The AI RFP Template: 50 Questions Every Buyer Should Ask

An RFP (request for proposal) forces vendors to answer specific questions about capability, cost, and risk. Don't use a vendor's standard RFP template—they'll craft it to make themselves look good. Write your own. Below are 50 questions organized into seven categories: cost modeling, attribution and analytics, integration and lock-in, performance and reliability, data and compliance, vendor sustainability, and contract terms. Customize by removing questions that don't apply to your use case, and add your own domain-specific questions.

Cost Modeling (8 questions)

1. What is your cost per resolved work item for a customer of our size and use case? Provide a specific dollar figure and state your assumptions (volume, resolution type, escalation handling).
2. What is the 95th percentile token usage per resolved work item in your production deployments for similar use cases?
3. How does your pricing scale when we exceed your standard tier? (E.g., tier 1 = 0–10K items/month; tier 2 = 10K–50K items/month.) Provide pricing at each tier.
4. Do you have a true-up clause if we exceed volume? If yes, what is the price per overage unit, and when is it invoiced?
5. Do you have a true-down clause if we use less volume than forecast? If yes, how is the credit applied?
6. What is included in your per-request fee? Does it include retries, model fallback calls, vector retrieval, and tool calls to third-party APIs?
7. What is not included in your per-request fee, and what would we be charged separately for? (E.g., logging, observability, data storage, etc.)
8. How often do you adjust your pricing? What was your price change in the past 12 months? Can you commit to a cap on annual price increases?

Attribution and Analytics (8 questions)

9. Can you expose cost per work item (not just per request) in your API responses? If yes, what metadata is included?
10. Do you tag each API response with the work-item ID that initiated it, so we can join cost with outcome data?
11. Can you provide batch cost reporting aggregated by work-item class or category?
12. What is the latency for cost data to be available? (Is it real-time in the API, daily, or monthly in a report?)
13. Can we export raw cost and usage logs in JSON, CSV, or Parquet format?
14. Do you provide a cost dashboard that shows cost per work item, cost per category, and cost trends over time?
15. Can you break down cost by component (token cost, tool calls, retries, etc.) at the work-item level?
16. What is the retention period for cost and usage logs? Can we access historical data for the entire contract term?

Integration and Lock-In (9 questions)

17. What are your API rate limits, and are there additional costs if we exceed them?
18. How many concurrent API calls to our systems (CRM, ticketing system, data warehouse) can your system make, and is that included in your pricing?
19. What is your typical API latency (p50, p95, p99) for real-time tool calls to third-party systems?
20. Do you support model agnosticism? (I.e., can we swap Claude for GPT-4 without rearchitecting our agent?)
21. If you deprecate a model we depend on, how much notice do you provide, and what is our upgrade path?
22. What happens if we want to port our prompts and fine-tuned models to a different vendor? What is the export format and latency?
23. How easily can we export our conversation history and training data in standard formats (JSON, Parquet)?
24. What is your data retention policy if we terminate the relationship? How long do we have to export data before deletion?
25. Describe your vendor lock-in vectors. (Model-specific? API-specific? Data format-specific?) How do you mitigate them?

Performance and Reliability (8 questions)

26. What is your published uptime SLA, and for how many years have you met it?
27. What is your p50 and p99 latency for API requests? How does latency scale with volume?
28. Do you have automatic rollback or fallback if model quality degrades? If yes, how is degradation detected?
29. What is your incident response process? What is your average time to detection and time to resolution for production outages?
30. Do you offer geographic redundancy or multi-region failover?
31. What happens during planned maintenance? Is there a maintenance window, and if so, what is the frequency and duration?
32. Do you offer dedicated infrastructure or a shared-tenant model? If shared, how many other customers share your infrastructure?
33. What is your scaling capacity? If we 10x our volume overnight, can your infrastructure handle it without service degradation?

Data and Compliance (8 questions)

34. Where are your data centers located, and what data residency options do you offer? (E.g., US-only, EU-only, etc.)
35. Do you support data encryption at rest and in transit? What encryption standard do you use?
36. What compliance certifications do you hold? (SOC2 Type II, HIPAA, GDPR, FedRAMP, HITRUST, etc.)
37. Do you conduct regular security audits? When was your most recent audit, and can you share the SOC2 audit report under NDA?
38. What is your data deletion policy? If we request data deletion, how long does it take?
39. What is your data retention policy for logs, cost data, and conversation history?
40. Do you have a Data Processing Agreement (DPA) in place that aligns with GDPR and CCPA requirements?
41. Can you provide a list of sub-processors and their data locations?

Vendor Sustainability and Roadmap (6 questions)

42. How long has your company been in business? What is your current funding status and runway? (This matters for vendor stability.)
43. What is your customer retention rate? What percentage of customers renew after their first contract?
44. Describe your product roadmap for the next 12 months. Are there planned pricing changes or capability shifts?
45. What happened to customers when your previous vendors (if any) shut down services or were acquired?
46. Who are your key dependencies? (E.g., do you rely on OpenAI/Anthropic/Google for model access?) What happens if those relationships change?
47. What is your go-to-market strategy for 2026? Are you expanding into new verticals, and if so, could that affect service quality for existing customers?

Contract Terms and Commercial (11 questions)

48. What is the minimum contract term? Can we start with a 3-month pilot before committing to a 12-month contract?
49. Do you have a most-favored-nations (MFN) clause? If you offer better pricing to a similar customer, do we get the same rate?
50. What are your termination rights? Can we terminate with 30 days' notice without penalty if cost-per-outcome exceeds our baseline by >20%?

Bonus questions for deep evaluation:

51. Do you allow third-party cost audits? Can your invoice be audited by our accounting firm on an annual basis?
52. What is your customer support model? Do we get a dedicated account manager, and if so, what is their availability (24/7 or business hours)?
53. What insurance do you carry? (E&O, cyber liability, etc.)
54. Are there any ancillary fees (onboarding, training, support, custom integration work) not captured in the per-item pricing?
55. Can you provide references from three customers in our vertical with similar use cases and volume?

How to score vendor RFP responses

Use the vendor evaluation rubric from the pillar article. For each dimension (cost transparency, attribution, lock-in, performance, compliance), score vendors 1–5, multiply by the weight (cost 25%, attribution 25%, lock-in 20%, performance 15%, compliance 15%), and rank. This forces objectivity and prevents a single vendor from winning on sales charm alone.

Share the RFP with three finalists and give them two weeks to respond. Vendors who miss the deadline should be deprioritized—execution matters. After you score responses, run demos with the top two vendors and negotiate a POC. For details on the full evaluation process, see "How to Buy AI: The Executive's Vendor Evaluation Guide."