An AI customer support RFP should ask vendors for evidence, not adjectives: audited security reports, a signed data processing or business associate agreement, a written escalation design, test results on your own historical tickets, and a priced worked example at your volume. The 40 questions below are grouped into eight areas, and the weighted scoring table turns the answers into a number you can defend to procurement, security and finance.

Send the questions as written, ask for a document or link behind every answer, and score each area from 1 to 5 against the anchors in the table. A vendor that cannot show you the evidence should score a 1 for that line, however good the demo looked.

Key takeaways

• Ask for the report, not the badge. SOC 2 is an attestation a CPA firm issues, and the AICPA itself warns buyers to evaluate SOC services thoroughly, so request the full report under NDA and read the exceptions.

• Put the contract terms in the RFP. GDPR Article 28 and the HIPAA business associate rules already list what a processor contract must contain, including sub-processor approval and return or deletion of data at the end.

• Weight escalation and integrations as heavily as security. In our scoring model they take 30% of the total, because that is where AI support deployments succeed or stall.

• Test on your own tickets before you sign. Score vendors on a replay or pilot of real conversations, not on a scripted demo.

• Write the exit before the entrance. Ask how you get your data, configuration and transcripts back, in what format, and how fast.

How we chose and checked these questions

We grouped the questions into the eight areas that a security reviewer, a support operations lead and a procurement lead each need answered before an AI agent talks to customers. Regulatory and standards statements link to the primary text: GDPR Article 28, the HIPAA business associate contract rules at 45 CFR 164.504(e), ISO/IEC 27001, the AICPA SOC suite, the NIST Cybersecurity Framework 2.0 and the Cloud Security Alliance CAIQ. Every vendor fact in the tools table was checked on that vendor's own public page on 22 October 2026, and where a vendor does not publish something we say so.

Lorikeet publishes this guide and is one of the tools listed. We have tried to describe every product, including our own, using only what each vendor publishes, and we link to the source for each claim.

How to score AI customer support vendors

Use one sheet per vendor. Score each area 1, 3 or 5 using the anchors below (2 and 4 are fine for answers in between), multiply by the weight, and add up. A perfect vendor scores 500. Agree the weights with security, support operations and finance before the first response arrives, so nobody re-weights after seeing a favourite.

1. Security and compliance: ask for evidence you can read

Start here because a failed security review ends the process regardless of everything else.

• Which independent attestations or certifications do you hold today (SOC 2 Type II, ISO/IEC 27001, others), what is the audit period, and can we read the full report under NDA?

• Were there exceptions in the latest report, and how were they remediated?

• Will you sign our DPA, or a business associate agreement if we handle protected health information?

• Who are your sub-processors, including model providers, and how are we told about changes?

• When did your last third-party penetration test finish, and can we see the summary?

What a good answer looks like: named reports with dates, a public trust center, and a sub-processor list. ISO describes 27001 as the standard that defines the requirements an information security management system must meet, so ask for the certificate scope as well as the certificate. The AICPA notes it is looking into allegations about a SOC compliance vendor and urges that SOC services be thoroughly evaluated, which is a good reason to check who the auditor was. If you prefer a standard question set, the CAIQ v4.1 is a set of yes or no questions mapped to the Cloud Controls Matrix that many SaaS vendors already have filled in.

2. Data residency and retention: where data sits and who keeps it

Separate where data is stored from where it is processed. Many vendors can offer regional storage while inference still runs elsewhere.

• In which regions is customer data stored, and in which regions is it processed by models?

• Do your model providers retain prompts or outputs, and is zero retention written into your contracts with them?

• Is any customer data used to train or fine-tune models, yours or a third party's?

• How is personal information redacted, and can we set our own retention period for transcripts?

• At the end of the contract, do you return or delete our data, and how do you confirm it?

What a good answer looks like: a clear storage region, a clear processing region, and contract language that matches the law. GDPR Article 28 requires that a processor delete or return all personal data at the end of the services, at the controller's choice, and that it not engage another processor without the controller's prior written authorisation. For health data, the HIPAA business associate rules require the vendor to return or destroy protected health information at termination where feasible and retain no copies.

3. Uptime, SLAs and incident response: what happens when it breaks

An AI agent that goes down at peak sends every conversation back to your team at once, so plan for it.

• What uptime do you commit to in the contract, and what service credits apply if you miss it?

• Where is your status history published, and what were your last three incidents?

• How quickly do you notify us of a security incident or breach, and through which channel?

• If a model provider has an outage, what does the agent do: fall back, queue or hand off to people?

• Who is on call for us during our peak periods, and how do we reach them?

What a good answer looks like: a contractual SLA, an incident history you can see, and a defined failure mode that sends customers to your team rather than leaving them stuck. Under HIPAA, a business associate must report any use or disclosure not provided for by its contract, including breaches of unsecured protected health information. Use the NIST CSF 2.0 outcomes, which NIST says apply to organisations of any size, sector or maturity, to check the vendor's detect, respond and recover answers hang together.

4. Escalation and human handoff design: when the AI should stop

This is where customer trust is won or lost, and it is easy to skip in a demo.

