An SMB AI vendor evaluation defensible to the typical cyber-insurance reasonable-care expectation can be completed in 90 minutes by walking through five questions in order — model provenance, data residency, sub-processor list, breach history, termination clause — each answered from the vendor's public site or the contract about to be signed.

Editorial framework piece. Each question maps to a specific public artefact (Trust Center, DPA, sub-processor list, security/incident page, termination clause) such that absence of the artefact is itself the answer. Not a substitute for ISO 27001 or SOC 2; not a guarantee. Pairs with OPS-011 (use-case filter) — vendor selection happens after the use case clears OPS-011's filter.