This is a procurement evidence benchmark, not a vendor ranking. It defines the minimum evidence a buying team should collect before turning a polished demo into an approval decision.
Public authority sources are separated from SitePilot editorial model inputs. Rows marked buyer-validation-required are deliberately not treated as verified facts.
Use each row as an evidence request. A baseline row names the authority guidance; a buyer-validation-required row tells you what must come from the vendor, contract, pilot, or your own operating data.
Who owns the AI risk decision, and how are risks mapped, measured, and managed?
Minimum evidence: Named risk owner, risk register, review cadence, and escalation path tied to the proposed workflow.
Can the vendor demonstrate identity, access, logging, incident response, and control ownership?
Minimum evidence: Current control documentation, testable access model, audit-log scope, and incident commitments.
Which provider, deployer, use-case, and jurisdiction obligations apply?
Minimum evidence: Documented role and use-case mapping with legal review of applicable obligations.
What happens to prompts, outputs, telemetry, and customer data during and after the contract?
Minimum evidence: Contract language, retention settings, training-use position, deletion procedure, and verification evidence.
Does the proposed system fit the existing data flow, identity model, and operating boundaries?
Minimum evidence: Current-state and target-state diagrams, integration test, dependency inventory, and rollback path.
What observable result earns approval to move from pilot to production?
Minimum evidence: Workflow baseline, acceptance thresholds, evaluation set, human review method, and stop conditions.
What will the total cost, renewal exposure, liability, and exit path look like at production scale?
Minimum evidence: Dated quote, usage assumptions, renewal terms, liability language, portability plan, and switching estimate.
Can another stakeholder reproduce the recommendation and see when it must be revisited?
Minimum evidence: Versioned scores, source dates, unresolved blockers, recommendation, owner, and next review date.
The benchmark does not certify a vendor, predict ROI, or replace legal, security, or architecture review. Record the source date, owner, unresolved blockers, score version, and next review date in the decision memo before approval.
Optional Google Analytics helps us understand aggregate page use. It only loads after you choose Allow.