The vendor question bank

Most failed AI projects failed at scope. Pin the outcome, the boundary and the measure before the price.

1. Q-01Which single business outcome does this service change, and how will we measure it on day 30 and day 90?
2. Q-02What is explicitly out of scope, in writing?
3. Q-03What must be true on our side (data, staff time, access, devices) for you to deliver — list it.
4. Q-04Show us one comparable delivery: what was the problem, what was built, what happened after handover?
5. Q-05What does "done" look like — a document, a demo, a signed acceptance test, or live use by our staff?
6. Q-06What happens when the AI cannot handle a case — who does it hand to, and how fast?
7. Q-07If we stopped the project after the first milestone, what would we own and be able to use?
8. Q-08Which parts of this are configuration of an existing tool, and which parts are custom work?

Zimbabwe's Cyber and Data Protection Act and SI 155 of 2024 make you, the controller, responsible for what your vendor does.

1. Q-09Which personal data will the system collect, store or send, and to which countries?
2. Q-10Are you licensed as a data controller with POTRAZ, or acting as our processor — and which are we?
3. Q-11Who is your named Data Protection Officer, and who is ours in this contract?
4. Q-12Which third-party AI models or APIs will see our data, and under which terms?
5. Q-13Is our data used to train or improve any model — yours or a third party's? Can we opt out?
6. Q-14How do we delete a customer's data on request, end to end, including backups and the AI provider?
7. Q-15What is retained after the contract ends, for how long, and who can access it?
8. Q-16Show us your breach procedure: who is told, within how many hours, and what we must do.

The AI is rarely the hard part; the connections to WhatsApp, CRM, POS, ERP, EcoCash and fiscal devices are.

1. Q-17Which of our systems will this connect to, and by which method (official API, export/import, screen automation)?
2. Q-18For WhatsApp: is this the official WhatsApp Business Platform (Cloud API) or an unofficial connection that Meta may block?
3. Q-19What happens to messages, orders or documents that arrive while the system is down?
4. Q-20Who owns the WhatsApp number, phone-number certificate, API keys and admin logins — us or you?
5. Q-21How are changes deployed — is there a test environment, and do we approve changes before they go live?
6. Q-22What monitoring exists, and who is alerted when a flow breaks at 22:00 on a Friday?
7. Q-23How many staff hours per week will running this take on our side after handover?
8. Q-24If we change CRM or POS in a year, what breaks and what does it cost to re-connect?

Customers write in Shona, Ndebele, English and mixes of all three; on WhatsApp, with voice notes, at any hour.

1. Q-25Show the system handling a Shona or Ndebele message, a mixed-language message and a voice note — live, not on a slide.
2. Q-26How does it respond to a customer it does not understand, and in which language?
3. Q-27Which channels are included (WhatsApp, web chat, SMS, phone, email, Facebook/Instagram) and which cost extra?
4. Q-28Can staff take over a conversation mid-thread, and does the customer notice?
5. Q-29How are tone and wording controlled — can we edit responses without a developer?
6. Q-30What happens with a customer who sends 40 messages in a minute, or an abusive one?
7. Q-31Can it collect a payment or issue a fiscal invoice inside the conversation, and through whom?

A system that is 92% right still gets 8 of every 100 customers, invoices or CVs wrong. Someone must catch them.

1. Q-32What accuracy do you expect on our data, and how will we measure it on a sample we choose?
2. Q-33Which decisions will a human always review before they take effect (refunds, rejections, payments, hiring)?
3. Q-34How does the system show its confidence, and what happens below a threshold?
4. Q-35Can we see and audit every automated decision afterwards — who, what, when, on which input?
5. Q-36How do we correct a wrong answer so it stays corrected?
6. Q-37What tests run before each change goes live, and can we see the results?
7. Q-38How is the system prevented from inventing facts (prices, stock, policies) it was not given?
8. Q-39Who is liable when an automated message, quote or document is wrong?

Price models hide risk: per-conversation fees, API pass-through and ZiG/USD terms decide the real cost.

1. Q-40Break the price into: your labour, licences, third-party API and messaging fees, hosting, and support — line by line.
2. Q-41Which costs are per month, per conversation, per document, per seat or per user, and who pays them if usage doubles?
3. Q-42Is the price in USD or ZiG, at which rate, and what happens if the rate moves during the contract?
4. Q-43What is the minimum term, the notice period and the exit fee?
5. Q-44What is included in the first 90 days after go-live at no extra cost?
6. Q-45What is your hourly or daily rate for changes outside scope?
7. Q-46Which payment milestones are tied to acceptance tests rather than to dates?
8. Q-47Do you receive commission or reseller margin from any tool you recommend? Disclose it.

Load shedding, fibre cuts and forex controls are real operating conditions here. Ask where it runs and what fails.

1. Q-48Where does the system run — which country, which data centre or cloud region — and can we choose?
2. Q-49What happens during a power cut or an internet outage at our premises: what queues, what is lost?
3. Q-50What is the uptime commitment, how is it measured, and what is the remedy when it is missed?
4. Q-51How are backups taken, how often, where are they kept, and have you tested a restore?
5. Q-52Can it run on a phone with 2G/3G and a small data bundle for our field staff?
6. Q-53How do we pay foreign hosting or API bills if forex is constrained — do you invoice locally in full?

The cheapest vendor is expensive if you cannot leave. Own the assets; document the system.

1. Q-54Who owns the code, prompts, flows, training data and documentation at the end — and is it in the contract?
2. Q-55Can we export all data and conversation history in an open format at any time?
3. Q-56What documentation and training do our staff receive so we can run it without you?
4. Q-57What are the support hours, response times and channels — and are they in Zimbabwe time?
5. Q-58How many of your team know this system, and what happens if that person leaves?
6. Q-59How are model or platform price changes from third parties (Meta, OpenAI, Google) passed on to us?
7. Q-60Can another vendor take this over — and would you cooperate with a handover?