Most RFP templates still ask nothing about AI. Here are the questions that close the gap, how to score them, and the standard questions you should still ask.
The RFP questions to ask suppliers in 2026 cover six standard areas (company stability, capability fit, implementation, commercials, security, and references) plus one area most templates still leave out: AI and AI agents. That section should ask where the supplier uses AI and agents to deliver the work, what those agents can do without a person, how your data is used, whether agent actions are logged and can be stopped, who is accountable when an agent gets something wrong, and how you will know when the AI changes.
This guide is for category managers and sourcing leads running RFPs for services, software, and outsourced processes, where a supplier’s AI touches your data, your systems, or your customers. For simple goods purchases, an RFQ with a short supplier questionnaire is usually enough.
Key takeaways
- Standard RFP templates cover company, capability, pricing, security, and support, but rarely ask about AI.
- Suppliers’ AI agents can act inside your business, so the RFP must ask what they may do without a person.
- Six areas cover agentic due diligence: AI use, autonomy, data use, oversight, accountability, and change and disclosure.
- Treat data use, oversight, and accountability as pass/fail gates, and score the rest.
- Weight the AI section by how much autonomy the scope hands the supplier.
- The same questions apply when your own team uses agents to run the RFP.
Why does every RFP now need an AI and agentic section?
Supplier AI has moved from assisting people to acting for them. An assistant drafts a reply for a person to send. An agent sends it, places the order, or changes the record. Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024. Much of that software will reach you through your suppliers.
Adoption is uneven, which is exactly why the RFP has to ask. McKinsey’s latest State of AI survey finds that about two in ten respondents have reached the scaling phase with AI agents across their organization. Some suppliers will run agents in production, others will be piloting them, and some will describe pilots as products. A standard template cannot tell them apart.
Agents enter an RFP in three ways:
- In the supplier’s delivery. Software, outsourced processes, and managed services increasingly include agents that act inside your systems: routing tickets, updating records, contacting your customers, or committing spend.
- In the supplier’s proposal. Responses are increasingly drafted with AI. They read well and can say little, so you need evidence and a named person behind each claim.
- On your own side. Sourcing teams now use agents to draft RFPs, qualify suppliers, and compare bids. The last section of this guide covers what that changes.
Which AI and agentic questions should you ask suppliers?
Twelve questions in six areas cover the ground. Each comes with what a good answer shows, so evaluators agree on what they are looking for before the responses arrive.
Where does the supplier use AI and agents in this work?
- List every point in delivering this scope where AI or an AI agent is used, and say which tasks it performs on its own and which it only assists with. A good answer names specific tasks and systems, not a general claim that AI enhances the service.
- Which third-party models or AI providers does your solution depend on, and where are they hosted? A good answer names the providers and regions, and explains what happens if one becomes unavailable.
What can its agents do without a person?
- Which actions can your agents take without human approval, and what limits apply, such as spending thresholds, record types, or customer communications? A good answer describes a documented permission model with thresholds you can configure, not a promise that humans stay in the loop.
- What access will your agents need to our systems, and how is that access granted, scoped, and revoked? A good answer uses least-privilege access through named service accounts, with revocation you control.
How will it use your data?
- Will our data, or outputs derived from it, be used to train or improve models that serve other customers? A good answer gives a clear yes or no that the contract will reflect, with opt-out terms if the answer is yes.
- Where will our data be processed and stored, how long is it retained, and how is it deleted at the end of the contract? A good answer names regions and retention periods and commits to certified deletion.
Can you see, and stop, what its agents do?
- Is every agent action logged with what was done, when, on whose authority, and on what data, and can we access those logs? A good answer offers logs you can export or query, kept for as long as your audit needs require.
- How can we pause or stop an agent, and how are its actions reversed if it acts in error? A good answer describes a stop control you operate and a rollback procedure the supplier has tested.
Who is accountable when an agent gets it wrong?
- Who is liable for losses caused by an agent’s error, and how is that reflected in indemnities and limits of liability? A good answer treats agent actions as the supplier’s own actions under the contract, rather than excluding them as AI outputs.
- Who owns the outputs your AI produces for us, and do you warrant that they do not infringe third-party rights? A good answer assigns ownership to you and extends the IP indemnity to AI-generated work.
How was this proposal written, and how will you know when the AI changes?
- Was AI used to draft this response, and which named person attests that each capability claim is accurate and available today? A good answer discloses plainly, names an accountable signatory, and labels roadmap features as roadmap.
- How will you notify us of material changes to the models or agents serving us, and how do you test that performance has not degraded? A good answer commits to advance notice, shares test results, and gives you the right to delay adoption.
Figure 1: Agentic due diligence in six areas, and which to treat as pass/fail gates.
How should you score the AI section?
Not every AI question should carry points. Some answers should disqualify a supplier outright. As Figure 1 shows, treat three areas as pass/fail gates: data use, oversight, and accountability. A supplier that will train shared models on your data without consent, cannot show you what its agents did, or excludes agent errors from its liability should not reach the scoring stage.
Score the other three areas (AI use, autonomy, and change and disclosure) on a simple 0 to 4 scale. A 0 means no answer, a 2 means a stated policy without evidence, and a 4 means a documented control backed by evidence or a reference customer.
Then weight the section by how much autonomy the scope hands the supplier. Where AI only assists the supplier’s own staff, the AI section might carry 10% of the technical score. Where agents act inside your systems or with your customers, it might carry 25% or more. Treat these as starting points to adjust, not as a standard.
