Short answer. An RFP for an AI transformation partner in a bank should score production evidence above pitch quality. Standard IT RFPs miss up to 60% of the risk questions specific to AI, so the document has to ask what share of a vendor’s AI projects reached production, name the regulated clients behind those numbers, and map every claim to EU AI Act and DORA obligations. Weight the scorecard so delivered outcomes count for more than credentials, and require a working reference the bank can call.
An RFP for an AI partner is a scorecard, not a wish list. The document you write decides which vendors you can compare and which risks you surface before you sign. Most banks reuse a software procurement template, and that is the first mistake. Software RFPs ask about features, licenses, and uptime. An AI transformation RFP has to test whether a partner can move a model from a pilot into a governed production system, because that is where 94% of AI value in a bank is lost.
The 2026 McKinsey State of AI survey found that nearly nine in ten organizations use AI in at least one function, yet only 6% attribute a measurable share of profit to it. The gap is not model quality. It is the ability to redesign a workflow and run the result in production under supervision. A good RFP forces every bidder to prove they close that gap with real numbers.
Write the RFP around three tests:
In a bank, the partner writes the code, but the bank carries the liability. Under Article 26 of the EU AI Act (Regulation (EU) 2024/1689), the bank is the deployer of a high-risk AI system and holds twelve standing duties, from human oversight to logging to incident reporting. For Annex III high-risk uses such as credit scoring and insurance pricing, those obligations apply from 2 December 2027. The vendor cannot absorb that accountability, so the RFP has to confirm the partner builds systems the bank can actually govern and evidence.
The pressure is already live. The ECB asked significant institutions to submit an action plan on AI-enabled cyber risk by 31 October 2026, and DORA has required documented ICT and third-party risk controls since January 2025. An RFP that does not ask a bidder how their delivery maps to these obligations is buying a compliance problem, not solving one. Put the regulatory questions in the scored sections, not the appendix.
Score production evidence above pitch quality: standard IT RFPs miss up to 60% of AI-specific risk questions.
A standard IT RFP asks whether the software works. An AI RFP asks whether the outcome holds up in production and stays compliant as the model changes. Add sections a software template never contains: the vendor’s production rate and how they measure it, their approach to model monitoring and drift, how they handle data residency and access to bank data, who signs off before a model goes live, and how they hand over ownership so the bank is not locked to one supplier.
Ask for one concrete case where the vendor put an external model or decision engine into production for a regulated client, including the before and after metric. A partner that ships will answer with a number. A partner that advises will answer with a framework. That single question separates the two faster than any credential check.
Build a weighted scorecard and publish the weights inside the RFP so bidders know what counts. A workable split for a bank puts 40% on production track record and references, 25% on regulatory and governance fit, 20% on technical approach and integration with legacy core systems, and 15% on commercial terms. The common error is the reverse: teams over-weight technical credentials and get impressed by advanced qualifications while overlooking whether the vendor can drive business value through operational change.
Score references by calling them. Ask each reference what share of the promised outcome reached production, how long it took, and what broke. A vendor with a real portfolio will offer references without hesitation. Treat a refusal to provide a callable production reference as a disqualifying signal, not a scheduling problem.
Name the obligations the partner’s work must support, and score the answers. Require the bidder to show how their delivery supports EU AI Act deployer duties under Article 26, DORA ICT and third-party risk documentation, and GDPR where the system processes personal data. Ask for their record on data residency in the EU, model logging that survives an audit, and human oversight design that a supervisor would accept.
The OECD AI Principles set the accountability standard most regulators now echo: AI actors must ensure traceability of datasets, processes, and decisions across the system lifecycle. An RFP that asks a bidder to demonstrate that traceability, with a concrete example, filters out partners who treat governance as paperwork rather than architecture.
Read every response for three tells. First, outcomes described as adjectives instead of numbers. A bidder who cannot state a delivered metric has not delivered one. Second, a production rate that is missing, vague, or presented without a reference to verify it. Third, an answer that shifts accountability for the live model back to the bank without a monitoring and rollback plan. Each of these predicts a pilot that stalls, which is the exact outcome the RFP exists to prevent.
Score conservatively on any response that leads with the size of the vendor’s team or the length of their client list rather than the share of work that reached production. Scale is not the same as delivery, and in a regulated environment only delivery counts.
Ableneo works in the regulated Central European market where these RFPs are written, with banks and insurers including CSOB, Erste, and UNIQA. In 2025 Ableneo shipped 34 production AI projects across four countries, with roughly four of five reaching production and 94% using large language models. One public example: document validation at a regional telecom operator ran 14 times faster, from seven hours to thirty minutes, at over 90% accuracy, with the client on record. When a bank writes an RFP, that production rate is the number to demand from every bidder, and to verify by reference. The Ableneo team builds AI systems the deployer can govern, observe, and account for, which is what an audit and a board both ask to see.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.