• What triggers a handoff to a person: topics, sentiment, confidence, customer request, regulatory keywords?

• Can we configure those triggers ourselves, per channel, without a vendor ticket?

• What context arrives with the handoff: transcript, actions already taken, customer data retrieved?

• Does the agent tell customers they are talking to an AI, and can we control the wording?

• Are escalated or unresolved conversations charged?

What a good answer looks like: triggers you can see and change, a handoff that carries the full context, and a disclosure you control. Under Article 50 of the EU AI Act, providers must design AI systems that interact directly with people so those people are informed they are interacting with an AI system, at the latest at the first interaction, and the provision applies from 2 August 2026.

5. Integrations and actions: what the agent can actually do

Answering questions is table stakes. Ask what the agent can change in your systems, and how that is controlled.

• Which helpdesks, CRMs and telephony platforms do you connect to today, and which require custom work?

• Can the agent take actions (refunds, address changes, appointment bookings) through our APIs, and how are permissions scoped?

• How are sensitive steps such as payments and identity checks kept deterministic?

• Is every action logged with who, what and when, and can we export that audit trail?

• Do we have to migrate our helpdesk, or does the agent work inside the one we run?

What a good answer looks like: a list of named connectors, scoped credentials, an exportable action log, and sensitive operations run as fixed code rather than free-form model output. Ask for one live example of an action in a system like yours.

6. Testing, QA and change control: proof before customers see it

The question is not whether the agent is accurate in a demo but whether you can prove it on your conversations, and keep proving it after every change.

• Can we replay a sample of our historical tickets against the configured agent before go-live, and see the results per conversation?

• How do you test adversarial cases such as prompt injection or false claims of authority?

• When you or a model provider change a model, how are we told, and what regression testing runs first?

• What share of conversations are quality scored, by whom, and against which criteria?

• Who approves a workflow change, and is there a version history we can roll back?

What a good answer looks like: bulk replay on your own tickets, a regression suite that runs on every change, and quality scoring across all conversations rather than a sample. Our guide to regression testing AI support agents after model changes covers the change-control questions in more depth.

7. Pricing and commercial terms: get a worked example

AI support pricing units differ (per seat, per conversation, per resolution, per outcome), so normalise them before comparing.

• What is your unit of charge, and exactly what counts as one?

• Price a worked example at our monthly volume and channel mix, including platform fees and minimums.

• Are escalations, unresolved conversations or customer complaints charged?

• What is the minimum term, and what happens to price at renewal?

• Is there a free trial or paid pilot, and what can we test in it?

What a good answer looks like: a published price, a worked example at your volume, and a clear definition of a billable event. Ask every vendor the same volume question so the numbers line up.

8. Implementation, offboarding and exit: plan the end at the start

Exit terms are cheapest to negotiate before signature.

• What is the plan to the first live ticket, and who on your side owns it?

• Do you roll out topic by topic, and who decides when a topic goes live?

• At exit, what can we export (transcripts, workflows, knowledge, audit logs), in what format, and how fast?

• How long after termination is our data deleted, and do we get written confirmation?

• Can we run the new agent alongside our current tool during transition?

What a good answer looks like: named people, a staged plan, and an export you have seen work. Exports are not always on by default: Zendesk, for example, says the account owner must contact Zendesk Customer Support to enable data exports and that AI agent tickets cannot be exported. Our vendor migration guide walks through a cutover step by step.

Tools that help

These vendors sell AI agents that a 2026 RFP is likely to include. Each row uses only what the vendor publishes on the linked page.

On the Lorikeet row, the honest limits: Lorikeet does not list PCI DSS among its certifications, it does not publish an uptime figure on its trust or pricing pages, and its residency options (US primary hosting, with storage in Australia and the EU) cover where data is stored, which is not the same as where models process it. The Start and Scale plans list USA data residency, with custom residency on Signature. Lorikeet customers have run their own head-to-head before choosing: Flex tested AI solutions head-to-head, and Carmoola ran a proof of concept before signing. For a fuller vendor list see our comparison pages.

How to run the RFP so the scores mean something

1. Agree weights first. Security, support operations and finance sign off the scoring table before it goes out.

2. Send the same 40 questions to every vendor, with a deadline and a rule that every answer links to evidence.

3. Shortlist on paper, then test. Give the top two or three the same sample of your historical tickets and compare results conversation by conversation.

4. Price the same scenario. One volume, one channel mix, every fee included.

5. Read the contract against the answers. Anything promised in the RFP that is not in the contract scores as not offered.

For the technical side of the evaluation, see our technical checklist for AI CX platforms and our guide to what to verify behind SOC 2 and HIPAA claims.

What still needs a human

A scoring table does not replace judgement. Your security team still has to read the audit reports and decide whether exceptions matter for your risk profile. Legal still has to check that the DPA or BAA matches the answers. Support leaders still have to read real conversations from the pilot, especially the escalated ones, because an average score can hide the handful of conversations that would have become complaints. And someone senior has to own the decision to go live on each topic.

If you want to test against your own tickets before writing the RFP, you can start a 30-day free trial of Lorikeet and run your questions against a configured agent.