PCI DSS 4.0 vendor evaluation criteria for enterprise AI implementation — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · PCI DSS 4.0 · layout matrix_first · implementation executed in CI before publish

The control that resolves this is a Gated Vendor Evaluation Framework, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is PCI DSS 4.0, and the question it actually asks is is cardholder data in scope, and can you prove it is not. The specific problem here is RFP and structured evaluation. The shape below holds p95 ≤ 600ms over gRPC with mTLS, and ships with a standard-library implementation that runs as written.

Deployment parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

Risk register with acceptance criteria

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

The architecture friction point

A vendor comparison built as a weighted average lets a supplier average its way past a control it does not have. The scorecard ranks everyone, the committee cannot see which gates were failed, and the decision gets re-litigated after the contract is signed.

What makes RFP and structured evaluation specifically hard

An RFP scored as a weighted average lets a vendor average its way past a control it does not have. The scoring model, not the questions, is usually what makes the evaluation indefensible.

What resolves it is a two-layer scorecard: pass/fail gates, then weights. The failure to design against: the highest-scoring vendor failing security review after award.

What PCI DSS 4.0 specifically requires

PCI scope is contagious: any system that stores, processes or transmits cardholder data — or can affect the security of one that does — is in scope. The cheapest control is to keep the model tier out of scope entirely.

The artifact that satisfies it is a segmentation test proving the model tier is out of scope. The way teams most often fail it: a PAN reaching a prompt log, dragging the whole inference tier into PCI scope.

Modular implementation framework

1. Gate layer — Pass/fail controls: SOC 2 Type 2 currency, DPA, tenant isolation, residency.
2. Weighted layer — Ranks only vendors that cleared every gate.
3. Evidence requirement — Each gate names the artifact that satisfies it, not a claim.
4. TCO model — Fully loaded three-year: licence, run cost, internal effort.
5. Reference protocol — A structured call with a comparable regulated deployment.
6. Decision record — Ranking plus failed gates plus a written reason per score.

The blueprint

Gated Vendor Evaluation Framework — the request path, with the decision points that must exist before the first model call:

flowchart TB
    V[Vendor responses] --> G{Gates - pass/fail}
    G -->|any gate failed| DQ[Disqualified<br/>with named gates]
    G -->|all gates passed| W[Weighted scoring]
    W --> TCO[3-year fully loaded TCO]
    W --> REF[Reference call<br/>comparable regulated deployment]
    TCO --> R[Ranking]
    REF --> R
    R --> DR[Decision record<br/>score + reason per criterion]
    DQ --> DR
    DR --> SC[Steering committee]

Working implementation — Weighted scorecard with disqualifying gates

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind gRPC with mTLS; the failure mode it guards against is a half-open HTTP/2 stream silently dropping the deadline. The output you hand the assessor is the segmentation test report.

"""Weighted vendor scorecard with disqualifying gates.

Why this shape: a procurement scorecard that is a weighted average lets a vendor
average its way past a control it simply does not have. Real evaluations have
two layers — GATES that are pass/fail, and weights that only ever rank the
vendors that already cleared every gate.

This produces the artifact a steering committee signs: a ranking, the gates each
vendor failed, and a written reason per score.
"""
from dataclasses import dataclass, field


@dataclass(frozen=True)
class Criterion:
    key: str
    weight: float          # relative; normalised at scoring time
    gate: bool = False     # True -> pass/fail, cannot be averaged away
    note: str = ""


DEFAULT_CRITERIA = [
    Criterion("soc2_type2_current", 0.0, gate=True,
              note="Type 2 report inside 12 months, not a Type 1 or a roadmap"),
    Criterion("dpa_and_subprocessors", 0.0, gate=True,
              note="DPA signable as-is and a disclosed subprocessor list"),
    Criterion("tenant_isolation_evidence", 0.0, gate=True,
              note="Architectural isolation, not a WHERE clause"),
    Criterion("data_residency", 0.0, gate=True,
              note="Processing stays in the contracted region"),
    Criterion("exit_and_portability", 2.0,
              note="Export of prompts, embeddings, evals; no model lock-in"),
    Criterion("latency_slo_contractual", 3.0,
              note="p95 in the agreement with a remedy, not a status page"),
    Criterion("integration_depth", 3.0,
              note="Works against the real system of record, not a demo schema"),
    Criterion("implementation_capacity", 2.0,
              note="Named engineers, not a bench claim"),
    Criterion("tco_3yr", 3.0, note="Fully loaded: licence, run, internal effort"),
    Criterion("reference_in_our_vertical", 2.0,
              note="A reference call with a comparable regulated deployment"),
]


