How to use this assessment: How to use this assessment: Work through each item and mark it complete once confirmed. Items flagged High Risk represent the most common sources of material overspend. A score of 16 or more indicates a well-governed position.

Scoring Guide
Tally your confirmed items against these benchmarks to determine your current maturity level.
0 – 5 High Exposure
6 – 11 Partial Governance
12 – 22 Well Governed

Section 1

1. You have benchmarked each vendor's flagship and budget models against your specific use cases using standardised test prompts. High Risk
OpenAI's GPT-5 leads on ecosystem maturity and developer experience, Anthropic's Claude leads on code generation quality and safety reasoning, Google's Gemini 3.x leads on cost efficiency and large context windows. Generic benchmark scores from third parties rarely translate to your specific domain; run representative workloads through each model before committing. A vendor that ranks first on general benchmarks may rank third on your particular document processing or customer support workflow. Test each model against 20–50 representative prompts from your actual production environment, scored against your internal quality rubric.
● High Risk
2. You have evaluated whether reasoning/extended-thinking model variants are necessary for your use cases, and costed the premium. High Risk
Reasoning models cost 5 to 15x more per token than standard models and introduce latency that makes them unsuitable for real-time applications. Many enterprise use cases categorised as "requiring reasoning" during vendor pilots are adequately served by standard flagship models with well-engineered prompts. Qualify the reasoning requirement rigorously before paying the premium. Run test cases through both standard and reasoning models to establish the quality lift and cost impact. Document which use cases genuinely require reasoning, and which can be served by standard models with better prompt engineering.
● High Risk
3. You have assessed context window requirements and confirmed which vendor's context limits meet your longest document processing needs. Medium Risk
Google Gemini 3.1 Pro offers a 1M+ token context window, enabling processing of entire legal contracts, financial filings, or codebases in a single request. OpenAI's GPT-5 and Anthropic's Claude Opus 4.6 offer 128K–200K context windows that cover most enterprise document use cases. Context window limits are a hard constraint — if your use case requires 500K tokens, your vendor shortlist is limited to Google Vertex AI. Measure your longest document processing requirements and confirm the vendor's context window explicitly covers your peak case, not just your average case.
● Medium Risk
4. You have evaluated each vendor's multimodal capabilities against your image, audio, and document processing requirements. Medium Risk
Google's Gemini 3.x leads on native multimodal processing, with video, audio, and image tokens priced within the same API. OpenAI's GPT-5 supports images and documents. Anthropic's Claude supports images but lacks native video processing. If your workflows involve video transcription, image-heavy document extraction, or audio processing, multimodal capability gaps translate directly into architectural complexity or additional vendor dependencies. Map your multimodal requirements against each vendor's native capabilities and cost model.
● Medium Risk
5. You have confirmed that each vendor's model performance meets your minimum accuracy thresholds for production deployment across your highest-priority use cases. High Risk
Vendor demonstrations and marketing benchmarks systematically select tasks where each vendor performs best. Run your actual production prompts through a representative 200-to-500 sample set for each candidate vendor, scoring against your own quality rubric. Procurement decisions made without production-representative evaluation are the leading cause of expensive post-deployment model migrations. Test each model with your real workflows, real data, and real output quality requirements before signing any enterprise agreement.
● High Risk
6. You have obtained fully-loaded cost models from each vendor — including caching, batch, embedding, and any regional processing surcharges — not headline token rates alone. High Risk
Regional processing endpoints (US, EU, APAC) carry a 10 percent surcharge with OpenAI. Embedding tokens are billed separately. Batch API discounts of 50 percent apply only to eligible workloads. Without a fully-loaded cost model, side-by-side vendor comparison produces misleading results. Build a cost model for each vendor using actual token counts from your pilot instrumentation before making a procurement decision. Include input tokens, output tokens, caching costs, batch discounts, regional surcharges, and any special pricing for fine-tuning or reserved capacity.
● High Risk

