An enterprise AI procurement cycle in 2025 was a capability conversation. What can the model do. How fast. At what cost. With what reliability.
An enterprise AI procurement cycle after Hermes is a governance conversation. The capability questions still matter. They no longer differentiate. The questions that differentiate are now about what the platform reads, what it decides, and what happens when it gets the decision wrong.
This piece is the operational guide to how that shift changes procurement, what to add to every RFP, and where to push back.
The Shift in One Paragraph
Before Hermes, the assumption inside most enterprise AI procurement was that the AI platform was a model with a wrapper. The buyer evaluated the model, evaluated the wrapper, evaluated the price, and signed. After Hermes, that assumption no longer holds. The wrapper is doing more than the model. It reads context, makes decisions based on what it reads, and can take enforcement actions independent of the buyer's explicit instructions. The buyer evaluating the wrapper now has to evaluate its decision logic — and that is a different kind of evaluation than enterprises are currently set up to perform.
What Belongs in Every AI RFP Now
A short, concrete addition to the procurement checklist. Six items.
1. The telemetry inventory. A vendor-supplied list of what context the AI platform inspects in the customer environment. What it reads from documents, codebases, calendars, communication tools, browser context, OS-level state, network metadata, and anything else the deployment touches. Versioned. Updated as it changes.
2. The decision-layer disclosure. A description of what downstream logic operates on the ingested context. What categories of action the platform can take — billing changes, access changes, behavior changes, output adjustments — based on what it reads. The buyer's right is to know the surface of the decision layer, not necessarily the weights.
3. The enforcement audit log. A commitment that any platform action that affects billing, access, or substantive behavior is logged to a surface the buyer can inspect. Not a customer support inquiry. A real, queryable audit log.
4. The dispute mechanism. What the buyer does when they believe an enforcement action was wrong. Who they contact. Response-time commitment. Precedent. Whether the dispute resolution is governed by the contract or by the vendor's discretion.
5. The notification commitment. How the buyer learns about a platform action in real time. The Hermes user's notification was the overage line on their invoice. That cannot be the standard for enterprise.
6. The change-management commitment. When the platform's behavior changes — new detection layers, new enforcement surfaces, new telemetry — how the buyer is notified, with what lead time, and with what option to renegotiate.
A vendor with clean answers to six is a vendor that has thought about the post-Hermes environment. A vendor without them is one whose risk profile is materially different from what the capability sheet suggests.
Where to Push Back
The reflex from AI vendors who are not yet ready for these questions tends to be one of three responses. Each has a counter.
Response 1: "That's proprietary." Counter: the buyer is not asking for the model weights. The buyer is asking for the surface of the decision layer — what it reads and what it can do. That surface is governable disclosure, not trade secret.
Response 2: "Our customers don't ask this." Counter: they will. The procurement leaders who anticipate the trajectory do it now, before the standards crystallize, while the negotiating leverage is highest.
Response 3: "We're not aware of any such mechanism." Counter: the Hermes case showed that vendors can be unaware of their own platform's detection logic until it produces a viral incident. Lack of vendor awareness is not a defense. It is the substance of the buyer's concern.
The procurement leaders who hold the line on these questions now influence the norm that governs the category as it forms.
The Internal Work
The other half of the post-Hermes procurement shift is internal — work the buyer organization has to do whether or not the vendor cooperates.
Map AI surfaces. What AI platforms are deployed in the organization. What systems they touch. What context they ingest. Increasingly the work of the same function that does data lineage and access management.
Establish a platform-incident playbook. When an AI vendor takes an action the customer organization did not expect — a billing change, an access change, an output change — what happens internally. Who is notified. Who decides on response. Who handles the external comms if it leaks.
Plug into the disclosure conversation. The category-level conversation about AI platform disclosure is forming now. Enterprise buyers who participate — through standards bodies, industry groups, or direct vendor pressure — shape the norms. Buyers who do not participate accept what gets shipped.
Budget for the shift. Governance and security review for AI tooling looks set to become a line item, not a one-time event. The post-Hermes procurement standard is heavier than the pre-Hermes one.
Where This Is Likely Headed
Current trajectories suggest a baseline standard for AI platform disclosure will form over the coming period — through some combination of industry self-regulation, regulatory pressure, and enterprise buyer demand. The likely shape is a set of minimum requirements: what is documented, what is auditable, what is disputable.
The vendors that move first — Anthropic, OpenAI, Google, Microsoft, and the next tier — appear positioned to set the standard. The enterprise buyers that hold the line on the right questions during the formation phase have the opportunity to influence how the standard reads.
Hermes was a small incident. The procurement shift it accelerates is not.
Read next
Observed platform behavior as of May 2026. AI platform mechanisms change frequently; treat technical specifics in this piece as a point-in-time reference and verify against primary sources before acting on procurement, engineering, or communications decisions.
Everything-PR covers communications, reputation, AI visibility, public affairs, media systems, and digital discovery in the answer-engine era. Publishing since 2009. Thirty verticals. Original reporting, research, and analysis. Every page reported, sourced, and built to be cited.
