AI Vendor Due Diligence: Questions to Ask Before Buying an Agent

AI vendor due diligence for an agent comes down to four questions: can you stop it, see what it did, hear about changes first, and leave with your data deleted? Most vendor questionnaires ask whether controls exist. The useful question is whether you can operate them yourself, and only a demonstration answers it. This guide is written for whoever signs off an agent purchase in Singapore, from the technology lead to the compliance officer at a bank or insurer. It gives the RFP questions, a stop drill to run, the log fields to demand and clause wording to start from.

Regulators are moving in the same direction. On 5 August 2026 the Monetary Authority of Singapore (MAS) told Parliament its proposed AI risk management guidelines "apply to all AI use cases by FIs, including agentic AI, and will be finalised soon" (MAS written parliamentary reply, 5 August 2026).

Who is responsible when you buy an agent instead of building it?

When you buy an AI agent from a vendor, the accountability for what it does stays with you. IMDA's Model AI Governance Framework for Agentic AI, Version 1.5 (20 May 2026, updated 5 June 2026) says it plainly: "As deployers, organisations and humans remain accountable for the decisions and actions of agents." The framework is voluntary guidance, not law, but the law points the same way.

Singapore's data protection law is the binding floor. PDPA section 4(3) gives you the same obligation for data a vendor processes on your behalf "as if the personal data were processed by the organisation itself." The vendor, as a data intermediary, is bound directly only by some duties, through section 4(2); consent and the rest stay with you. See the PDPA liability gap for AI agents.

Version 1.5 changed one thing that matters for procurement. It refined the value chain "to separate platform providers and system providers or app developers." In practice the company you sign with is usually the system provider. It builds on someone else's platform, which runs someone else's model, which calls tools hosted by yet more parties. Your contract reaches one of them.

The model behind your agent can change because a model developer you have never met released a new version. IMDA's advice is to "clarify distribution of obligations in any terms and conditions or contracts" and, "where there are gaps", to "reassess if the agentic deployment meets its risk tolerance." Read that as permission to walk away. The value-chain liability split explains why the loss pools with the deployer when nobody does.

What should an AI agent RFP ask that a SaaS questionnaire does not?

An AI agent RFP has to test how the agent behaves, beyond where it is hosted. A SaaS questionnaire does not ask what the agent is allowed to do, who can stop it, or what happens when the underlying model changes. IMDA's Version 1.5 framework names the features to request: "scoped API keys, per-agent identity tokens, and observability such as the logging of tool calls and access history."

Each row below asks for evidence you can check, because a yes on a form costs the vendor nothing.

Illustrative example: two vendors pitch a collections agent that sends payment reminders. Vendor A is cheaper. Its halt is a support request with a two-hour response target. Vendor B gives your operations lead a stop control that takes effect in about a minute. Assume the agent sends 300 messages an hour and a bad template slips through. With Vendor A, up to 600 wrong messages could go out before anyone at the vendor acts. With Vendor B, about 5. The licence saving would have to pay for complaints from 595 extra customers. Price the halt time alongside the seat.

Agents act faster than people react, so ask for a rate cap per agent as well: a ceiling on actions per hour that the vendor enforces whatever the model decides. Here, a cap of 60 messages an hour would cut Vendor A's worst case from 600 to 120 before anyone presses anything.

Try the halt-time arithmetic with your own volumes.

Some asks collide with how multi-tenant software works. Few vendors will keep an old model running for one customer indefinitely, because the model developer upstream retires versions on its own schedule. Ask instead for a committed pinning window and the upstream retirement dates. Deletion has the same shape: embeddings can only be deleted cleanly if they sit in an index kept separate per customer, so ask whether yours will.

What should the stop drill and log export prove before you sign?

A pre-signature stop drill should prove that your own staff can halt a vendor's AI agent in staging and that its queued actions die with it. The halt should also appear in a log you can read without the vendor's help. MAS's November 2025 proposal expects kill-switch protocols for high-risk AI to be "tested regularly". The first test belongs before signature.

Run it the way you would run a fire drill: unannounced timing, real permissions, a stopwatch. The steps are our suggested acceptance test, not a regulatory list.

Step 5 is the easiest to leave out. A stop that pauses the orchestrator but leaves the credential live is a pause. Our guide to agent identity and kill paths covers the credential side.

The step 7 export is your evidence in any later dispute, so fix its fields in the RFP.

Ask for one machine-readable line per action (JSON Lines or CSV) within a fixed number of hours, and have your own analyst open the sample unaided.

Ask for the action record, not only the agent's narrative. IMDA's discussion paper Legal Responsibility for AI Agents (May 2026) warns that chain-of-thought explanations "are generated as statistical language outputs rather than direct traces of the model's internal decision-making process" (page 14). Many of its members also worried that proving which actor in the value chain caused an incident "may be difficult" (page 15). The party holding parameter-level records starts that argument ahead.

Which contract clauses make an agent governable after signature?

Contract clauses make an agent governable only if they turn the demonstrated controls into obligations the vendor cannot quietly withdraw. MAS's Guidelines on Outsourcing (Banks), in effect since 11 December 2024, list the minimum a bank's agreement should cover, including audit and inspection and "default termination and early exit". An agent needs more. The wording below is illustrative, a starting point for your lawyer, not legal advice. Brackets mark what you negotiate; each pattern carries a fallback if the first ask is refused.

