Begin with metadata, then approved examples, then a bounded pilot if justified. Specify the question the evaluation must answer before choosing the sample. A request for maximum volume is not itself evidence that maximum volume is necessary.
The release record should cover the named legal entity and authorised users, permitted purpose, files or record identifiers, access method, download rules, onward sharing, retention, incident contact, conclusion date and required return or deletion evidence. Counsel should review the agreement, while the data owner checks whether the controls can actually be operated.
AWS explicitly states that it does not validate a prospective subscriber's submitted information and assigns that responsibility to the provider in its verification guidance. Use an identity check appropriate to the proposed disclosure; completion of a form is only one input.
Set measurable acceptance criteria, such as schema completeness, agreed duplicate handling, usable source identifiers and task-specific evaluation results. Choose thresholds from the intended task and sample, rather than inventing universal accuracy requirements. NIST AI 600-1 discusses documented testing. This pilot checklist is an original editorial recommendation.
Advance when: agreed acceptance criteria and rights/controls conditions are met, and a separate commercial decision supports the next commitment. A successful technical pilot does not alone establish a profitable licence.