AI Detection Procurement Checklist for 2026

Buying AI detection software is a governance decision, not an accuracy comparison. The vendors do not disagree on accuracy by much on common corpora; they disagree on data handling, methodology disclosure, integration fit and appeal workflow. The procurement questions that separate vendors are the ones about those four, not the ones about benchmark scores.

This checklist is 40 questions to put to any AI detection vendor before buying, grouped by procurement stage. Each question has a "why it matters" line and the source. Treat the answers as the body of your RFP.

1. Data handling (10 questions)

1. What is the data retention period for submitted text? (Why: liability duration and FERPA/GDPR alignment.)
2. Is submitted text used to train or improve your model? (Why: FERPA explicitly limits use of educational records; GDPR requires explicit consent.)
3. Where is submitted text stored geographically? (Why: data-residency law in EU, UK, Canada.)
4. Who within your organisation can access submitted text? (Why: insider-risk and vendor-side access controls.)
5. Do you share submitted text with any third party, including sub-processors? (Why: sub-processor list drives downstream risk.)
6. What is your breach notification SLA, and what triggers it? (Why: regulatory reporting windows.)
7. Do you offer a signed Data Processing Agreement (DPA) tailored to our jurisdiction? (Why: standard-terms DPAs may not cover K-12 COPPA or UK schools.)
8. Do you support deletion on request (right to erasure)? (Why: GDPR Article 17; some state laws.)
9. Is submitted text visible in cleartext in logs or support channels? (Why: operational data exposure beyond the stored copy.)
10. What encryption standards cover data at rest and in transit? (Why: baseline security control.)

2. Scoring methodology (8 questions)

1. What is the published false-positive rate, and on what corpus? (Why: Weber-Wulff et al 2023 found disclosure varies widely.)
2. What is the false-positive rate on non-native English writing specifically? (Why: Liang et al 2023 documented 2x over-flagging on non-native samples.)
3. How are scores produced? Is the methodology published? (Why: appealability depends on explicability.)
4. Does the score vary on re-scan of the same text? (Why: consistency is a reliability test.)
5. How is the model retrained, and how often? (Why: performance drifts as new generators ship.)
6. How does the detector handle short texts (under 300 words)? (Why: known weak spot for every detector.)
7. How does the detector handle heavily edited or paraphrased AI output? (Why: this is where detectors diverge most.)
8. What vendor-independent studies have evaluated your detector? (Why: third-party evaluation is the real reliability measure.)

3. Platform fit (8 questions)

1. Which LMS platforms do you integrate with natively? (Why: Canvas, Blackboard, Moodle, D2L cover most higher ed.)
2. Do you support institutional SSO (SAML, OIDC)? (Why: user-management baseline for institutions.)
3. Is there an API, and what is the rate limit? (Why: moderation and publishing workflows depend on API throughput.)
4. Can scans be batched, and what is the batch limit? (Why: end-of-term workflows need high throughput for short periods.)
5. Does the product support multiple languages? (Why: international institutions need multi-language.)
6. Does the product support multi-modal content (image, audio, video)? (Why: deepfake and voice detection are separate categories; some vendors cross over.)
7. What is the uptime SLA, and what is the compensation for breach? (Why: tied to assessment-period availability.)
8. How are software updates deployed, and what is the testing window? (Why: a model update mid-term can change scoring behaviour.)

4. Appeal workflow (7 questions)

1. Can the full report be shared with the student or author being flagged? (Why: appealability requires equal access.)
2. Does the product produce a chain-of-custody log (who ran the scan, when, on what text)? (Why: formal review needs an audit trail.)
3. Can the same text be re-scanned on demand, and does the result vary? (Why: consistency check as part of appeal.)
4. Does the product return a confidence interval or just a score? (Why: confidence framing supports proportional response.)
5. What is your public guidance on how to use the score responsibly? (Why: vendor-published guidance supports institutional policy.)
6. Does the detector flag false-positive cases in its own reporting? (Why: a detector that flags its own uncertainty is more defensible.)
7. How does the detector handle disclosed AI use (acknowledged in a methods section)? (Why: policy-permitted AI use should not be flagged as misconduct.)

5. Total cost of ownership (7 questions)

1. What is the per-seat cost, and does it scale by module or institution-wide? (Why: institutional pricing varies widely.)
2. Is there a scan or word cap, and what is the overage charge? (Why: a low per-seat price with high overage is a trap.)
3. What is the setup and integration cost? (Why: LMS plugin install and SSO wiring are not free.)
4. What is the renewal uplift, and when is it set? (Why: multi-year contracts should cap renewal increases.)
5. What is the exit cost (data export, migration time)? (Why: switching cost drives lock-in.)
6. Is there a usage-reporting dashboard, and does it count failed scans? (Why: billing clarity.)
7. Does the vendor publish an educational-sector discount, and what are the conditions? (Why: K-12 and public higher-ed pricing differs from commercial.)

How to use this checklist

Three practical patterns:

As an RFP body. Paste the 40 questions into your RFP template, adapt the data-handling section to your jurisdiction, and require answers from each vendor in writing.

As a pilot shortlist. Score each shortlisted vendor on each question before piloting. Two vendors that score comparably on the questions are the two to pilot on anonymised samples.

As an existing-vendor audit. Run the 40 questions against the vendor you already use. The gaps you find are the leverage you have at renewal.

Related reading

For the full procurement writeup for universities specifically, see the best AI detector for universities guide. For a trust review of detectors generally, see the most reliable AI detector guide.

Frequently asked questions

What should you ask an AI detection vendor before buying?

The questions that separate vendors are about data handling, scoring methodology, platform fit, appeals workflow and total cost of ownership. The 40 questions in this checklist cover each.

What is the best AI detection software to buy?

Best depends on governance fit, not accuracy. For universities, Turnitin leads on LMS integration; Copyleaks on multi-language; GPTZero on institutional plans. Pilot two before buying.

Do AI detectors have a false-positive rate?

Yes. Every detector tested in independent studies has a documented false-positive rate above zero. Ask the vendor for their published rate on your specific population.

How do you evaluate AI detection vendors?

On methodology disclosure, independent study coverage, data handling terms, integration fit and total cost. The 40 questions cover each axis.

Is there an RFP template for AI detection?

The 40 questions above work as the body of an AI detection RFP. Adapt the data-handling section to your jurisdiction and add institution-specific requirements for LMS and SSO.

What this means for you

If you are evaluating AI detection for an institution, use the 40 questions as the body of your RFP. Score each vendor on each question before shortlisting. Pilot the top two on your own anonymised samples. The headline accuracy number is a starting point; the procurement decision is governance, not accuracy.

Sources

• FERPA (studentprivacy.ed.gov)
• EU AI Act Article 50
• Weber-Wulff et al 2023 (Springer IJEI)
• NIST AI Risk Management Framework