Look beyond checkboxes. Can the vendor trigger flows from list views, related lists, or inline quick actions? Do they respect validation rules, required fields, and duplicate management? Grade the nuance of their connectors, not just availability, and capture evidence through recorded walkthroughs, sandbox proofs, and admin sign-off.
Score documented policies, breach response commitments, data retention controls, and subject access workflows. Confirm subcontractor disclosures and model provider dependencies. Require clear answers on prompt logs, training data usage, and PII handling. Create a red-yellow-green system so legal, security, and operations align around acceptable risk levels.
Calculate admin hours, change management, user enablement, and incident overhead alongside subscription pricing. Include overages, model tokens, and data egress. Ask for renewal caps and roadmap transparency. A vendor that minimizes hidden operational drag often outperforms a cheaper sticker price when adoption reaches hundreds of daily users.