class Disqualified(Exception):
    pass


@dataclass
class Vendor:
    name: str
    gates: dict = field(default_factory=dict)    # key -> bool
    scores: dict = field(default_factory=dict)   # key -> 0..5
    reasons: dict = field(default_factory=dict)


def evaluate(vendors, criteria=None):
    """-> (ranked, disqualified). Gates are evaluated first, always."""
    criteria = criteria or DEFAULT_CRITERIA
    gate_keys = [c.key for c in criteria if c.gate]
    weighted = [c for c in criteria if not c.gate and c.weight > 0]
    total_w = sum(c.weight for c in weighted) or 1.0

    ranked, disqualified = [], []
    for v in vendors:
        failed = [k for k in gate_keys if not v.gates.get(k, False)]
        if failed:
            disqualified.append({"vendor": v.name, "failed_gates": failed})
            continue
        got = 0.0
        breakdown = []
        for c in weighted:
            s = float(v.scores.get(c.key, 0))
            if not 0 <= s <= 5:
                raise ValueError(f"{v.name}.{c.key}={s} outside 0..5")
            contribution = (c.weight / total_w) * (s / 5.0)
            got += contribution
            breakdown.append({"criterion": c.key, "score": s,
                              "weight": c.weight,
                              "contribution": round(contribution, 4),
                              "reason": v.reasons.get(c.key, ""),
                              "standard": c.note})
        ranked.append({"vendor": v.name, "score": round(got * 100, 1),
                       "breakdown": breakdown})
    ranked.sort(key=lambda r: -r["score"])
    return ranked, disqualified


if __name__ == "__main__":
    passing = {k: True for k in
               ("soc2_type2_current", "dpa_and_subprocessors",
                "tenant_isolation_evidence", "data_residency")}
    a = Vendor("Vendor A", gates=dict(passing),
               scores={"exit_and_portability": 4, "latency_slo_contractual": 5,
                       "integration_depth": 4, "implementation_capacity": 3,
                       "tco_3yr": 3, "reference_in_our_vertical": 5},
               reasons={"latency_slo_contractual": "p95 450ms with 10% credit"})
    b = Vendor("Vendor B", gates={**passing, "tenant_isolation_evidence": False},
               scores={k: 5 for k in
                       ("exit_and_portability", "latency_slo_contractual",
                        "integration_depth", "implementation_capacity",
                        "tco_3yr", "reference_in_our_vertical")})
    ranked, dq = evaluate([a, b])
    for r in ranked:
        print(f"{r['vendor']}: {r['score']}")
    print("disqualified despite perfect scores:", dq)

The PCI DSS 4.0 control, as code

PAN tokenisation and a scope-reduction proof. This is the artifact an assessor asks for under PCI DSS 4.0 specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""PAN detection with tokenisation, and a scope-reduction proof.

PCI DSS 4.0 scope is everything that stores, processes or transmits account
data, plus anything connected to it. The cheapest compliance move is not better
controls — it is removing systems from scope. A model gateway that never sees a
PAN is out of scope; one that sees it once is in, along with everything it talks
to.
"""
import hashlib
import re

PAN_RE = re.compile(r"\b(?:\d[ -]?){12,18}\d\b")


def luhn_valid(digits: str) -> bool:
    total, parity = 0, len(digits) % 2
    for i, ch in enumerate(digits):
        d = int(ch)
        if i % 2 == parity:
            d *= 2
            if d > 9:
                d -= 9
        total += d
    return total % 10 == 0


class TokenVault:
    """Format-preserving surrogate. The vault is in scope; nothing it feeds is,
    provided the surrogate is not reversible outside it."""

