A supplier may use AI in the service it sells, inside its office tools, or in an operational system such as a support desk. A useful enquiry covers AI relevant to the buyer’s data, not only products marketed as AI.
Australian Government policy and procurement material can help buyers frame those enquiries. The DTA’s Policy for the responsible use of AI in government version 2.0 took effect on 15 December 2025; version 2.1 was updated on 21 October 2026. Its scope is defined and includes exceptions, so check whether it applies to your organisation and procurement.
Seven questions
- Which AI-enabled tools or features may handle our information while you deliver this service, including features embedded in other software?
Ask about transcription, drafting, search, support and other features that may process buyer information, whether or not AI is part of the purchased product.
- Where is information stored at rest for each relevant service?
Ask for the applicable country or cloud region and the source that describes the account or service setting.
- Where are prompts and outputs processed for the feature and deployment option in use?
Ask for the named option and configuration evidence where available. A broad hosting statement may not answer the processing question.
- What information is retained for monitoring or logging, where, and for how long?
Treat retention and monitoring as handling questions related to residency, but distinct from it.
- Can our information be used to train or improve a model?
Ask which contract or product term applies to the service and configuration.
- Which other providers may handle the information, and what locations or services are relevant?
Request the applicable sub-processor information and its effective or review date.
- How will you notify us if the service, configuration or providers change?
Ask what change process applies during the contract and where updates will be recorded.
Ask for evidence, then state its limits
Supporting material may include provider terms, regional documentation, a sub-processor list, supplier account settings or third-party assessment material. A provider’s own contract or documentation is useful evidence of what that provider publishes or permits; it is not automatically an independent audit of the supplier’s configuration.
Record the source date and the feature or configuration it covers. If the evidence does not establish an answer, mark the point as open and ask a focused follow-up. Avoid inferring the location of a particular supplier’s data solely from a provider’s general regional availability.
For Australian Government buyers
The Digital Transformation Agency publishes AI procurement guidance and model clauses. These are primary materials for buyers to review alongside their own agency requirements, privacy assessment and procurement process. Applicability depends on the entity, policy scope and relevant arrangements.
