TL;DR
I sit through a lot of AI vendor pitches now. Most of them follow the same arc, hit the same beats, and ask for the same six-figure annual commitment. The three questions below cut through that arc faster than any RFP scoring rubric. If a vendor cannot answer them in plain English in the first thirty minutes, the pitch is over. Use this before you let your team start drafting a contract.
There are weeks where I get on three AI vendor calls before lunch. Some are for clients. Some are for my own work. The volume is high enough that I have started keeping a small list of the questions that actually separate the serious vendors from the pretenders.
Here are the three I run every time. They are short. They are unromantic. They almost always work.
Question one: “What part of your product is yours, and what part is the foundation model doing the work?”
This is the most uncomfortable question for an AI vendor in 2026, which is exactly why it has to be asked first.
A good answer sounds something like this. “Our product is a workflow layer, a domain knowledge corpus, a data pipeline, and an evaluation harness. The reasoning happens at the foundation model. We use a mix of models depending on the task. The defensible part of our product is the work we have done on the corpus and the evaluation.”
A bad answer sounds like this. “Our proprietary AI engine has been trained on…” Stop. Walk away. Or at least slow the conversation down considerably.
Why this matters. A vendor that does not have a clear, honest map of what is theirs and what is rented is a vendor that will struggle when foundation models change underneath them. And foundation models will change. Continuously. Every six to nine months. The vendors who are well-positioned for that have a clear architecture. The vendors who are not are essentially a UI on top of an OpenAI or Anthropic API with a markup.
You are not buying a UI. You are buying a partner for a five year journey.
Question two: “Show me a customer who started six months ago. What does their usage look like now?”
This question goes underneath the case study slide that every vendor has prepared. The case study slide will always show a customer that loved the product. The usage curve will show you whether the product earned that love over time.
Three things to listen for. First, is usage going up, flat, or down? Vendors who proactively show you a customer where usage is climbing month over month are doing it because they have it. Vendors who pivot to a different example are doing it because they do not.
Second, are the users the same people who bought it? In AI vendor pitches, the buyer is often a senior leader who is excited about the product. The actual users are usually three layers down. If the senior leader is the only one using the tool six months in, you are buying shelfware.
Third, what is the renewal posture? You will not get the answer to this from the vendor. You will get it from a customer reference call, which you should always ask for, and which the vendor should be able to schedule inside a week. If the customer reference is hard to schedule, that is the answer.
This question is not about being skeptical of the product. It is about being realistic about how AI tools land inside organizations. A six-month usage curve tells you more than any pitch deck ever will.
Question three: “What is your model governance posture, and what documentation can you give us for our regulator, our board, or our risk committee?”
This question is the one that ends conversations the fastest.
Most AI vendors selling into financial services and law firms have a slide on compliance. The slide says all the right things. Encryption at rest. SOC 2. Sometimes a note about HIPAA or BSA/AML. What the slide almost never includes is the documentation a regulator, a board, or a risk committee will actually ask for in the year after you sign.
Here is what real documentation looks like. A model risk management framework that aligns with SR 11-7 (for banks) or the equivalent guidance for your regulator. Data lineage documentation that traces where the model’s training data and your inputs go and come back from. An evaluation methodology that shows how the vendor monitors model performance over time. A clear policy on what happens to your data, including whether it is used for training. A red team or jailbreak testing summary. An incident response process with examples.
If a vendor cannot show you these, in writing, within a week of a serious conversation, they are not ready to sell to a regulated institution. They may be a fine product. They are not a fine product for you yet.
This is the question I see kill more deals than any pricing conversation. It should be asked earlier, not later. Save your team the time.
Why these three and not ten
I get asked this a lot. There are obviously more than three questions worth asking. ROI, integration timelines, support model, pricing structure, contract terms. All worth asking. None of them as discriminating in the first thirty minutes as the three above.
What the three questions share is that they each surface a structural truth about the vendor. Question one surfaces the architecture. Question two surfaces the customer reality. Question three surfaces the governance maturity. A vendor who is strong on all three is a real partner. A vendor who is weak on any of them is a risk you should price into the conversation, not paper over with a positive demo.
The questions also share something else. They are uncomfortable for the vendor to answer in a structured way. Which means the answer you get tells you as much about the vendor’s posture as it does about their product. The vendor who welcomes the question is one kind of partner. The vendor who deflects is another.
The bottom line
If you are evaluating an AI vendor this quarter, run these three before you let the conversation go any further. Architecture, customer usage, governance. Thirty minutes is enough. If the vendor passes, you have earned the right to spend the next several months in serious diligence. If the vendor stumbles, you have just saved your team a quarter of work.
The AI vendor market is still expanding. The number of new entrants is still going up. Most will not be standing in three years. Your job is not to be excited about every pitch. Your job is to find the small number of vendors who will be standing, and who will be standing alongside you.
The three questions are not a complete framework. They are a filter. Filter early. Diligence later.
Kevin Farley writes about AI visibility, AI readiness, and strategic growth for financial services. Read more on the blog.