Hotel Software Procurement Questions: 20 to Ask Before You Sign

Ask five things before you sign. Who owns the guest data and what happens to it when you leave. How the vendor secures it. Exactly what the AI does when it does not know. What the contract locks and what it auto-renews. And what uptime and support you get in your time zone. Get every answer in writing and attach it to the contract. That is the whole method, and a GM without a procurement department can run it in one call. The hotel software procurement questions below are the long version, with the answer that should worry you beside each one. Where the questions touch the PMS, our guide to PMS and AI integrations carries the technical detail.

A note before the list: this is general information for operators, not legal advice, and a contract this size deserves a lawyer's hour even if you have to buy it.

Who owns the guest data, and what happens when you leave?

The right answers already exist in law, which makes this the easiest group to check. Article 28 of the European Union's General Data Protection Regulation (GDPR), in force since 2018, sets out what a contract with a processor must say: the processor acts only on documented instructions from the controller, binds its people to confidentiality, applies security measures, uses sub-processors only under set conditions, helps with individuals' rights, and, at the controller's choice, deletes or returns all the personal data when the service ends and makes available all information necessary to demonstrate compliance ^[1]. You are the controller. The vendor is the processor. Even if your property is nowhere near Europe, that list is the template.

So the questions are concrete. Who owns the guest data? Where is it hosted, and in which country? Who are your sub-processors? When we leave, in what format do we get our data back, how many days until you delete it, and will you confirm in writing? The good answer to each is a sentence and a document. The worrying answer is "export is available on request," which usually means no self-service export exists.

The written version of all this is the data processing agreement, and a vendor that publishes a public data processing agreement has passed the "get it in writing" test before the call starts.

If your property has not written down its own rules for guest data yet, a plain English guest data and AI policy is the place to start, because you cannot hold a vendor to a standard you have not set.

Does the vendor train AI on your guest data?

Ask it in those words, and watch for the pause. Guest messages are not product telemetry. They contain names, room numbers, complaints, dietary needs, the occasional medical detail and the exact phrasing of a bad night. Whether any of that trains a model, for you or for every other customer, is a yes or no question with a contract clause behind it.

The good answer is "no, and here is the clause." The worrying answer is "anonymized data improves the model for everyone," which is a yes wearing a sweater. Anonymization is a claim, not a fact, and you have no way to audit it. If a vendor genuinely needs usage data to improve a product, they can say which fields, how they are stripped and whether you can opt out, in writing. If they cannot, the honest reading is that nobody has thought about it, which is worse.

This is not a niche worry. In Canary Technologies' 2026 survey of 404 hotel IT purchasing decision makers, vendor-sponsored, data and privacy issues sat among the top challenges to AI adoption, and 51% of respondents were piloting or had adopted AI ^[4]. Half the industry is already in the conversation. Be the half that asked the question first.

How does the vendor secure the data?

"We take security seriously" is a sentence, not an answer. The answer has four parts. Certification status: SOC 2 or ISO 27001, with the report date, or an honest statement that the vendor is working toward one and what controls exist today. Encryption in transit and at rest, stated plainly. Access controls: who at the vendor can see guest conversations, under what approval, and whether access is logged. Breach notification: how many hours from discovery to telling you, in the contract.

Why it matters beyond the obvious: unvetted tools multiply. Hospitality Upgrade's 2025 IT Investment Survey, drawn from CIOs representing roughly 32,677 hotels, listed shadow IT at 49% among the top digital transformation challenges, behind budget constraints at 64% and employee adoption at 51% ^[3]. Every department that buys its own fix is a department whose vendor nobody asked these questions. The messaging tool you are evaluating may be the fifth system holding guest data, and tool sprawl nobody vetted is a security exposure as much as an operational one.

The verification step is simple. Ask for the security page before the call and read it. The ResortConcierge AI trust page publishes the security and privacy posture in one place, which is what should exist for any vendor you are about to trust with guest conversations; if a vendor has no equivalent, ask why not. Then ask the four questions anyway, because a page is a claim and a contract is a commitment.

What does the AI do when it does not know?

This is the group most procurement lists skip, and it is the one with a court case attached. In Moffatt v. Air Canada, decided in 2024 by British Columbia's Civil Resolution Tribunal, the airline's chatbot gave a customer wrong information about bereavement fares. Air Canada argued the chatbot was a separate legal entity responsible for its own actions. The tribunal called that remarkable, found the chatbot was still just part of the airline's website, and awarded CAD 812.02 ^[2]. Small money. Large principle: the company answers for what its software says.