Section 2

7. You have requested enterprise pricing proposals from all shortlisted vendors with documented consumption forecasts as negotiation leverage. High Risk
Enterprise buyers committing to meaningful volume can secure 25 to 40 percent below list price from all major AI vendors. Without a documented consumption forecast and a credible multi-vendor comparison, you have no negotiating position. Present each vendor with your projected annual token consumption, the comparable quote from their primary competitor, and your requirements for price stability and data governance terms. Enterprise discounts are significant — negotiations are worthwhile at any meaningful scale.
● High Risk
8. You have compared total cost of ownership including integration costs, monitoring tooling, and prompt engineering resources — not API costs alone. Medium Risk
API integration development costs $5,000 to $25,000 per vendor per use case. Fine-tuning premiums add $10,000 to $50,000. Prompt engineering resource costs average $50,000 to $150,000 annually. A vendor whose API is 20 percent cheaper may have a higher total cost of ownership if its documentation, SDK maturity, and developer experience require significantly more engineering time to implement and maintain. Model your integration costs, monitoring, and staffing costs alongside raw API pricing.
● Medium Risk
9. You have assessed whether each vendor's pricing model — per-token consumption versus user-based subscription versus reserved capacity — aligns with your consumption pattern and budget planning requirements. Medium Risk
Google and Microsoft often bundle AI services within broader enterprise cloud contracts, which can obscure AI cost within a larger cloud commitment and make cost attribution difficult. OpenAI and Anthropic charge per-token, which enables precise cost attribution by use case but creates budget variability. Choose the pricing model that matches your financial governance approach, not just the lowest unit price. If you need predictable monthly costs, per-token pricing creates budget risk. If you need transparent cost attribution by use case, bundled cloud pricing obscures visibility.
● Medium Risk
10. You have confirmed price stability terms — specifically the contract period during which rates are locked — for any vendor you are placing in a preferred or exclusive position. High Risk
AI API list prices fell approximately 80 percent between early 2025 and early 2026. An enterprise agreement that locks you into a fixed rate without a Most Favoured Nation clause or re-opener may leave you paying more than market rate within 12 months. Negotiate explicit price stability clauses — or automatic rate reductions tied to list price decreases — for any committed spend. Lock rates for 12 months, include a Most Favoured Nation clause to capture industry discounts, and negotiate a re-opener at month 12 to benchmark pricing against market rates.
● High Risk
11. You have reviewed each vendor's data processing terms and confirmed that your input data and outputs are not used for model training. High Risk
Standard API terms for all major vendors state that data is not used for training. However, policy is not contract. Obtain written confirmation in your enterprise agreement that your inputs, outputs, and fine-tuning data are excluded from model training, used only for service delivery, and deleted according to your retention schedule. This is particularly critical for industries handling regulated data. Insert explicit contract language: "Customer data will not be used for model training, fine-tuning, or product improvement. Customer data will be deleted within [X days] of contract termination per Customer's request."
● High Risk
12. You have confirmed each vendor's data residency options against your regulatory requirements, including EU AI Act, GDPR, HIPAA, and sector-specific mandates. High Risk
Over 70 percent of enterprises cite data residency as a top concern when expanding AI capabilities. All major vendors now offer regional API endpoints but at varying price premiums and with different compliance certification coverage. Confirm that the vendor's data residency option covers the specific regulatory frameworks applicable to your industry and geography before shortlisting. Map your data residency requirements against each vendor's regional availability and pricing. EU AI Act requirements differ significantly from GDPR — ensure the vendor's compliance approach covers both.
● High Risk

Section 3

13. You have reviewed SOC 2 Type II, ISO 27001, and relevant sector certifications for each vendor and confirmed audit report recency. Medium Risk
SOC 2 Type II certification is table stakes for enterprise AI vendor selection, but certification scope varies significantly. Request the actual audit report, not just the certificate, and confirm that the scope covers the specific services and regions you will use. Certifications with stale audit dates — more than 18 months old — should be treated as unverified. Check the audit completion date, not just the certification issuance date. Confirm that the SOC 2 audit covers API services, not just office operations.
● Medium Risk
14. You have assessed each vendor's incident notification, data breach response, and audit rights terms in their enterprise agreement. Medium Risk
Standard API terms provide limited incident notification commitments. Enterprise agreements should specify notification timelines (typically 72 hours for personal data incidents under GDPR), the escalation chain, and your right to audit service security controls. Vendors that resist audit rights clauses in enterprise agreements are signalling either compliance immaturity or contractual inflexibility that will compound in regulated environments. Negotiate: incident notification within 48 hours of discovery, quarterly security audit rights, and breach forensics support at no additional cost.
● Medium Risk
15. You have assessed SDK quality, API documentation completeness, and community support maturity for each vendor against your engineering team's existing technology stack. Medium Risk
OpenAI has the most mature developer ecosystem by adoption, with the broadest third-party tooling coverage. Anthropic's SDK is comprehensive but the ecosystem is narrower. Google's Vertex AI inherits the full GCP developer ecosystem and is optimal for teams already operating on GCP. Vendor SDK quality directly affects integration development cost and time-to-production — assess against your engineering team's existing stack, not against theoretical best practice. If your team is Python-native and uses async/await patterns, test each vendor's SDK against your preferred async frameworks.
● Medium Risk
16. You have confirmed that each vendor's rate limits — tokens per minute, requests per minute — are sufficient for your peak production workloads without requiring a reserved capacity upgrade. Medium Risk
Standard API tier rate limits are designed for development and mid-scale production. High-throughput enterprise workloads — customer service automation, real-time document processing, or content generation at scale — frequently hit rate limits within weeks of production launch. Confirm production rate limits in your enterprise agreement before go-live, not after the first throttling incident. Model your peak hourly token consumption and request rate, and confirm the vendor's rate limits support your peak load with at least 50 percent headroom.
● Medium Risk
17. You have evaluated fine-tuning availability, pricing, and restrictions for each vendor against your model customisation requirements. Lower Risk
OpenAI has the most mature fine-tuning capability with job management tools, checkpoint saving, and robust documentation. Anthropic deprioritises customer fine-tuning, with constitutional AI constraints limiting the scope of customisation. Google's Vertex AI fine-tuning is production-grade and integrated with the full GCP ML platform. If model customisation for domain-specific vocabulary, tone, or classification is a requirement, vendor fine-tuning capability and restrictions should be an elimination criterion, not a differentiator. Test each vendor's fine-tuning workflow against a representative dataset to confirm the quality lift and cost model.
● Lower Risk

