How to evaluate a vendor's eval suite

The sentence that ends every sales call now
Every AI development vendor says some version of the same line: "we test everything with an eval suite." It sounds precise. It sounds like the vendor did the hard part already, so you do not have to ask.
We say a version of this line too. An eval suite, a set of automated checks written from the project's specification, is how we decide whether a piece of AI-written code is allowed to be released. We know why the sentence is persuasive, and we know what it leaves out. "We test everything" tells you a suite exists. It does not tell you who wrote it, what it actually checks, or who is allowed to say a test passed.
A vendor who cannot answer those questions in plain terms probably does not have an eval suite worth trusting. Here is what to ask, and why each question matters.
Question one: who wrote the tests, and when
The order matters more than the fact of testing at all. A test written from the specification, before the code exists or independent of the finished code, checks the code against what was asked for. A test written by reading the finished code checks the code against itself.
That second kind of test is common, and it is close to useless. Say a developer, human or AI, writes code that rounds a price down instead of up, then writes a test by looking at what the code does and confirming it. That test will pass forever. It never asked what the specification actually required. It only asked whether the code agrees with itself.
Ask the vendor directly: "Do you write the tests from the spec, or from the code?" If the answer is vague, or if nobody on their side can describe the order those two things happen in, assume the tests check nothing useful.
Question two: what fraction of the spec has a test tied to it
A vendor can show you a dashboard with 400 passing tests and a 100 percent pass rate, and that number can still mean almost nothing. Pass rate measures how many of the written tests passed. It says nothing about how much of the actual requirement got a test written against it in the first place.
Picture a project with 50 separate requirements in its specification. If only 10 of them have a real test, the suite can pass at 100 percent while 40 requirements are released completely unchecked. The number that matters is the coverage: how many of the things you asked for have a test that would fail if that thing broke.
Ask for one concrete example, shown step by step, instead of a dashboard screenshot: pick one requirement from your own spec, and ask the vendor to show you the exact test written against it, and what a failing version of the code looks like next to a passing one. A vendor who can do this in a few minutes, on a real example, has a suite that does what they say. A vendor who cannot produce a single example on request probably does not.
Question three: does the model that wrote the code also grade its own tests
Most buyers never think to ask this one, and it is the question that matters most.
If the same AI model writes the code and then writes, or runs, the test that judges that code, you have asked a system to check its own work with no outside reference point. Researchers at SB Intuitions tested this directly: they measured whether GPT-4, used as an evaluator, rates its own answers higher than an independent human rater would, for the exact same quality of output. It does. The paper, Self-Preference Bias in LLM-as-a-Judge (Wataoka and Takahashi, 2024), found GPT-4 shows a measurable tendency to prefer its own writing, and traced part of the cause to the model favoring text that reads as familiar to it, whether or not that text is actually correct.
This is a reason to keep the writer and the grader separate. A vendor whose process keeps those two roles apart, using a different model, a different pass, or a fixed rule set that does not change to match whatever the code already does, has a real check. A vendor who lets one pass write the code and the same pass decide it is correct has built a check that can only agree with itself.
Ask the vendor plainly: "Is the model that writes the code the same one that decides whether the test passed?" If they have not thought about this question before, that is itself an answer.
Question four: what happens when a test fails
A suite is only proof of anything if failing it actually stops something. Ask what happens the moment a test fails: does the change get blocked from release, or does someone have the option to override it and release it anyway? Ask how often that override gets used, and on what kind of failure.
A vendor who treats a failing test as a firm stop, which nobody can ignore under deadline pressure, is telling you the suite can actually stop a release. If overriding a failed test is routine, the suite is only as strong as the person deciding to skip it that day, and you are back to trusting a person's judgment call, which is exactly what an automated suite exists to reduce.
Question five: who is accountable for what the suite misses
No suite catches everything. A test suite can only check for a rule someone thought to write down in the first place, which means a genuinely new kind of mistake, one nobody anticipated when the tests were written, can get past a suite that is otherwise thorough. This is true of all testing, at every vendor.
What separates a vendor worth trusting from one that is not is what happens after something gets past the suite. Ask who is responsible when a bug reaches production despite the suite: a named individual, or the vendor as a company. A single engineer taking the blame does not fix the underlying gap, because the next new kind of mistake will not look like the last one either. A vendor that treats the miss as the company's problem, updates the suite so that specific gap cannot recur, and takes responsibility for the fix until it is in production has a real process behind its marketing line.
What a real answer sounds like
You will not get a perfect answer to every question above from every vendor, and you should not expect one. What you are listening for is specificity. A vendor with a real eval suite can point to a real requirement, a real test, and a real failure that test caught, in the time it takes to have a conversation. A vendor without one will answer in the same confident, general language every time: comprehensive, thorough, we test everything.
Whatever the sales pitch says, the suite is the thing you ask to see.
Why this is worth the extra ten minutes on a call
None of these five questions are hard to ask. None of them require you to read code or understand how a model works. They require the vendor to describe their own process in plain terms, during the call, without slides.
That is the actual test. A team that built a real eval suite uses that process every day, so describing it is easy for them. A team that added the phrase "eval suite" to their pitch after noticing buyers respond to it will delay, speak in general terms, or change the subject back to speed and cost. You are trying to tell the difference between a process and a phrase, and the difference shows up fast once you ask for one concrete example instead of a summary.
In the work we do, this is also why we keep the grading step separate from the writing step, and why, if something still got past the suite, you would reach someone who speaks for the company, and that stays true when one employee leaves. A specification is the actual contract for what gets built. The suite either checks the finished work against that contract, honestly, or it checks the work against itself and calls that proof.
A test that grades itself proves nothing. A test that checks the work against what was actually asked for, written before the code and graded apart from whoever wrote it, is the only kind worth paying for.
Sources
- Self-Preference Bias in LLM-as-a-Judge: Wataoka and Takahashi (2024) measured that GPT-4, used as an evaluator, rates its own answers higher than an independent human rater would for the same quality of output, and linked part of the effect to the model favoring familiar-sounding text over correct text.

