Sovereignty Questions to Ask Before You Sign

These questions are written for a commercial discussion, not a conference. Each one has a document that should exist. If the document does not exist, the answer is no. Fluent no is still no.

Send the list a week before the meeting. Ask for artefacts attached, not spoken. Three people should mark independently: procurement, CISO, DPO. Average only after each has written a word — accept, condition, or fail.

Control and location

1. Where, precisely, will prompts, embeddings, weights, logs and backups live? Name the facility, not the country.
2. Who holds the encryption keys, and can we rotate them without you?
3. What is the complete egress allow-list of the proposed deployment, including licence checks?
4. Which legal entity will be the processor on the DPA, and in which country is it organised?
5. Which foreign laws can compel that entity to produce our data? If you do not know, say so.
6. Where does the identity provider live, and what identifiers leave India on each login?

Model and training

1. Which models are in the default path, and which are in any fallback path?
2. Will any of our data, including traces and evals, be used to train or evaluate a model that other customers can reach?
3. If we fine-tune, who owns the adapter, where is it stored, and in what format can we export it?
4. Can we switch the model without a change request that resets the price?
5. What happens to inference if outbound internet is cut for 72 hours?

People and support

1. Who can access the production workspace, from where, and under what ticket?
2. Are support sessions recorded, and where do those recordings sit?
3. What is the list of sub-processors today, not the URL to a page you control?
4. Which annotation, eval or red-team vendors will see our data, even if sampled?
5. What is the last incident in which your staff accessed a customer's production workspace, and how was it recorded?

[Exit](/blog/what-happens-to-your-data-on-contract-exit) and failure

1. On termination, what artefacts are returned, in what format, within how many days?
2. What is deleted, including backups and eval sets, and who signs the certificate?
3. Show us the last time you restored this stack onto a second environment without your SaaS control plane.
4. What happens to service if your parent company is ordered to stop serving Indian government customers?
5. Which clause in your paper already calls undeclared egress a material breach? If none, will you add ours?

How to use the answers

Fails on location, training or undeclared egress are conditions precedent or they are bid rejection. Conditions that can be fixed — a missing schedule, a weak certificate template — go into the MSA before financials are compared, not after. Do not let a promise to add a schedule survive until kickoff. Kickoff is when leverage dies.

Keep the marked list in the file. Future officers, and future auditors, need to see why a path was accepted. Memory is not a control.

How to run the room

Send the questions a week ahead with a one-page instruction: attach the artefact, do not attach a slide. Start the meeting by opening attachments, not by allowing a product tour. If an artefact is missing, mark the question fail and move on. Do not spend the hour helping the salesperson find a PDF on their laptop.

Seat the people who can mark. A meeting of eight listeners and one speaker will produce minutes, not diligence. Three markers is enough: procurement, CISO, DPO. Everyone else is optional and should not dilute a fail.

Record answers in the same table you sent. After the meeting, circulate the marked table the same day. Vendors who want to 'clarify' a fail may send artefacts within 48 hours. After that, the mark stands. Open-ended clarification is how a fail becomes a story.

Questions officers are afraid to ask

Will your parent company produce our prompts if a foreign court asks. What happens if your acceptable-use policy bans government use next quarter. Which of your engineers have standing access today. Can we load last month's adapter on a model you do not sell. These feel rude. They are ordinary continuity questions. Write them into the list so no one has to be brave in the room.

Turning answers into conditions precedent

A good answer that is not yet on paper becomes a condition precedent: the DPA schedule, the egress list, the deletion template, the restore date. Do not compare financials until those papers exist. Price on a missing schedule is how you buy a conversation.

Conditions that cannot be met before signature — a restore drill that needs your staging rack — become deliverables with a stop on production data. Production is the privilege. Artefacts are the price of the privilege.

A ten-day diligence sprint before signature

Day 1: send the question list and the artefact instruction. Day 3: refuse to confirm the meeting if fewer than half the artefacts have arrived. Day 5: meeting, attachments first, no product tour. Day 6: circulate marks. Day 7–8: 48-hour artefact cure. Day 9: conditions precedent listed. Day 10: counsel turns fails into clauses or a stop.

Do not let sales move the meeting earlier because a director is in town. Diligence that waits for a director is a photo. Photos do not list subprocessors.

After signature, keep the marked table in the file and reuse it at the first quarterly audit. Questions that were accept should still be true. Questions that were condition should now be accept. If a condition is still open, production personal data stays off.

1. Fluent answers without paper are fails.
2. SOC 2 of an affiliate is background, not an answer.
3. Compulsion questions need a jurisdiction or an honest we do not know.
4. Financial comparison waits for the paper.

Objections you will hear — and what to do with them

Sales will say the questions are hostile. Continuity questions feel hostile to people who have only been asked about features. Tell them the same list goes to every bidder. Hostility that is universal is just a standard.

They will ask to answer orally because the architecture is evolving. Evolving architecture is a reason to wait, not a reason to skip paper. If they cannot freeze a picture for signature, you cannot freeze a price for signature.

Your own leadership will say we already decided this vendor. Decisions without artefacts are preferences. Preferences can still collect paper. If the paper fails, the decision gets to be brave or get to be reversed. Both are better than discovering the fail in production.

Counsel will want to redraft every question. Let them add, not subtract. Subtracting the compulsion question or the training question is how the list becomes a product questionnaire again.

After the meeting, the vendor will send a twenty-page clarification that restates the demo. File it. Do not change marks unless a new artefact arrived. Clarifications without artefacts are literature.

How this shows up in the file

Put the marked table behind the work-order note. A later officer should see which questions were fail, which were condition, and which artefacts closed them. If that trail is missing, the next negotiation starts from zero and the vendor knows it.

Reuse the same table at the first quarterly audit. Accepts must still be true. Conditions must now be accepts. An open condition means production personal data stays off, even if invoices have started. Invoices are not a lawful basis.

If leadership presses to sign because a director is in town, send the director the artefact list instead of a briefing slide. Directors who see missing paper usually wait. Directors who only see slides usually sign. Give them paper.

What the next noting must contain

“Sovereignty Questions to Ask Before You Sign” belongs in a file, not only in a search result. A P2 Procurement should be able to point at one artefact that proves “sovereign AI vendor questions”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Print this list. Put it across the table. The useful answers are short and evidenced. The dangerous ones are fluent. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C1 Sovereignty & Data Residency: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “sovereign AI vendor questions”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.

Related reading on contract language for exit is in What Happens to Your Data on Contract Exit. Use both together. Questions without clauses are conversation.