Manufacturing AI pilots don't die on the plant floor. They die in three conference rooms: security review, legal review, and compliance review. The usual cause is that nobody walked in with answers. This checklist is the walkthrough of all three rooms: the questions that will be asked, and the answer that should satisfy the person asking. If a vendor can't clear this list, the pilot was never going to ship.
Security review: what your CISO and IT will ask
The security room cares about one thing: the boundary. Where does data go, who can touch it, and what happens when something goes wrong.
- Where does inference run?
What good looks like: Inside your VPC or on-premise tenancy. No multi-tenant processing of your data on shared vendor infrastructure, and the vendor can show you the architecture diagram, not describe it.
- What leaves our network boundary?
What good looks like: Nothing by default. Anything that must cross the boundary is enumerated in writing, encrypted in transit, contractually excluded from training, and logged on both sides.
- How is access scoped?
What good looks like: Least-privilege service accounts tied to your identity provider (SSO). Per-workflow scopes that expire when the task does. No standing admin credentials, no shared logins.
- How is it separated from OT and the plant floor?
What good looks like: Network segmentation between AI workloads and OT systems, read-only taps where possible, and no direct write path to anything that moves metal.
- What is logged, and can we replay it?
What good looks like: An immutable audit log of every read and action with the reasoning behind it, exportable to your SIEM. When something looks off, you replay it instead of reconstructing it from fragments.
- What is the incident story?
What good looks like: A kill switch you control, rollback for consequential actions, and notification commitments in the contract, not in a slide.
Legal review: what your counsel will ask
The legal room cares about ownership, exposure, and exits. Good answers are contractual and architectural at the same time.
- Who owns the outputs, and the workflows built on our data?
What good looks like: You do, in writing. The workflows, configurations, and everything they learn are your assets, not features you rent.
- Can our data be used to train models?
What good looks like: No. Training use is excluded contractually for the vendor and every subprocessor, and excluded architecturally because the data never leaves your environment.
- Which subprocessors touch our data, and where does it reside?
What good looks like: A short, enumerated list with data residency stated per subprocessor. "It depends" is not an answer.
- Where does liability land when an AI-assisted decision is wrong?
What good looks like: Consequential actions carry human approval gates, so accountability has a name on it, and the contract allocates the rest explicitly instead of hoping.
- Is generated content clean from an IP standpoint?
What good looks like: Provenance on outputs, no copyleft contamination in generated code, and indemnification where it matters.
- What happens at termination?
What good looks like: You keep the workflows, the configurations, and the data, with a documented offboarding path, not a hostage negotiation.
Compliance review: what the quality and regulatory side will ask
The compliance room cares about your certifications surviving contact with new tooling. AI has to land inside the systems your auditors already certify.
- Does this fit our certified QMS?
What good looks like: AI outputs enter your existing revision control and approval flows, and AI-assisted steps are documented as controlled processes under ISO 9001 / AS9100 / IATF 16949, not around them.
- Does AI expand our CUI or ITAR boundary?
What good looks like: No. It runs inside the existing enclave, inherits its access rules (including personnel restrictions where required), and adds no new boundary to defend.
- Can the vendor map to NIST SP 800-171 / CMMC 2.0?
What good looks like: A written control mapping across the relevant control families, ready for your assessor. The vendor produces it rather than leaving it as homework for you.
- What about records integrity (21 CFR Part 11, where it applies)?
What good looks like: Audit trails, electronic signatures, and validation documentation for any workflow that touches regulated records.
- Who is accountable for AI-assisted dispositions?
What good looks like: Named human approvers on every consequential decision, with training records to show the auditor.
- Can we trace one decision end-to-end on audit day?
What good looks like: From input document to output decision in one queryable trail: timestamps, data touched, reasoning, and the human approval.
Tip: print this page (or save it as a PDF) and bring it to your next vendor conversation.