Procurement departments are tasked with purchasing products that did not exist several years ago and that rarely come via formal request. A department head has piloted a tool, a contract arrives with a deadline, or a corporate card statement shows a dozen subscriptions to generative AIs. The standard purchasing process is optimized for a certain type of software, and not always ideal for new and fast-moving technologies. Procurement needs to both enable the business to take advantage of the opportunities that AI presents, while ensuring appropriate oversight given the risks that come with these products.

This article provides guidance on achieving this balance, from discovering existing spend to negotiating and reviewing contracts.

Know the Landscape Beforehand

Before jumping into policy, understand the environment in which you operate. AI tools are often bought in small ways and by non-central procurement channels: a team subscribes on a corporate card, a free trial converts to a paid plan, or an AI feature is turned on in a software license that the business already owns and uses procured tools from. These purchases could fall entirely outside of procurement’s control.

By reviewing expense reports and corporate card statements along with accounts payable, procurement can identify recurring payments to AI vendors. Additionally, engaging with department heads on what tools their teams are using can be a good way to understand the market demand, potential use cases, and data sensitivities. The goal is education: unplanned software purchases are typically made because there was a need that the formal procurement process could not fulfill swiftly enough.

A reality check on existing tools can be useful in prioritizing efforts: are there tools that handle the same data, or that have similar features? This creates a baseline for what procurement should aim to influence directly.

Design an Intake Process That Is Quick and Simple

If the alternative to the formal process is significantly quicker and easier, users will employ it. Design the intake form in a way that makes requesting an AI tool a few-minute commitment with a rapid response for lower-risk items.

A brief request form can capture the tool’s functionality, users, data sensitivity, costs, and the problem it solves. This information can be used to risk categorize the request: is it a low-cost tool that touches non-confidential data, and thus only needs a light procurement review? Does it require access to customer data or other sensitive data sets, and thus needs additional security and legal scrutiny?

The specific fields to include in such a form depend on the organization’s appetite for risk and should be designed in collaboration with stakeholders. Publishing a list of pre-vetted tools can be helpful in reducing ad-hoc requests, as can designing the form in a way that allows employees to select from a list of known options.

Structure a Review Process Fit for AI

Some aspects of the review for AI tools are similar to any other software purchase: due diligence on the vendor, their security practices, and the terms of the contract. However, there are areas where procurement should spend extra time and attention when considering a purchase of an AI tool.

First, data: ask how the tool is handling data, where it is stored, and whether customer, employee, or other data is used to train the models or retained by the vendor. Practices, and thus contractual language, can vary drastically between vendors and plans, so it is important to obtain this information in writing and consult with legal and privacy teams.

Second, outputs: consider conducting a proof-of-concept or a pilot with your own data to evaluate the accuracy and reliability of the tool, rather than relying on a vendor demonstration. Make sure to have the users of the tool assess the value and determine success criteria for the pilot.

Third, model specifics: ask which models the vendor is using and whether there are plans to retire or replace them, as this can affect the operations and cost structure of using the tool.

The regulatory requirements for AI tools vary drastically by industry and by the type of data a given tool processes, so consult with legal counsel on the requirements and avoid relying on a vendor’s generic statements of compliance.

Think Carefully About Your Sourcing Channels

AI tools can come to procurement via direct sales, resellers, and marketplaces, which can differ drastically in the level of due diligence that they perform and the contract flexibility that they offer. Marketplaces can be beneficial in reducing the discovery and contracting time for tools while also consolidating payments, but they vary drastically in terms of their vendor and contract screening practices. The Top 10 AI Tools Marketplaces overview can help in identifying the right channels for your organization.

Regardless of the sourcing channel, the review and due diligence process should be the same for any given tool: a product that lists itself on a marketplace is no less liable for violating your organization’s security and privacy requirements than one that is sourced directly from the vendor. The same applies to the contract language: even if a marketplace has a standardized template, the contract still needs to be reviewed for your organization’s requirements.

Negotiate Terms That Reflect the Unique Risks of AI

Contract terms for AI tools should be negotiated in a similar vein to any other software purchase, with attention to uptime, support, and licensing language, but with additional considerations. Make sure that the contract does not contain language that implicitly grants the vendor ownership of any outputs from the tool, and that the vendor does not retain rights to the data provided to the tool. Ask about the vendor’s liability for incorrect outputs and whether the vendor offers protection against intellectual property infringement claims.

These terms, along with the questions about data usage and model specifics, are likely to vary drastically between vendors, and should be reviewed with legal counsel. Pricing terms for AI tools can be especially important to review, as they often rely on a usage-based billing model. Ask the vendor to provide estimated costs at the pilot and enterprise levels, and make sure that the contract includes spending limits, notifications, and reporting for better spend visibility and control. Ensure that there are no additional costs for premium features, additional environments, or support options, and that the contract is reviewed for any renewals or exit clauses that may be relevant to the purchase. For purchases that require the tool to be available within the United States or that have region-specific requirements, the Buy AI Software in the US. guide can help in identifying the relevant terms to review.

Whenever possible, negotiate language around the ability to export data and a notice period for any changes to pricing or terms, as the industry moves rapidly, and flexibility to exit a contract can be valuable.

Maintain Oversight Throughout the Lifecycle of the Tool

Issues with AI spending often arise months or years after procurement, making lifecycle management one of the most important responsibilities for procurement. Keep a registry of all AI tools, with details on the business owner, pricing, data, and renewal dates and cancellation policies. Conduct regular reviews of the tool’s usage to ensure that it is being used to its fullest potential and that there are no underutilized or redundant tools in use.

Assign ownership of a given tool to a business owner who is responsible for its performance, and not just its initial request. Schedule a follow up, approximately 3 months after launch or adoption, to assess whether the tool is fulfilling its intended purpose. If it is not providing value, procurement is in a good position to remediate the situation, and having a list of Exomatter Alternatives can be useful in finding a replacement.

Regular follow-ups with the tool’s users can be helpful in managing expectations. A brief set of guidance can help employees understand what can and cannot be put into an AI tool, which is often more effective at preventing risk than responding to it afterwards.

Measure Your Success

It is important to measure and track the effectiveness of the procurement process, both in terms of speed and responsiveness. Measure the time-to-review, time-to-closure, and the number of approvals, rejections, or requests for additional information. Track the number of shadow purchases that continue to occur, and use that information to inform improvements to the intake process. If there are large numbers of requests that fall outside of procurement’s control, consider whether the problem can be solved by streamlining the approval process.

A good starting point this week is to begin compiling the inventory of AI tools that the company is using, along with their costs, owners, and users. Spend an hour this week speaking with the accounts payable team about the AI tools the company is currently paying for.