MSP due diligence
Questions to Ask an MSP Before You Sign or Renew
A service-level promise is useful only when someone can show who acts, how quickly, and with which authority.
Open the checklistPillar · Technology Procurement
Procurement
For a regulated buyer, technology procurement comes down to what to modernize, what to keep, and how to justify every dollar to the council or board that approves it. With AI, the contract also decides where your data goes, whether it trains someone else’s model, and what happens when the model underneath changes.
Reviewed October 5, 2026 · Standards in force
The buyer's problem
You do not have an unlimited budget or a large team, and every purchase has to survive a public approval process. AI adds terms that standard IT contracts never covered: prompts and outputs as data, model training rights, sub-processors that are themselves AI providers, and models that are deprecated on the vendor’s schedule. Federal buyers now have explicit direction. OMB Memo M-25-22 governs agency AI acquisition, and GSA’s revised proposed clause would bar using government data to train contractor models. Every buyer can borrow the same terms.
What to settle before you buy
- Where does our data go? Name the regions, tenants and sub-processors that touch prompts, files and outputs. Require a zero-egress option for regulated data.
- Will our data train their models? Get a written default of no training or improvement on your inputs and outputs, covering sub-processors, not a settings toggle that can change.
- Who is liable when the AI is wrong? Set indemnity, liability caps and incident duties that cover AI outputs, data leakage and IP claims, not just uptime.
- What happens when the model changes? Require notice before model swaps or deprecation, a re-validation window, and the right to pin a version for regulated workflows.
- What is the true total cost? Include usage-based AI pricing, staff time, evaluation and exit, not just the license line.
- Will they train on our telemetry or code? Extend the no-training clause to logs, telemetry, usage analytics, code and repository metadata, not only prompts and outputs.
- What can the AI connect to inside our workspace? Approve each integration with email, files, chat and code repositories explicitly, with scoped OAuth grants, admin consent and a way to revoke all grants at once.
- Who runs the agent platform, and how is it secured? For agentic tools, require disclosure of the control-plane version, identity-provider configuration and who patches it, especially for self-hosted or managed deployments.
- How is untrusted AI code isolated? For tools that run AI-generated code, ask what isolation they use, how they patch the hypervisor and what network and credential limits surround each sandbox.
- What does this product expose? For any hosted portal, gateway or agent, ask the vendor to list every internet-facing endpoint, how each is authenticated and how fast it patches a KEV-listed flaw.
Acquisition rules buyers can borrow, as of October 5, 2026
- OMB Memo M-25-22, Driving Efficient Acquisition of AI in Government Issued April 3, 2025 and in force for federal agencies. Sets expectations for AI acquisition, including protecting government data and avoiding vendor lock-in.
OMB ↗ - GSA proposed clause 552.239-7001 (revised June 17, 2026) Proposed, not final. It would keep government ownership of data, bar using government data to train or improve contractor models, and override inconsistent commercial terms.
Jenner & Block ↗ - FedRAMP Consolidated Rules for 2026 Published June 25, 2026. FedRAMP 20x is now a full certification path, and the new rules become mandatory for all stakeholders on January 1, 2027.
FedRAMP ↗ - CMMC Phase II suspended On July 13, 2026 the Department of War suspended the Phase II requirements that were due November 10, 2026. Phase I self-assessments remain in place.
DoW CIO ↗ - EU AI Act deployer duties Article 50 transparency obligations have applied since August 2, 2026. Machine-readable marking for generative systems already on the market is due December 2, 2026.
White & Case ↗
SaaS vs. private cloud vs. on-premise AI evaluation matrix
B3 analysis. Score each column against your data classification, not the vendor’s preferred deployment.
| Criterion | Multi-tenant SaaS | Single-tenant or private cloud | On-premise or self-hosted |
|---|---|---|---|
| Data boundary | Contractual; verify region pinning and sub-processor list | Dedicated tenant in a pinned region | Stays inside your network |
| Zero-egress feasibility | Rare; ask for a no-retention, no-logging mode | Possible with private endpoints | Native, if telemetry is disabled |
| Training on your data | Must be contractually excluded | Excluded by architecture and contract | Under your control |
| Model lifecycle | Vendor schedule; negotiate notice and pinning | Negotiated upgrade windows | You choose when to upgrade |
| Security evidence | SOC 2 Type II, ISO 27001, ISO/IEC 42001, FedRAMP where relevant | Same, plus tenant-isolation testing | Your controls; the vendor supplies an SBOM and model provenance |
| Staffing and cost | Lowest staff burden; usage-based cost | Moderate; reserved capacity | Highest; hardware, GPUs, patching |
| Agent control plane | Vendor-operated; ask for version and identity-provider evidence | Shared responsibility; confirm who patches and rotates | You operate it; patch like the edge and front it with an identity provider |
Standard AI contract terms
- Data-use opt-out. No training, fine-tuning or product improvement on customer inputs or outputs by default, flowed down to every sub-processor.
- Data boundary. Named processing regions, a sub-processor list with advance notice of changes, and retention limits on prompts and outputs.
- Liability. Indemnity for IP and data-protection claims arising from AI outputs, with caps sized to the data at risk.
- Model lifecycle. Ninety days’ notice before a model is changed or deprecated, version pinning for regulated workflows, and re-validation support.
- Exit. Export of data, prompts, configurations and logs in usable formats, with certified deletion.
- No re-training on telemetry or code. The vendor and its sub-processors will not use customer telemetry, logs, usage data, source code or repository metadata to train, fine-tune, evaluate or improve any model.
- Zero-egress guarantee. For designated regulated data, no retention, no human review and no transfer outside named regions or endpoints, verified by audit right.
- Workspace integration limits. Integrations with email, files, chat and code use least-privilege OAuth scopes, require admin consent and can be revoked in one action.
- Security SLA bounds. Notify within 24 hours of a confirmed incident affecting customer data; publish an advisory and workaround within 72 hours of a critical flaw; ship a fix for an exploited critical flaw within 7 days or provide a documented mitigation.
- AI incident notification. Notify the customer within 24 hours of any incident in which the vendor's AI system or agent accessed, altered or transmitted customer data outside its authorized scope, and preserve the related logs.
- Exploited-flaw patch window. Remediate any vulnerability added to the CISA KEV catalog that affects the service within 72 hours of listing, or apply a documented mitigation and notify the customer.
This is one of the six domains in the readiness assessment. See where your organization actually stands.
Take the readiness assessmentBuy products that tell you what they expose.
Korean lenders were breached through a loan-broker service, an employee mobile work system and a sales support tool, systems often bought or built for convenience. Regulators ordered inspections of every externally exposed system and authentication gap.
Test now: Before the next renewal, ask each vendor that hosts a portal for you for its list of exposed endpoints and its KEV patch window, in writing.
Read the October 5 brief →
Watch
Public talks, with a buyer-side read.
Curated public-sector and regulated-technology speeches, each with buyer-side commentary.
Loading…