So ask. What does the AI answer from: only our property content, or the open internet? What does it do when the answer is not there, refuse, guess or hand off? Does the person receiving the handoff see why? Is the guest told they are talking to AI? Is there an audit log? The good answers name a knowledge source, a refusal behavior, a handoff with a reason attached and a log you can read. The worrying answer is "it always has an answer," because that means it guesses, and the guess is yours.

The handoff is the part to see in the demo rather than hear about. The general practice is that a conversation the AI should not handle moves to a named person with the context attached, not a generic "a team member will contact you." ResortConcierge does this through smart escalation and an escalation queue, where the conversation lands with the reason it was escalated, and that is the standard any vendor should meet. A supervised mode, where a person approves every AI reply before it sends, is planned on the ResortConcierge side and worth asking any vendor about.

What should the contract lock, and what auto-renews?

Price, tiers and the quiet costs. Ask for a price lock for the term, with the renewal increase capped in writing. Ask how tiers are defined: by room count, by conversation volume, by channel, by property. Ask which channels are included and which cost extra, because WhatsApp and SMS carry carrier fees somewhere, and the question is whether they are in the price or on a separate invoice. Ask the auto-renewal window and the termination notice period, in days, and put a calendar reminder 30 days before the window opens.

Then ask about costs that live outside the vendor's price entirely. Property management system (PMS) integrations are the common one. Oracle's OHIP, the integration platform for OPERA Cloud, is pay-as-you-go with 10,000 transactions included per month and about USD 20 per additional 10,000, billed in sandbox as well as production, per Oracle's 2026 documentation ^[6]. Small, but it is a line, and "integration is included" does not tell you who pays it. What to look for in a PMS integration covers what to pin down before the connector is built.

The full year-one budget, with the lines vendors leave off the quote, is in what an AI concierge costs and the hidden lines. One more item for it: what happens to the knowledge base you built inside the tool? Six months of refined answers about your property is an asset. If it cannot be exported in a readable format, you are renting your own words.

What uptime, support and training should you expect?

A written uptime target with a remedy, a public status page, support hours stated in your time zone, and a named contact who will still be there in a year. That is the list. "Support is 24/7" invites the question "in which time zone, and by whom," because 24/7 chat staffed nine hours away is not the same as a person who knows your property at 11pm your time.

Training is where vendors overpromise and hotels underask. The NYU Tisch Center's 2026 outlook, sponsored by Stayntouch and IDeaS, found 51% of more than 300 respondents planned to replace or upgrade their stack within 12 to 24 months, and among all-in-one users planning to switch, only 34% were satisfied with training and support ^[5]. Half the industry is about to re-buy, and training is a reason. Ask how new staff get trained after launch, not just at it, because the person trained at launch will have left by next season. Ask for recorded sessions, written guides and a named onboarding owner. Ask what the vendor did during its last outage and how customers were told.

If the vendor sells a review tool, add one question from a different domain: does anything it does fall under the FTC's 2024 rule on reviews, which bans fake or AI-generated reviews and compensation conditioned on review sentiment, with civil penalties up to USD 51,744 per violation ^[7]? A vendor who knows the rule will answer in detail. One who does not will look at you blankly, and that is your answer.

Which answers mean walk away?

Not many answers are fatal on their own. These eight should slow you down.

Vendor answers and their usual meaning, operator checklist, 2026. Patterns, not accusations; a good vendor will explain and then put it in writing.

The last row is the one to hold onto. Roadmap is fine for features. It is not fine for anything in the data or security groups. If the deletion timeline or the "no training" clause is on the roadmap, the contract does not have it, and the contract is what you are signing.

Illustrative, from a call that could happen anywhere: the GM asks who owns the guest data. "You do, of course." Where is that written? A pause. "I will check with our team." What format does the export come in? "We can arrange that on request." What does the AI do when a guest asks something not in the property content? "It always finds something helpful." Three questions, three worrying answers, 90 seconds. Nobody was rude. The GM now knows which three clauses to ask for, and which to walk from if they do not arrive.

What are the 20 hotel software procurement questions?

Twenty questions, five groups. Print it, take it to the call, write the answers in the margin, and attach the page to the order form.

Twenty questions for hotel software vendors, operator checklist, 2026. General information for operators, not legal advice; have counsel review the contract.

Take the twenty into the room. You will not need a procurement department, only the willingness to let a silence sit after a question and write down what fills it. Then hand the page to a lawyer with the contract, because this is general information, not legal advice, and the hour is worth it.