Section 4

18. You have obtained formal SLA commitments — including uptime guarantees, latency SLOs, and support response times — from each vendor in writing, not from marketing materials. High Risk
Many early enterprise AI adopters discovered post-deployment that their standard API terms contained no uptime SLA. Production applications require a minimum of 99.9 percent monthly uptime SLA with defined service credits for failures. Any AI vendor placing services in your critical production path without a contractual SLA is an unacceptable operational risk regardless of its technical capability. Negotiate: 99.9 percent minimum SLA with service credits, explicit latency SLOs (e.g., p99 latency <5 seconds), and 15-minute support response time for Severity 1 incidents.
● High Risk
19. You have assessed each vendor's financial stability, strategic commitment to enterprise AI, and dependency on a single revenue source. Medium Risk
OpenAI's enterprise revenue is diversifying but remains concentrated in API consumption. Anthropic is venture-backed with significant Amazon Web Services strategic investment. Google's Gemini is backed by Alphabet's balance sheet and GCP infrastructure. Microsoft Azure OpenAI benefits from the combined stability of Microsoft's enterprise relationships and OpenAI's model access. Financial instability or strategic pivot in a primary AI vendor can create significant operational disruption for dependent enterprise applications. Review vendor funding, revenue composition, and strategic partnerships to assess long-term viability.
● Medium Risk
20. You have reviewed the contract termination and data return provisions for each vendor and confirmed you can exit within your required timeframe. Medium Risk
Standard enterprise AI agreements include 30 to 90 day termination notice periods with data deletion within 30 days of termination. Confirm that your data export format is machine-readable and complete, that fine-tuned model weights are exportable or that equivalent model quality can be replicated, and that the termination timeline is compatible with your transition plan. Vendors that restrict data portability or model portability at contract termination have structurally higher lock-in than their API documentation implies. Negotiate: 30-day termination notice, data export in standard formats (JSON, CSV) within 10 days of termination, and fine-tuned model weights exportable or replicated to alternative vendors.
● Medium Risk
21. You have documented a formal multi-vendor AI strategy that specifies which vendor is primary for which use case category and avoids single-vendor dependency for business-critical workloads. Medium Risk
Leading enterprises are building multi-provider architectures that spread risk while optimising for cost and performance. An AI gateway layer — routing requests to the optimal provider based on task type, cost, and availability — provides vendor independence without requiring application-level code changes for each provider. Document your multi-vendor routing logic, test failover behaviour, and review vendor weightings quarterly as capability gaps close. For example: OpenAI GPT-5 for general-purpose reasoning (70%), Anthropic Claude for code generation (20%), Google Gemini for long-context document processing (10%).
● Medium Risk
22. You have established governance for managing multiple AI vendor relationships — including a single commercial owner, consolidated spend reporting, and a vendor review calendar. Lower Risk
Managing four or more AI vendor relationships without consolidated governance creates commercial fragmentation: each team negotiates independently, volume is not consolidated, and discounts are not leveraged across the enterprise. Designate a single commercial owner for AI vendor relationships, consolidate spend reporting across all providers, and conduct quarterly vendor performance reviews that include cost benchmarking, SLA compliance, and roadmap alignment. This centralization typically yields 15–25 percent additional cost savings through volume consolidation.
● Lower Risk

Ready to optimise your AI contract and cost position?

Download our AI Platform Contract Negotiation Guide — covering all major vendors, pricing structures, and negotiation tactics.
Download Free Guide →

Next Steps

Score your confirmed items against the benchmarks above. If you are in the High Exposure or Partial Governance bands, prioritise the items flagged High Risk — these represent the most common sources of material overspend and are addressable within a single procurement or FinOps cycle.

Redress Compliance works exclusively on the buyer side, with no vendor affiliations. Our GenAI advisory practice has benchmarked AI costs, negotiated enterprise AI contracts, and built governance frameworks across 500+ enterprise engagements. Contact us for a confidential review of your AI cost and contract position.