Due diligence checklist.

Six risk groups

Print it before your first vendor call. Fill it in as you go. When you get to the SoW draft, every unanswered row is a specific negotiation point — not a vague worry.

• Team + Delivery

  10 questions — named senior, sub-contract, staff turnover, change management.

• Track record + References

  5 — two-sided-consented case studies, references you can call this week.

• Technical + Architecture

  7 — default architecture, evaluation methodology, observability.

• Data + Security

  7 — where your data lives, who accesses, retention, incident response, exit.

• Financial + Contractual

  6 — milestone triggers, liability caps, IP structure, termination-for-convenience.

• Post-launch + Ownership

  5 — hyper-care, weights/code/data ownership, transition path.