Choosing an AI vendor is a security and compliance decision, not just a feature one. Before you sign an MSA you need a framework: security questions, a lock-in risk map (data, model, integration), and real TCO, because the quoted price is rarely the total cost.
This cluster gives you tools to evaluate an AI vendor for NIS2, security, and cost. We lay out 12 questions worth asking before signing an MSA (data retention, sub-processors, right to audit, incident notification, exit), plus three layers of vendor lock-in and two contractual traps that most often cost you later. We show how to build a transparent, unbiased vendor comparison matrix (air-gap, PL model, RAG, NIS2/AI Act support, TCO, SLA), with methodology, because in a regulated niche a biased ranking destroys trust. We honestly flag where the author is a party (building CortexMine) and give the criteria by which you assess him. Start with the pre-MSA questions, then close the conversation with specifics.
Spotting lock-in is half the job. The other half is preventing it: what to write into the contract before you sign, and what exit plan to keep from day one. Ready clauses and an operational migration runbook for a NIS2 essential entity.
An AI TCO calculator answers one question: at what utilisation does on-prem beat cloud. Methodology, three formulas (per token, GPU rental, on-prem CAPEX), a full 3-year worked example and FAQ. Verdict: at moderate volume the API wins on price, on-prem earns its keep on control, not cost.
A ready RFP framework for AI vendors in regulated manufacturing: 24 questions across four categories, security, regulatory, architecture and exit, each with its purpose and scoring guidance.
TCO is not decided by the GPU price tag, but by utilization and horizon. How to model on-prem AI vs cloud over three years: three different cost models, a full CAPEX and OPEX line-item list, the break-even point and an honest look at when cloud wins.
Twelve questions to put to an AI vendor before you sign an MSA, in four blocks: data location, sub-processors, operational security, and exit terms.
AI vendor lock-in is rarely one bad decision — it's the sum of reasonable steps across three layers (data, model, integrations). The worst traps sit not in the architecture but in the contract. How to spot them before you sign an MSA.
“Where is my data physically processed and who is the sub-processor?”, it ties directly to NIS2 Article 21.
Ensure data portability, open formats, and exit clauses; avoid being locked in at the model and integration levels at the same time.
We state explicit criteria and disclose that the author builds his own product, judge by the methodology, not the verdict.
Want to apply this to your case: architecture, compliance, and cost?
→ Book 30 min