    def __init__(self, pepper: str):
        self._pepper = pepper
        self._map: dict[str, str] = {}

    def tokenise(self, pan: str) -> str:
        digest = hashlib.sha256(f"{self._pepper}:{pan}".encode()).hexdigest()
        surrogate = "4" + str(int(digest[:15], 16)).zfill(15)[:15]
        self._map[surrogate] = pan
        return surrogate

    def last_four(self, pan: str) -> str:
        return pan[-4:]


class ScopeBoundary:
    def __init__(self):
        self.systems: dict[str, bool] = {}
        self.flows: list[tuple[str, str]] = []

    def add(self, system: str, sees_pan: bool) -> None:
        self.systems[system] = sees_pan

    def flow(self, src: str, dst: str) -> None:
        self.flows.append((src, dst))

    def in_scope(self) -> set[str]:
        scope = {s for s, sees in self.systems.items() if sees}
        changed = True
        while changed:                      # connected-to is also in scope
            changed = False
            for src, dst in self.flows:
                if src in scope and dst not in scope:
                    scope.add(dst); changed = True
                elif dst in scope and src not in scope:
                    scope.add(src); changed = True
        return scope


def redact(text: str, vault: TokenVault) -> tuple[str, int]:
    found = 0
    def _sub(m):
        nonlocal found
        raw = re.sub(r"[ -]", "", m.group(0))
        if not luhn_valid(raw):
            return m.group(0)
        found += 1
        return f"tok_{vault.tokenise(raw)}(last4={vault.last_four(raw)})"
    return PAN_RE.sub(_sub, text), found


if __name__ == "__main__":
    vault = TokenVault(pepper="hsm-managed")
    text = "Charge card 4111 1111 1111 1111 for invoice 9912, ref 1234567890123456"
    out, n = redact(text, vault)
    assert n >= 1 and "4111 1111 1111 1111" not in out, out
    assert "last4=1111" in out, out

    # A number that fails Luhn is not a PAN and must not be mangled.
    benign, n2 = redact("order 1234 5678 9012 3450 placed", vault)
    assert n2 == 0 and "1234 5678 9012 3450" in benign, benign

    sb = ScopeBoundary()
    sb.add("checkout", True); sb.add("token_vault", True)
    sb.add("llm_gateway", False); sb.add("analytics", False)
    sb.flow("checkout", "token_vault"); sb.flow("token_vault", "llm_gateway")
    scope = sb.in_scope()
    assert "llm_gateway" in scope, "connected-to is in scope — that is the point"

    clean = ScopeBoundary()
    clean.add("checkout", True); clean.add("token_vault", True)
    clean.add("llm_gateway", False)
    clean.flow("checkout", "token_vault")
    assert "llm_gateway" not in clean.in_scope(), clean.in_scope()

    print("PCI DSS 4.0 tokenisation + scope reduction: OK")
    print(f"  PANs tokenised {n}, naive scope {len(scope)} systems, "
          f"segmented scope {len(clean.in_scope())} systems")

Control questions before sign-off

• Is the inference tier in PCI scope, and what segmentation test proves it is not?
  Cardholder data is tokenised before the model boundary and the segmentation is evidenced by an annual penetration test, so the tier stays out of scope by design.
• Which criteria are pass/fail, and which vendor failed one?
  Gates are evaluated first and independently of score: SOC 2 Type 2 currency, DPA and subprocessor disclosure, tenant isolation evidence, residency. A failure on any of them disqualifies.
• Which criteria are pass/fail, and which vendor failed one?
  The gate layer is pass/fail: SOC 2 Type 2 currency, DPA and subprocessor disclosure, tenant isolation evidence, and data residency. Gates are evaluated before any weighted scoring, so a vendor cannot average past a control it lacks.
• For each passed gate, what artifact proves it and what is its date?
  Each gate names the artifact that satisfies it — the report, the signed DPA, the architecture document — with its date. A claim is not evidence.
• Is the latency target in the signed agreement with a remedy, or on a status page?
  It must be in the signed agreement with a remedy. A status page is not a commitment; the scorecard scores the remedy, not the promise.
• What does exit look like — specifically, what can you export and has it been rehearsed?
  Export of prompts, embeddings, eval sets and fine-tunes, rehearsed during the pilot rather than promised in the contract. Portability that has never been executed is not portability.
• Was the reference deployment in the same vertical and regulatory regime as ours?
  It must be — a reference in the same vertical and the same regulatory regime, worked through a structured question set, not a vendor-selected happy customer.

Adjacent problems

• Part of enterprise ai vendor evaluation.
• The same control appears in ISO/IEC 27001:2022 vendor evaluation criteria for enterprise AI.
• A different failure mode of the same component: SOX vendor evaluation criteria for enterprise AI implementation.
• Where this interacts with another regime, see SOC 2 Type II vendor evaluation criteria for enterprise AI implementation.
• For the related constraint, see HIPAA vendor evaluation criteria for enterprise AI implementation.
• If this is the blocker in front of you: enterprise AI infrastructure review.