BLOGS

10 questions to ask every AI vendor before you sign

Written by James | Jun 19, 2026 2:49:18 PM

10 questions to ask every AI vendor before you sign

We all know about the new opportunities AI tools are creating across sports and media workflows, particularly around localisation, archive discovery, metadata enrichment and content distribution.

But all this operational value relies on good governance.

As we explored in our webinar “Navigating the AI Minefield in Sports and Media”, organisations who are evaluating AI vendors increasingly need clarity around consent, ownership, compliance, security and accountability before deployment even begins.

This is crucial. Because as Dawn Juntilla, General Counsel at Thomson Reuters explained in the webinar:

"Restrictions and obligations apply not just to
EU companies, but for any AI system that is used
within or its outputs are used within the EU."

- Dawn Juntilla, General Counsel at Thomson Reuters

AI vendor conversations can move quickly. A compelling demo, a promising proof of concept and suddenly you're in commercial discussions before you've asked the questions that actually matter. This guide gives you those questions, drawn from the legal, commercial and operational realities of deploying AI in sports and media.

Q1. Does your system process biometric data and if so, how?

Biometric data including facial recognition, skeletal tracking and emotion recognition is considered high risk under the EU AI Act. Many organisations are exploring AI tools without fully understanding whether biometric processing is happening inside their workflows. If it is, your organisation could inherit significant compliance obligations.

Dawn Juntilla warns that organisations cannot simply focus on outcomes without understanding the underlying processing of this data. “You need to understand if biometric data is being processed,” she says. “It can't just be: ‘I have this problem, solve it,’ and you don't quite understand exactly what's happening.”

Ideally, you need a clear explanation of:

  • Whether biometric data is processed
  • What specific data is involved
  • Why it is being processed
  • Where it is stored and processed
  • What legal basis or consent framework applies

Vague answers from an AI vendor should concern you.

Q2. Who owns the outputs your system generates from our content?

AI-generated metadata, clips, analytics and enrichment layers all carry commercial value. But rights holders are increasingly aware that archive and live content may become more valuable once AI makes it searchable, localised and commercially usable at scale.

And content ownership can become more complicated when a third-party vendor is generating those outputs. So, look for clear language that confirms:

  • Your organisation owns the outputs
  • The vendor has no competing ownership claims
  • Usage rights remain under your control
  • Ownership continues after contract termination

Q3. Are you training models on our data and do we have the rights to allow that?

This is becoming one of the most important commercial and governance questions in sports media.

Federations, broadcasters and rights holders are sitting on decades of valuable archive footage, athlete imagery and performance data. It’s hardly a surprise that vendors may want to use that content to improve their own AI systems.

The challenge is that your organisation may not actually hold the consent or licensing rights required to allow that training to take place. As Brian Leonard, Live Services Lead at Reuters Imagen points out: “There was a fear from the federations I spoke to that they have all this library and they have all this data, and if they give it to a company, and the company trains [on it], they then go off and make billions.”

When talking to vendors, we recommend requesting a direct explanation of:

  • Whether training occurs (and whether it is optional)
  • What data is used
  • How consent is handled
  • What contractual protections exist

Many organisations are now requesting explicit written permission before any training can occur using their data.

Q4. What happens to our data when the contract ends?

Data portability becomes critical once workflows begin to scale. If your metadata, enrichment layers or archives are trapped inside proprietary systems, then switching vendors could become operationally expensive and legally difficult.

It is also important for you to own your data and not have it locked in anywhere. The data effectively has come from the your business and return back to your business, not stay with the vendor.

When talking to any AI vendor, make sure you identify ways to keep control of your data. These can include:

  • Data export formats
  • Export timelines
  • Deletion procedures
  • Metadata portability
  • Archive retention obligations

These should be defined before procurement.

Q5. Where is our data stored and processed and does it comply with data sovereignty obligations?

Many sports and media organisations operate internationally. But while cloud infrastructure, AI processing and model hosting may involve multiple jurisdictions, your existing data transfer obligations still apply.

As Dawn Juntilla reminds us: “You always have to abide by data sovereignty requirements.” This means that any contract must feature full transparency around:

  • Hosting regions
  • Processing locations
  • Cross-border transfers
  • Third-party cloud infrastructure

If the vendor cannot clearly explain where your data lives, that creates risk.

Q6. What security measures do you have in place?

Sports organisations increasingly manage sensitive athlete data, rights-protected live feeds, commercial partner assets and historical archives.

AI workflows can increase speed and efficiency, but they can also increase the number of systems, integrations and data touchpoints involved. And that creates governance and security operational issues that are impossible to ignore:

What good looks like here from an AI vendor:

  • ISO 27001 certification
  • Clear access controls and audit trails
  • Incident response procedures
  • Secure deletion processes
  • Willingness to share security documentation

A vendor should be able to explain all this clearly.

Q7. How long do you retain our data and why?

Some vendors retain data indefinitely because it’s operationally convenient or commercially useful for training purposes. But that can create unnecessary exposure for your organisation. The solution here is to look for a clear retention policy that covers:

  • Retention periods
  • Deletion schedules
  • Customer deletion rights
  • Backup handling

Retention should have a business justification.

Q8. What happens when your service fails (and what happens if it does)?

This became one of the strongest themes from our webinar. Every AI system will produce errors. Vendors need clear processes for identifying, monitoring and correcting failures, including escalation and human review workflows.

As Brian Leonard said in the webinar: “It's more important to know what happens when AI fails than when it's successful… If you ask those questions to vendors, and they're like, ‘It never fails,’ then be wary…”

A vendor should be willing to show:

  • Known limitations
  • Failure scenarios and error rates
  • Human review workflows
  • Escalation procedures
  • Accountability ownership

This is often where gaps in operational processes become clear.

Q9. What are your obligations under the EU AI Act and how are you meeting them?

The EU AI Act is already changing procurement conversations across sports and media. The obligations apply to technology developers, deployers and users, and that means your organisation may still carry risk if your vendor is not compliant.

As Dawn Juntilla explained: “The prohibited uses for the EU AI Act as well as AI literacy requirements are already in force.”

In practice, this means that you should be looking for:

  • An active compliance programme
  • Internal governance structures
  • AI usage policies
  • Named accountability owners
  • Ongoing monitoring processes

Q10. What rights do we have to audit your compliance?

AI regulation is evolving quickly. A vendor who appears compliant today may need to adjust their workflows, data handling or governance approach tomorrow as new guidance emerges.

Crucially, you need visibility into how that process will be managed. Any contract should include:

  • Audit rights
  • Regulatory notification obligations
  • Governance review processes
  • Escalation procedures for material compliance changes

This protects both sides over the lifetime of the relationship.

Good governance builds trust

We can all see that AI can create huge operational and commercial value across sports and media. Many organisations are already using AI to improve localisation, archive discovery, metadata enrichment and content servicing workflows.

But good governance still determines whether those deployments can scale safely. And good governance builds trust.

As the “Navigating the AI Minefield in Sports and Media” webinar reinforces, organisations need to understand their data, rights, workflows and vendor responsibilities before AI can deliver long-term value.

A vendor who can answer all 10 of these questions clearly and in writing is usually a vendor who takes governance seriously. These conversations take time upfront, but they protect your organisation, your athletes and your content in the long run. If a vendor struggles to answer, that's useful information too.

Reuters Imagen is built on Reuters' Trust Principles and operates to the same standards of accuracy, transparency and accountability that Reuters applies to its journalism. If you'd like to understand how we approach these questions, speak to our team of experts.


Watch the Webinar:
>> Navigating the AI Minefield in Sports and Media <<