.

05Reading a document and sending its contents to a customer should be separate permissions.

06Ask the business owner what success looks like without assuming every available feature must be enabled.

07A narrower task can be easier to evaluate and may reveal that sensitive information is unnecessary.

08Record prohibited inputs in practical terms.

09For example, a purchasing assistant may use approved supplier specifications while excluding employee case files and unrelated customer drawings.

10Users need examples they can recognise during normal work.

02Then add conversation history, usage logs, backups and support troubleshooting.

03These secondary paths can change the procurement assessment.

04The ICO's contracts guidance addresses processing instructions, confidentiality, security, subprocessors, assistance, end-of-contract arrangements and audit rights.[

051] Use those topics to request evidence, while having the actual terms reviewed for the service's roles.

06Do not assume every provider component has the same role.

07A business may process data on instructions for one activity and use some information for its own purposes elsewhere.

08Ask for an activity-specific explanation.

09Separate a supplier promise from a setting you can configure.

10If retention depends on disabling history or selecting a particular service tier, document who applies the setting and how the business will detect later changes.

022] Procurement therefore needs to understand relevant recipients and access arrangements, not just a storage-region label.

03Ask which organisation provides support and which entities operate downstream processing.

04A map showing servers alone may omit the relationships needed to assess the arrangement.

05Where a restricted transfer is identified, ask the responsible privacy adviser to determine the applicable route and supporting assessment.

06Do not let a sales assurance that the product is compliant replace that work.

07This does not mean every overseas connection is automatically prohibited.

08It means the decision needs enough specific information to apply the correct rules and agree an acceptable service configuration.

02Some documents contain named contacts, phone numbers and commercial terms.

03The initial demo uses public examples.

04Before production use, the buyer asks how real files enter the index, whether deleted quotations remain in logs, and which support organisations can inspect a failed request.

05The team removes personal contact details from the initial dataset because the task concerns specifications and price comparisons.

06It keeps an authorised route to the original quotation for staff who need the contact.

07Then it tests an intentionally unavailable document.

08The assistant should explain the access limit rather than answering from a cached copy belonging to another user.

09That behaviour is part of the purchasing evidence, not an optional polish item.

02Mark unanswered questions explicitly.

03A partially completed questionnaire should not become a blanket approval because the trial account already exists.

04Assign each unresolved item to a business, technical or privacy owner.

05This prevents the IT manager from being asked to approve legal terms and the finance director from being asked to judge retrieval permissions alone.

06The tradeoff may be accepting less functionality to obtain a clearer service boundary.

07A tool that cannot meet the required retention or access controls might still be suitable for public information, subject to a separate decision.

08Capture the approved configuration and dataset categories in the onboarding instructions.

09Procurement work has little value if employees later enable an unassessed connector because it appears in the product menu.

02Ensure the business can remove a departing employee without losing shared evidence or leaving their personal account as the service administrator.

03Test how approved documents and decision records can be exported.

04A contract promising portability is more useful when the team knows what the export contains and how another system would read it.

05Review the approval when the task changes materially, such as adding employee records or external sending.

06An earlier assessment should not silently expand to a different purpose.

07The next deliverable is a service map with a bounded approval decision.

08That gives users a useful starting point and gives the business a way to expand AI on evidence instead of accumulating subscriptions it cannot explain.