AI Vendor Questions for iGaming

The checklist, by domain

Domain	The questions	The answer that should worry you
Explainability	Show a case-level explanation for one real decision. Who is it written for — a data scientist or a case handler?	Accuracy metrics instead of a screen
Your data	Does our data train other customers' models? Residency per market? Deletion and model disposition at exit?	"Anonymised, so it's fine" without the mechanism
Protection signals	How are RG-class signals segregated? Can you demonstrate they never enter marketing features or cross-customer training?	The question surprises them
Monitoring edges	Input/output logging in our infrastructure? Score distributions per our segments? Calibration exports?	"Our dashboard covers monitoring"
Change control	Are model versions announced before behaviour changes? Can we pin a version? Rollback?	"Continuous improvement" as a shipping policy
Failure modes	The documented fallback when the service is down or wrong. A real incident story and what changed.	Perfection; graceful degradation without specifics
Audit support	What do you provide when our regulator asks about a decision your product influenced?	"That's never come up"

Contract clauses that do the work

Decision-data ownership. Inputs, outputs and explanations for decisions about your players are your records, exportable, retained per your schedules — because the audit trail obligation is yours whether or not the model is.
Training opt-out with teeth. Not a checkbox — a warranty, with the protection-class carve-out absolute.
Version pinning and notice. Behaviour changes are releases to you, with a validation window before they route real decisions — your champion-challenger discipline needs the hook.
Exit rights. Data return, model disposition, and a transition period long enough that leaving is a decision rather than a hostage negotiation.
Regulatory cooperation. A defined SLA for producing evidence when a regulator asks — the clause nobody uses until the one day it is the only clause that matters.

Running the diligence

Do it with the model-risk owner in the room, against a real case from your own operation if the vendor will run one. Score the answers against the table, write the findings into the model register as the vendor-model's first entry, and treat unresolved worries as contract clauses rather than hopes. The pattern across every domain above is the same one this whole cluster teaches: the artefact, not the assurance.

Continue reading: AI governance — the register the vendor's model joins. The Turbo Stars platform — our own answers to this page's questions are part of any evaluation.

AI vendor diligence — common questions

What is the single most revealing question to ask an AI vendor?

'Show me the case-level explanation your product gives my team for one specific decision.' It compresses the whole diligence: a vendor with real explainability shows a screen in a minute; a vendor without it pivots to accuracy metrics and roadmap. Every downstream obligation — the audit trail, the human review, the regulator conversation — depends on the answer being a screen, not a slide.

What about our data and their training?

Three contractual facts, not assurances: whether your player data trains models served to other customers (and the right to say no), where the data is processed and stored per your markets' residency rules, and what happens to it at exit — deletion, return, and the models trained on it. In this industry the sub-question that separates vendors: how do they handle protection-class signals, and can they demonstrate those never leak into cross-customer training or marketing features.

How do we monitor a model we cannot see inside?

By its edges — which is enough if the contract guarantees them: input and output logging in your infrastructure (or exported raw), score distributions per your segments, versioning notifications before behaviour changes, and the calibration data to run the four-layer monitor yourself. A vendor who cannot support edge monitoring is asking you to carry unmonitored model risk with your licence attached.

What failure-mode answers should worry us?

'It degrades gracefully' without specifics; no documented fallback when the service is down or wrong; version changes shipped silently ('continuous improvement'); and any hesitation on the question 'has this product ever produced a wrong adverse outcome at a customer, and what changed afterwards'. Mature vendors have incident stories and postmortems; immature ones have perfection.

Does vendor certification or a big client list reduce our diligence?

It reduces the probability of gross defects, not your accountability for outcomes — the same logic as every supplier control in a licensed business. References and certifications earn a vendor the meeting; the contract terms above earn them the data. The governance page carries the underlying rule: accountability does not outsource.

Questioning the AI vendor.

The checklist, by domain

Contract clauses that do the work

Running the diligence

AI vendor diligence — common questions

See it on a live stack.