The GPU Vendor Evaluation Checklist: What to Ask Before You Sign Anything

◆ THE CERTIFICATION SCOPE PROBLEM

Which product, which tier, which period

Get the actual SOC 2 report, not the marketing page referencing it. Check whether it's Type I or Type II, and which specific product or tier the audit boundary covers. Check the audit period too. A Type II report is a point-in-time snapshot of a historical window, not a standing certification. One where the observation period ended over a year ago, with no successor report in progress, tells you far less about current posture than a fresh one does. A handful of minor exceptions with documented remediation is normal in a report covering 6 to 12 months of real operations. A pattern of repeated exceptions on the same control, or an exception with no remediation noted, is worth raising with the vendor directly before anything gets signed.

◆ COUNTERPARTY STABILITY IS NOW A REAL VARIABLE

Two providers already disappeared this year

Two GPU cloud companies shut down or froze new signups in Q1 2026 alone. Customers who'd built on either one are now rebuilding on infrastructure that wasn't part of their original plan. Check how long the company has operated at current scale, whether it's raised capital recently, and what the actual data migration path looks like if service ends with short notice.

◆ THE THREE FABRIC QUESTIONS

Real training infra vs. someone else's topology

The interconnect question separates real training infrastructure from someone else's topology wearing a different logo. What's the fabric, NVLink, InfiniBand, or Ethernet, and is it non-blocking inside a pod. What's the NVLink-domain size, eight GPUs for standard HGX versus seventy-two for NVL72, and how does traffic route across that boundary. What's the actual peak read bandwidth from a 128-GPU job on the storage layer. A vendor that answers all three cleanly has mature training infrastructure. A vendor that deflects on any of them is usually inheriting infrastructure from an underlying partner and reselling it under their own brand.

◆ EGRESS IN WRITING

Where surprise bills actually come from

Egress fees need to be in writing, with real numbers, not a general policy statement pointing at a pricing page. This is where surprise bills come from more often than any other line item on a GPU contract. Worth asking specifically what happens during high-demand periods too, whether existing customers get squeezed out when everyone trains models in the same quarter, and what the reservation system actually looks like when that happens rather than what the sales deck says it looks like.

◆ EXIT TERMS DESERVE THE SAME SCRUTINY AS PRICING

The section most buyers skip because it's boring

Exit terms deserve the same scrutiny as the pricing itself, and this is the section most buyers skip because contracts are boring and fabric specs feel like the real work. Google Cloud's own published contract guidance treats a 90-day exit notice with no penalty as the standard to lock in, alongside up to 12 months of free egress at contract end. Fewer than that on a GPU contract is worth pushing back on directly.

Read the renewal clause word for word, not the summary of it. Some contracts don't auto-renew into a one-year extension. They auto-renew into a new term matching the original commitment. Miss the notice window on a three-year deal under this structure and the lock-in isn't one more year, it's three. Look specifically for phrases like "successive terms of the same length" or "renewal term shall match the initial term." Push for renewal terms that convert to month-to-month or one-year periods regardless of how long the original term ran, on any multi-year deal, no exceptions.

Check who owns the performance data too, since this one hides inside what looks like a standard reporting clause. A provider offering a dashboard is normal. A provider whose contract says customers can't export, scrape, or reproduce that dashboard's output outside vendor-authorized channels is something else, a data lock-in dressed up as intellectual property protection. That clause means the usage history, cost data, and performance metrics built up over a contract term can't leave with the buyer if they switch providers later.

Ask for the hardware refresh roadmap in real dates, not fiscal half-years. Firm calendar quarters for the next generation's general availability. Which SKUs are already under procurement contracts versus which ones are still slides in a deck. What penalty applies if the stated availability date slips by more than one quarter. A provider advertising consumer-grade cards as enterprise stopgaps, or showing "coming soon" without SKU numbers or network specs, is signaling something about how seriously to take the rest of the roadmap.

None of this requires adversarial energy at the negotiating table. It requires specificity, and a willingness to actually read the document instead of the summary someone wrote for it. A vendor with a real answer gives one immediately. A vendor without one changes the subject, points back to the marketing page, or answers a slightly different question than the one that got asked.

◆ THE CHECKLIST

◆ FAQ

Frequently asked questions