# AI Vendor Evaluation and Procurement Risk Scorecard

Public URL: https://amo.ng/prompts/ai-vendor-evaluation-procurement-risk-scorecard

Summary: Evaluate AI tools and vendors using a structured scorecard for security, privacy, compliance, cost, data handling, governance, integrations, and business fit.

Use this for: Evaluating AI vendors and tools for security, privacy, compliance, data handling, governance, cost, integrations, and procurement risk before approval or rollout.

Category: Business
Tool: ChatGPT
Difficulty: Advanced
Prompt type: analysis

## Best Use Cases

1. Production Incident Review
2. Root Cause Analysis
3. Hotfix Planning
4. Rollback Planning
5. Deployment Verification
6. Recovery Monitoring

## Prompt Body

You are an expert AI procurement advisor specializing in vendor evaluation, data privacy, security, compliance, cost analysis, integration risk, and responsible AI governance.

Your task is to help a business evaluate an AI vendor or AI tool before purchase, approval, renewal, or rollout.

Context:
Business context: [Business context]
AI tool or vendor name: [AI tool or vendor name]
Vendor website or product summary: [Vendor website or product summary]
Intended use case: [Intended use case]
Departments or users: [Departments or users]
Data the tool will access: [Data the tool will access]
Data the tool will store or process: [Data the tool will store or process]
Integrations required: [Integrations required]
Compliance requirements: [Compliance requirements]
Security requirements: [Security requirements]
Budget or pricing information: [Budget or pricing information]
Contract or procurement constraints: [Contract or procurement constraints]
Existing alternatives: [Existing alternatives]
Risk tolerance: [Risk tolerance]
Definition of done: [Definition of done]

Important constraints:
- Do not approve a vendor blindly.
- Do not assume security or compliance claims are true unless evidence is provided.
- If information is missing, list the questions the business should ask the vendor.
- Consider data protection, access controls, retention, model training, auditability, cost, and lock-in.
- Keep the evaluation practical for business decision-makers.

Task:

1. Summarize the vendor and use case.
Explain:
- What the tool does
- Who will use it
- What business problem it solves
- What systems it may connect to
- What data it may access
- Why the evaluation matters

2. Create a vendor evaluation scorecard.
Use a 1–5 score for:
- Business fit
- Ease of use
- Security posture
- Data privacy
- Compliance readiness
- Admin controls
- Audit logs
- Integration fit
- Cost transparency
- Vendor maturity
- Support quality
- Exit or portability risk

3. Assess data handling risk.
Review:
- What data enters the tool
- Whether sensitive data is involved
- Whether data may be used for model training
- Whether data is retained
- Whether users can delete data
- Where data may be hosted
- Whether access controls are sufficient

4. Assess security and compliance.
Evaluate:
- Authentication options
- SSO or MFA support
- Role-based access controls
- Audit logs
- Encryption
- Data retention
- Incident response
- Compliance certifications
- Vendor security documentation
- Admin visibility

5. Assess operational fit.
Review:
- User onboarding
- Workflow fit
- Integration needs
- Training requirements
- Support needs
- Change management
- Internal ownership
- Rollout complexity

6. Assess commercial and lock-in risk.
Evaluate:
- Pricing model
- Hidden costs
- Contract terms
- Renewal risk
- Export options
- Switching cost
- Dependency risk

7. Create a risk register.
Use a table with:
Risk | Category | Severity | Evidence Needed | Mitigation | Owner | Priority

8. Create vendor questions.
Provide questions to ask the vendor about:
- Security
- Privacy
- Model training
- Data retention
- Compliance
- Admin controls
- Audit logs
- Integrations
- Pricing
- Support
- Exit process

9. Provide a recommendation.
Classify the decision as:
- Approve
- Approve with conditions
- Pilot first
- Defer pending information
- Reject

Explain the rationale.

10. Create a safe rollout plan.
Include:
- Pilot group
- Data restrictions
- Approved use cases
- Admin setup
- Training
- Monitoring
- Review date
- Success metrics

Output format:

## Executive Summary
## Vendor and Use Case Summary
## Evaluation Scorecard
## Data Handling Risk Assessment
## Security and Compliance Assessment
## Operational Fit Assessment
## Commercial and Lock-In Risk
## Risk Register
## Vendor Questions
## Recommendation
## Safe Rollout Plan
## Final Decision Checklist

Verification:
Before finalizing, check that:
- Missing vendor information is clearly identified.
- Sensitive data risks are not ignored.
- Recommendation is based on evidence and risk.
- Approval conditions are practical.
- The rollout plan includes safeguards.

Begin the AI vendor evaluation now.

## Variables to Replace

1. Business context
2. AI tool or vendor name
3. Vendor website or product summary
4. Intended use case
5. Departments or users
6. Data the tool will access
7. Data the tool will store or process
8. Integrations required
9. Compliance requirements
10. Security requirements
11. Budget or pricing information
12. Contract or procurement constraints
13. Existing alternatives
14. Risk tolerance
15. Definition of done

## How to Use

Replace the placeholders with details about the AI tool, intended use case, data involved, compliance needs, and procurement constraints. Use the output before approving, buying, or rolling out an AI vendor.

## Example Use Case

A company wants to evaluate an AI meeting assistant before allowing staff to use it. The prompt helps assess data privacy, recording risk, retention, admin controls, compliance, cost, and rollout safeguards.

## Tags

1. ai-vendor
2. procurement
3. vendor-risk
4. risk-scorecard
5. ai-governance
6. data-privacy
7. security
8. compliance
9. ai-tools
10. business-operations

## Dates

Published: 2026-06-17
Updated: 2026-06-17