More than they’ll expect. Most vendor AI pitches are designed to generate enthusiasm and defer the hard questions — so asking them early is the most useful thing you can do.
What data does this tool use, and where does it go?
You want to know whether your data is used to train the model, who has access to it, and where it’s processed. If the vendor can’t answer this clearly, that’s your answer.
Is this tool making decisions, or informing them?
The distinction matters legally and practically. A tool that recommends is different from one that decides. Under Australia’s updated Privacy Act, if a computer program uses personal data to make a decision that significantly affects someone — a customer, a job applicant, a claimant — specific obligations apply. Know which side of that line you’re on before you sign anything.
What happens when it’s wrong?
Every AI tool is wrong sometimes. Who’s responsible when it is? Does the vendor’s contract try to disclaim liability for outputs? Many do.
What’s your data processing agreement?
This should be a standard document they can produce without hesitation. If they’re not sure what you’re asking for, that tells you something.
How do we exit if we need to?
Data portability, contract terms, and exit provisions matter more than most buyers realise at the pitch stage.
You don’t need to be technical to ask any of these. They’re governance questions, not engineering ones. A vendor that can’t answer them confidently hasn’t thought hard enough about enterprise deployment.
If you’d like a short checklist to take into the room, get in touch — or book a free call if you want to talk through the broader picture.
This content is for general information only and does not constitute legal advice. For advice specific to your circumstances, consult a qualified Australian privacy lawyer.
