Vendor Selection: The Critical Path
Poor vendor selection leads to: 6-12 month delays, $1-5M wasted investment, team frustration, and failed ROI realization. Good vendor selection process takes 8-12 weeks but prevents these outcomes.
RFP (Request for Proposal) Design
RFP Should Include
- Business requirements: Use cases, success metrics, integration needs
- Technical requirements: Data volume, latency, accuracy, security
- Operational requirements: Training, support, SLA, monitoring
- Organizational requirements: Vendor viability, reference customers, team
- Commercial terms: Pricing model, contract length, performance penalties
RFP Best Practices
Be specific: Don't ask "how good is your AI?" Ask "what accuracy do you achieve on X dataset with Y constraints?" Require references from similar companies. Include weighted scoring in RFP (40% capability, 30% cost, 20% operational, 10% team).
Evaluation Framework
Evaluation Dimensions
- Technical (40%): Performance, accuracy, scalability, integration, roadmap
- Operational (30%): Support quality, implementation speed, training, monitoring
- Commercial (20%): Pricing, contract terms, flexibility, renewal terms
- Organizational (10%): Financial stability, team, references, strategic alignment
Evaluation Process
Week 1-2: RFP sent, responses received. Week 3: Technical deep-dive calls. Week 4: Reference calls. Week 5: Pilot proposal review. Week 6-8: Pilot execution. Week 9-10: Pilot results analysis. Week 11-12: Final negotiation and decision.
Pilot Program Design
Pilot Scope
Small scope (1 use case, 1 team, 50-200 data points): 4-8 week timeline, $50-100K cost. Large enough to be meaningful, small enough to limit risk.
Success Criteria
Define before pilot: accuracy target (e.g., 95%), integration success (system talks to others), user adoption (70%+), support quality (response time <4 hours), timeline (4 weeks to production-ready).
Pilot Evaluation
Measure against predefined criteria. If vendor passes pilot, proceed to negotiation. If not, decision to either: revise requirements and re-pilot, or move to next vendor.
Legal Review Framework
Critical Contract Terms
- Data Protection Agreement (DPA): GDPR/CCPA compliance, data residency, data deletion
- Service Level Agreement (SLA): Uptime, response time, accuracy guarantees
- Intellectual Property: Who owns models, data, derivative works
- Security & Compliance: SOC 2 certification, penetration testing, audit rights
- Liability & Indemnification: Cap on damages, indemnification for third-party claims
- Termination Clauses: Notice period, early termination rights, data return
Negotiation Points
Data residency (keep in your region), IP ownership (ensure you own output), performance penalties (financial recourse for SLA breach), termination flexibility (shorter termination notice).
Vendor Financial Stability Assessment
Risk Assessment
Assess funding status: Series A = high risk, Series C+ = moderate, public company = low risk. Review funding runway, burn rate, growth trajectory.
Sustainability Questions
- How is vendor monetizing? (Sustainable business model?)
- What percentage of revenue are top 10 customers? (Customer concentration risk?)
- What is churn rate? (Are customers staying?)
- What is gross margin? (Can they sustain service?)
Mitigation for High-Risk Vendors
Require escrow of source code (you get access if vendor fails), shorter contract terms (1-2 years), performance-based pricing (tie payments to results).
Negotiation Strategy
Negotiation Priorities
Prioritize: data security and DPA, SLA with teeth (performance penalties), termination flexibility. De-prioritize: minor features, implementation timelines (these can be managed).
Negotiation Tactics
- Get 2-3 competing proposals (competition enables negotiation)
- Negotiate based on pilot results (data-driven not emotional)
- Trade concessions (longer term = lower price, higher commitment = better terms)
- Get everything in writing (verbal commitments don't matter)
Final Decision Framework
Decision Committee
Include: CTO/technical lead, procurement, legal, business sponsor, end users. Decision should be consensus-based after structured evaluation.
Red Flags (Deal-Breaker Issues)
- Won't agree to GDPR/data protection terms
- No SLA or refuses performance penalties
- Can't demonstrate accuracy on your data
- Financial viability concerns unresolved
- Team lacks relevant expertise
Documentation
Document decision rationale: Why this vendor vs others? What were key decision factors? What risks did we accept? This prevents second-guessing and enables learning for future selections.