Vendor and partner selection

Aspect 8 of 10. Most AP teams do not build video analytics or facial recognition systems. They buy them, and the quality of the buying decision sets the ceiling on everything else.

What you will be able to do

• See the full chain of parties behind a single video analytics or facial recognition feature.
• Run a diligence process that fits the risk of the use case.
• Put the commitments that matter into the contract.
• Plan for renewal, model change, and exit before you sign.

You are buying a whole supply chain

Behind one video analytics or facial recognition vendor there is usually a model provider, a cloud host, a camera hardware manufacturer, and a set of integrations into your case management system. Any of them can change terms, change behavior, or have an incident.

• Which facial recognition or ORC detection model powers this, and can the vendor swap it without telling you?
• Who hosts your surveillance footage and biometric database, and in which country?
• Which subprocessors touch your CCTV footage or person-of-interest lists?
• Is the vendor reselling someone else's analytics engine with a new interface?

Responsibility does not transfer down the chain. To the customer who was wrongly stopped, it is your deployment.

Size the diligence to the risk

• Low risk. Internal shrink dashboards with no personal data: confirm terms, retention, and training opt-out.
• Medium risk. Self-checkout exception detection and POS analytics: add security review, performance evidence, and named accountability.
• High risk. Facial recognition, person-of-interest matching, or anything that can lead to a stop or detainment: add bias testing evidence, documentation deliverables, audit rights, and legal review.

Questions that separate serious vendors

• What exactly does the system do, and where does it perform worst, such as low light or certain skin tones?
• Show me match accuracy and false positive results broken out by the demographics of our customer base.
• How do you notify us before a model or matching algorithm change?
• What documentation do you provide, and is it a contract deliverable?
• Who is accountable on your side when a false match leads to a wrongful stop?
• What do we get on exit, including our footage and watchlist data, in what format, and how fast?

Vague answers to specific questions are the finding. Record them.

A scenario

A retail chain buys a facial recognition platform for organized retail crime detection after a strong demo. Two years later a wrongly detained customer files a lawsuit. The vendor cannot produce match accuracy by demographic group, the contract has no audit right, and the matching algorithm has been updated twice without notice.

Put it in the contract

1. Data terms. No training on your footage or biometric data without consent, defined retention, deletion on request.
2. Change notice. Advance written notice of model or material behavior changes, including new matching algorithms.
3. Evidence. Documentation, match accuracy results, and bias testing as deliverables.
4. Audit and cooperation. The right to request records and support during a wrongful stop investigation or litigation.
5. Incident terms. Notification window and a named contact for a data breach involving biometric data.
6. Exit. Footage and watchlist data export format, timeline, and confirmed deletion.

Your leverage is highest before signature and at renewal. It is near zero the day you need something.

The relationship does not end at purchase

• Keep an inventory of AP AI vendors with owner, use case, risk level, and renewal date.
• Re-review at renewal, and whenever the vendor changes terms or matching capability.
• Watch for scope creep: the camera system bought for safety that quietly starts running facial recognition.
• Track whether promised match accuracy is holding in your stores.

What to do in your own deployment

1. Route all AP technology purchases through a single intake, regardless of price.
2. Use a tiered diligence checklist tied to the risk of the use case.
3. Maintain a standard AI and biometric data contract addendum and start from it every time.
4. Name an internal owner for every vendor relationship, from CCTV analytics to case management.
5. Set a calendar review before each renewal date.
6. Document the reason you selected a vendor, so the decision can be defended later in court or by a regulator.

Recap

• Buying AP AI means inheriting a chain of parties, and the accountability stays with you.
• Match diligence to the use case, with facial recognition and ORC tools at the top.
• Get data, change notice, evidence, audit, incident, and exit terms in writing.
• Manage the vendor after signature, with an owner and a renewal review.