1. Stop right. "The Customer may suspend the Agent, or any capability of it, at any time through the Customer console and without liability. On suspension the Supplier shall ensure that no new action starts, cancel all queued actions and record the suspension in the Action Log." Fallback: a staffed suspension line with a response time in [minutes] and a service credit when it is missed.
2. Log access. "The Supplier shall retain the Action Log, with the fields in Schedule [A], for [period] and deliver an export within [hours] of request, during the term and for [period] after it." Fallback: self-service export only, provided every Schedule [A] field is present.
3. Change notice. "Material Change means any change to the model or model version, system instructions, tool access, autonomy level or safety filters. The Supplier shall give [days] written notice of a Material Change and keep the current version available for [days] after notice. Security fixes may apply at once, with notice within [hours]." Fallback: termination without penalty if a Material Change fails your retest.
4. No silent expansion. "The Agent shall not gain any tool, data source or permission beyond Schedule [B] without the Customer's prior written approval." No fallback: this is the scope of the deal.
5. Named upstream. "Schedule [C] lists every model developer, platform provider and sub-processor used to deliver the Agent; the Supplier shall give [days] notice before adding or replacing any of them." Fallback: notice plus a right to object.
6. Exit and deletion. "On termination the Supplier shall return Customer Data and configuration in [format], then delete all other copies, including embeddings, vector indexes and logs, within [days], let backups expire within [days] and confirm deletion in writing." Fallback: a certificate naming any store that cannot be purged and its expiry date.

Clause 6 carries legal weight. Under PDPA sections 25 and 4(2), your vendor as a data intermediary must itself cease to retain personal data, or remove the means of linking it to individuals, once retention serves no purpose or legal or business need. Banks also expect that, on termination, information given to the provider should be "deleted, destroyed or rendered unusable" (Guidelines on Outsourcing (Banks), paragraph 3.7.2(c)).

IMDA's legal working group, drawn from over 20 members of Singapore's legal community, records that "contracts were effective and efficient means of defining agentic AI actors' rights and obligations" (page 10). Its own example is a seventh clause worth copying: where an agent buys goods and humans review only weekly, "the company may choose to incorporate a contractual right of rescission to reverse purchases within a week" (page 16). Match the rescission window to your review cycle. The paper adds a limit: under the doctrine of privity, people harmed by your agent "generally cannot enforce contractual protections agreed between other actors" (page 10). Your customers will claim against you, so any indemnity has to run from the supplier to you. The paper is a discussion document, not law, and makes no policy recommendations.

It also names the risk on the other side of the table. Parties with stronger bargaining power "would be able to carve out their responsibilities and disclaim liability for many incidents", including "by simply stating the risks (e.g. that agents can behave in unexpected ways)" (page 16). Read the vendor's redlines and RFP answers as data; the answers below are illustrative.

For a managing director, the test: which clauses did the vendor strike out, and what did the disclaimer add? A vendor that refuses a stop right is telling you how the relationship will run.

What changes if you are regulated by MAS?

For financial institutions regulated by MAS, buying an AI agent is a third-party arrangement that MAS expects to be risk-managed like outsourcing. Footnote 21 of MAS's proposed Guidelines on AI Risk Management (consultation, 13 November 2025 to 31 January 2026) says outsourcing and third-party expectations "would apply to the use of third-party AI." This is general information, not legal advice.

The AI guidelines propose that a financial institution "establish processes to receive notifications of updates or changes to third-party AI" (paragraph 4.11). MAS's March 2026 consultation on third-party risk management, which closed on 20 April 2026, would supersede the outsourcing guidelines and extend their expectations "to all third-party services", with a proposed six-month transition after issuance. That brings in SaaS agents a bank might not have treated as outsourcing. Insurers and other financial institutions follow the parallel Guidelines on Outsourcing (Financial Institutions other than Banks), which would also be superseded.

How the RFP asks map to MAS text, and how firm each one is:

Guidelines are supervisory expectations, not statute; the bank outsourcing guidelines say MAS "may also take non-observance into account in its assessment" of a bank. The proposed texts may change, but a contract signed this quarter will still be running when they land.

For runtime controls that sit beside these contracts, see what banks should build under MAS SAFR.

How much of this does a smaller business need?

A smaller business needs the same four abilities as a bank: stop, see, change and leave. MAS's outsourcing guidelines for banks tie the effort to the "nature of risks in, and materiality of" each arrangement (paragraph 1.3), and that principle works outside finance too. An owner-managed firm can skip on-site audits. It cannot skip the stop drill, one log export and a deletion clause that names where the data lives.

Name the operator before go-live. The person who would press stop at 2 a.m. should have pressed it once in staging.

Run each shortlisted vendor through the scorecard below.

Where Origin Pi stands

We treat governability as an acceptance test. If a vendor cannot stop the agent in front of you, the clause that promises a stop describes a hope.

When we design agent deployments, the buyer's controls sit in a layer the buyer owns where possible: bounded permissions per agent, a confirm step before consequential actions, and an audit trail written outside the vendor's product so it survives a change of vendor. That agent-ready layer reduces how much you depend on the contract. Cerebrum, our own governed agent layer, is in build.

Buy the agent whose failure you can contain, not the one with the best demo of success.

Your first step: before the next vendor meeting, write down who on your side would press stop, and ask the vendor to let that person do it in staging. Their answer will tell you more than the questionnaire.