What an RFP for AI and workflow governance should require

Most RFPs for AI and automation ask what a vendor's tool can do. In a regulated business, the better question is what it can prove: that every required step ran, in order, every time, and that you can show an examiner exactly what happened in any single case.

That gap is where most evaluations go wrong. A demo shows an AI agent answering a customer. It does not show what happens after the conversation ends: the data re-keyed into the core, the documents chased by email, the approval that sits in someone's inbox while a regulatory clock runs. And it rarely shows how compliance is enforced. In most companies, compliance is checked after the fact, in a GRC review, and anything that was wrong gets redone by hand.

We published a free, vendor-neutral RFP checklist for AI and workflow governance to close that gap. Use it to evaluate any vendor, including us. Here is what it asks for, and why.

Four things every vendor must prove

1. Runtime enforcement. Policies, both regulations and your own SOPs, are enforced at every step while the work runs, whether a person, a form, a call or an AI agent started it. A required step that fails stops the run. If the vendor's answer is a dashboard that flags violations afterward, it is not enforcement.

2. An immutable audit trail. Every run produces a step-level record: what the customer saw and agreed to, each check, each decision and who made it, and why each AI action was allowed. No one, the vendor included, can edit it. Ask the vendor to pick a random run in the demo and produce its full record in under five minutes.

3. The front-to-back handoff. Capturing the request is the easy part. The platform should run the work all the way to the system of record: prefill from what your systems already know, classify the request with an owner and a due date, chase missing documents on a clock, route decisions to the right reviewer, and write the result back. If the vendor stops at the front door, someone on your team still finishes the work by hand.

4. Live in weeks. A first regulated process in production in weeks, not a multi-quarter IT project, with policy changes shipping in hours or days. Ask for two production references with go-live dates measured from kickoff.

Red flags

• "Guardrails" on an AI that runs the process. Guardrails reduce errors some of the time. They do not stop an AI from skipping a step or writing something it should not to your core system. The process itself has to run deterministically.
• Compliance reported after the fact. Scoring, sampling and dashboards tell you what went wrong last month. Ask what stops the violation before it happens.
• The audit trail is application logs. A log is not an audit record. Ask for a per-run record an examiner would accept, and how it is protected from edits.

The checklist lists nine red flags in all.

The live proof test

Written answers are cheap. Give every finalist the same scenario from your industry and 60 minutes, and score each step pass or fail:

1. Start the process from two doors: a human channel and an AI agent.
2. Prefill from your system of record, so only missing data is asked.
3. Break a rule mid-run. The run must block or escalate before anything is written.
4. Send a decision to an outside reviewer with no account.
5. Let a regulatory clock run out.
6. Take the system of record offline at write-back.
7. Produce the full record of a random run in under five minutes.
8. Show how long the scenario took to build, and who built it.

A vendor that cannot run the test live does not belong on the shortlist.

By industry

The 41 core requirements apply everywhere. Each industry adds its own, with the regulations a platform must enforce and a proof test built for that industry:

• Banking and credit unions: Reg E disputes, loan completeness before Processing, BSA and CDD
• Home lending: TRID and Reg X clocks, changed circumstances, loss mitigation
• Insurance: first notice, claims settlement clocks, market conduct evidence
• Healthcare: HIPAA, prior authorization, consent before the procedure date
• Telecom: FCC SIM swap and port-out rules, CPNI, the Safe Connections Act
• Utilities: PUC disconnection rules, medical holds, assistance pledges
• Travel and eCommerce: disruptions, refund policy, chargeback evidence

Get the checklist

The full checklist is free to read at callvu.com/rfp/ai-workflow-governance. The spreadsheet version adds a scorecard for up to three vendors, ready to drop into your RFP.

It is published by Callvu, and it works for evaluating any vendor. We built it around the questions we think every regulated buyer should ask. If a vendor, including us, cannot prove all four, keep looking.