Glossary term
RFP (Request for Proposal)
Also: Ausschreibung, Request for Quotation, RFQ
A structured document that invites vendors to propose a solution against specified requirements, evaluation criteria and timeline. RFPs are the formal front-end of most enterprise buying processes; DecisionOS sits upstream of the RFP and downstream of it, not inside it.
An RFP formalises requirements, commercial expectations and evaluation rules before vendors respond. Done well, it compresses the buying cycle and keeps the process defensible. Done badly, it produces long vendor responses that are impossible to compare and invite the worst kind of spreadsheet acrobatics.
The decision memo is a different artefact. The memo captures why the requirements are what they are, which options are really on the table (including incumbents and status quo), the dealbreakers and weighted criteria, and the evidence behind the decision. The RFP is the request; the memo is the decision.
In practice
In regulated scopes (public-sector procurement under UVgO or VgV, DORA Art. 28 due diligence), both artefacts are expected. The memo feeds the procurement file as the auditable decision basis; the RFP documents the formal commercial process.
Related terms
Vendor matrix
A structured comparison of vendor options across weighted criteria, showing scores, evidence per cell and an aggregate result. A good vendor matrix separates dealbreakers from weighted criteria and makes every score traceable to a source.
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Readiness Score
A 0-100 score that quantifies how decision-ready a memo actually is. It breaks down into criteria coverage, evidence quality, risk analysis, stakeholder alignment and formal governance. A score above 70 signals audit readiness.
RTO / RPO
Two core BCM metrics. RTO = maximum downtime by which a process must be back online. RPO = maximum tolerable data loss measured in time.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.