AQE AI Deployment Qualification

Before you buy an AI tool, ask the vendor these nine questions

A free request any US small business or nonprofit can send to an AI vendor. Nine questions mapped to the third-party items in the NIST AI Risk Management Framework. The vendor answers on this page.

Free, no accountSame answers, same resultSelf-declared, not an audit

Why ask

The NIST AI Risk Management Framework, published by the US National Institute of Standards and Technology, is a voluntary framework for managing AI risk, but it is a practical checklist, and several items deal directly with AI that comes from someone else: third-party data, software and pre-trained models. NIST notes the framework is being updated, so check the current version for any changes.

This request turns those items into nine plain questions for your vendor, and gives you a record of the answers.

The answers are self-declared, so treat the result as a list of documents to ask for, not as proof.

How it works

  1. You create a request link above and send it to your vendor from your own email.
  2. Your vendor answers 9 questions on this page about the evidence they hold.
  3. You both get the same result: what is available, what is partly available and what is missing, with the rule behind each item and a fingerprint so anyone can check it was not changed.

The 9 questions

  1. Rights in data and outputs: The vendor's position on intellectual property and other rights in the training data and in the outputs you receive. NIST AI RMF 1.0, GOVERN 6.1
  2. Plan for failures and incidents: What happens if the system or its data fails or causes an incident, and how you will be told. NIST AI RMF 1.0, GOVERN 6.2
  3. Legal risks of the components: How the vendor has mapped legal risks in the system's components, including third-party data and software. NIST AI RMF 1.0, MAP 4.1
  4. Risk controls for the components: The internal risk controls in place for the system's components, including third-party AI technology. NIST AI RMF 1.0, MAP 4.2
  5. Shown to be valid and reliable: Evidence the system is valid and reliable, and the documented limits of where it works well. NIST AI RMF 1.0, MEASURE 2.5
  6. Privacy risk: How privacy risk in the system has been examined, and the documented results. NIST AI RMF 1.0, MEASURE 2.10
  7. Fairness and bias: How fairness and bias have been evaluated, and the documented results. NIST AI RMF 1.0, MEASURE 2.11
  8. Ongoing monitoring: How the system is monitored over time, and what the vendor shares with customers about it. NIST AI RMF 1.0, MANAGE 3.1
  9. Pre-trained models: Whether the system uses pre-trained models from others, and how those are monitored and maintained. NIST AI RMF 1.0, MANAGE 3.2

Sources

Sources checked 8 October 2026. This tool helps you ask for evidence. It is not legal advice, an audit or a certification, and the answers are the vendor's own.