Evaluation capacity is the hidden constraint. The Hackett Group’s 2026 Procurement Key Issues study finds that 43% of organizations are actively pursuing AI deployment, but only 12% report large-scale implementation. Many sourcing teams are judging supplier AI before they have run much of their own, so bring IT security and legal into the scoring of this section.
Which standard RFP questions should you still ask?
The AI section adds to the RFP; it does not replace the rest. These eighteen questions cover the standard areas. The full question bank adds modules for direct materials, indirect services, software, and professional services.
Company and stability
- How long have you provided this service, and what share of your revenue does it represent?
- What has changed in your ownership, leadership, or financial position in the last three years?
- Which subcontractors would deliver any part of this scope?
Capability fit
- Does your solution meet each requirement in our requirements table fully, partially, or not at all?
- Which capabilities in your response are available today, and which are on your roadmap?
- What would you need from us to deliver this scope?
Implementation
- What is your plan, timeline, and staffing for a scope of our size?
- Which risks most often delay work like ours, and how do you manage them?
- Who will lead our implementation, and what similar work have they led?
Pricing and commercials
- What is the total cost over three years, including implementation, training, support, and likely change requests?
- Which costs are fixed, and which vary with volume or usage?
- What are your terms for price increases, renewal, and termination?
Security and compliance
- Which certifications and audit reports can you share, and when were they last renewed?
- How quickly, and how, do you notify customers of a security incident?
- How do you meet the regulations that apply to our industry and regions?
References and support
- Can you provide three references of similar size and scope, including one former customer?
- What service levels do you commit to, and what remedies apply when you miss them?
- How is support structured, and who is our escalation contact?
What changes when your own side of the RFP uses agents?
Agents are arriving on the buyer’s side of the table too. Gartner predicts that by 2027, half of organizations will support supplier contract negotiations through the use of AI-enabled tools. When your team uses agents to draft RFPs, qualify suppliers, and compare bids, the six areas above apply to your own tools as much as to your suppliers: what the agent may do alone, where its actions are logged, and who approves its decisions.
Merlin Autonomous Sourcing, part of the Merlin Agentic Platform, is built on that principle. A category manager describes the business problem in plain language and gets a sourcing strategy grounded in spend and contract history. The agent then drafts the RFP, loading questions from past sourcing playbooks, and qualifies suppliers before they are invited to bid. Procurement decides where agents act and where they escalate, human approval sits at every key decision gate, and every agent action is logged and time-stamped. The principle behind it: isolated agents do tasks; Zycus delivers Intake to Outcomes.
Whichever side of the table the agent sits on, the test is the same. AI decides. Suite governs. Enterprise stays in control.
Buying procurement software itself? Our companion guide covers the RFP questions to ask procurement software vendors.
Frequently asked questions
1. What questions should an RFP ask suppliers?
An RFP should ask about company stability, capability fit against your requirements, implementation, pricing and commercial terms, security and compliance, and references and support. In 2026 it should also include a section on AI and AI agents: where the supplier uses them, what they can do without a person, how your data is used, how agent actions are logged and stopped, and who is accountable for errors.
2. What AI questions should you ask a supplier in an RFP?
Ask where AI and agents are used to deliver the work, which actions agents take without human approval, whether your data trains models that serve other customers, whether every agent action is logged and can be stopped or reversed, who is liable for agent errors, and how you will be told when the models change. Also ask whether AI drafted the proposal and who attests to its claims.
3. How do you evaluate a supplier’s use of AI agents?
Treat data use, oversight, and accountability as pass/fail gates, because failing any of them creates risk that scoring cannot offset. Score the remaining areas, such as autonomy design and change management, on a 0 to 4 scale that rewards documented controls and evidence over stated policy. Weight the section by how much autonomy the scope gives the supplier, and involve IT security and legal in the evaluation.
4. Should suppliers disclose whether AI wrote their RFP response?
Yes. Ask suppliers to disclose whether AI was used to draft the response and to name a person who attests that each capability claim is accurate and available today. AI-drafted proposals can read well while saying little, so disclosure, a named signatory, and clearly labeled roadmap items make responses comparable and hold the supplier to what it wrote.
5. How do you score RFP responses?
Agree the scoring method before the RFP goes out. Separate pass/fail requirements, such as security certifications or data-use terms, from scored criteria. Use a simple scale, such as 0 to 4, with written definitions of each score, and weight each section by its importance to the scope. Have several evaluators score independently, then reconcile differences against the written definitions.
6. What is the difference between an RFI, RFP, and RFQ?
A request for information (RFI) gathers general information to understand the market and build a supplier long list. A request for proposal (RFP) asks shortlisted suppliers how they would meet defined requirements and at what cost, and is used when the solution matters as much as the price. A request for quotation (RFQ) asks for prices on clearly specified goods or services.
7. How many questions should an RFP have?
Enough to evaluate what matters, and no more. Start from a core set that applies to every RFP, add the module for the category you are buying, and add the AI section when the supplier’s AI will touch your data, systems, or customers. Every question should map to a scored criterion or a pass/fail gate. Questions that will not change your decision add work for suppliers and evaluators without improving the outcome.
8. Can AI write an RFP?
Yes. Agentic sourcing tools can turn a described business need into a sourcing strategy and a draft RFP, drawing questions from past sourcing events and qualifying suppliers before they bid. The draft still needs human review. Look for tools that let procurement set where agents act and where they escalate, require approval at key decisions, and log every agent action.
