A complete talent management RFP in 2026 covers roughly 100 to 120 questions across eight modules: performance, 360° feedback, skills, career paths, engagement, analytics and AI, integrations, and security. DACH buyers need three additional mandatory sections: works council co-determination (§87 BetrVG), GDPR requirements (DPA, DPIA), and EU AI Act compliance with an August 2, 2026 deadline.
This guide gives you a practical question bank by module, a dedicated DACH compliance section, a demo script, a scoring matrix with DACH weighting, and short answers to the most common buyer questions. You can plug it straight into your existing template and adapt it to your context.
Here is what you will get:
- Why generic RFPs fail for talent management platforms
- 100+ focused questions by module, as copy-ready lists
- A dedicated DACH section: works council, GDPR, and EU hosting
- EU AI Act questions for the August 2, 2026 deadline
- A demo script and a scoring model with DACH-adjusted weighting
1. Your RFP strategy — before you ask the first question
Without a clear strategy, even the best list of talent management RFP questions will not help you select the right vendor. Generic RFPs fail in DACH for three reasons: they involve the wrong stakeholders, they ignore the legal obligations, and they do not weight modules in advance.
The key difference from generic buying guides: in DACH, the works council and the data protection officer are not optional. The works council must be involved before you sign the contract, both procedurally and substantively (source: Naegele Arbeitsrecht on introducing HR software).
Translate your business goals (retention, internal mobility, leadership pipeline) into concrete use cases first. Then fix your module weights before you see a single demo. This prevents the common "demo glow" bias, where a strong sales pitch outshines your actual requirements.
| Step | Stakeholders | Outcome |
|---|---|---|
| Requirements mapping | HR, IT, legal/DPO, works council | Prioritized checklist and use cases |
| Set evaluation weights | Selection committee | Weighting model before demos |
| Create demo script | Project lead, power users | Realistic demo flow per module |
For an industry-specific start on selection criteria, pricing, and compliance, see our DACH talent management software comparison. With this foundation set, work through the modules one by one.
2. Performance management & reviews — module questions
Performance and 1:1s are often the first module you roll out, so this section is crucial. Mercer found that 72% of employees prefer continuous feedback over annual reviews — your questions must reveal whether a vendor can support that shift.
Use these 15 questions for the performance module:
- Can we run continuous check-ins alongside annual or bi-annual review cycles?
- How configurable are review forms by role, department, and country?
- Can line managers trigger ad-hoc reviews outside standard cycles?
- Do you support both rating scales and narrative-only evaluations?
- How do you handle calibration across teams and business units?
- Can we align and cascade goals using OKRs or similar frameworks?
- Is goal progress updated manually, automatically, or both?
- Can managers schedule and document 1:1 meetings linked to goals?
- How are performance notes and feedback surfaced in formal reviews?
- Do employees get a single, clear view of goals, feedback, and outcomes?
- How do you support underperformance processes and documentation?
- Can workflows be configured for labor law requirements in DE, AT, and CH?
- What reporting is available for HR, leaders, and managers?
- How do you measure adoption and quality of performance conversations?
- Can you share sample review cycles and configuration from similar clients?
| Area | Sample question | Priority |
|---|---|---|
| Review flexibility | Can we run continuous check-ins and annual reviews in parallel? | High |
| Feedback & 1:1 | Can managers link 1:1 notes to goals? | High |
| Local labor law | Can workflows be configured for DE/AT/CH requirements? | High |
Ask explicitly whether the vendor has supported DACH customers with works agreements (Betriebsvereinbarungen) covering performance processes. This saves negotiation time with the works council later.
3. 360° feedback — test depth and anonymity
360° feedback strengthens leadership development and trust, but only if you can configure it to your culture and privacy expectations. Gallup has shown that teams using regular peer feedback can be 12% more productive. In DACH, anonymity configuration is often subject to a works agreement — request reference examples from German or Austrian customers.
Use these 12 questions to probe 360° capabilities:
- Which reviewer roles do you support (manager, skip-level, peers, direct reports, external partners)?
- Can we configure different question sets for different reviewer groups?
- How do you handle anonymity thresholds and aggregation rules?
- Can participants nominate their own reviewers with manager approval?
- Do you support bulk reviewer assignment for large populations?
- Can we run multiple 360° cycles at the same time for different cohorts?
- How are individual reports structured and shared with participants?
- Can coaches or HR partners access dedicated views for debriefing?
- Do you provide team or cohort-level analytics while protecting anonymity?
- Can 360° feedback feed into development plans and goals in the same platform?
- How do you manage reminders and deadlines for multi-rater surveys?
- Can you show examples of 360° programs at similar company sizes?
| Functionality | Vendor A response | Vendor B response |
|---|---|---|
| Custom reviewer roles | Full configuration per group | Manager/peers only |
| Anonymity controls | Thresholds and role-based rules | Basic masking |
| Multi-cycle scheduling | Separate timelines per cohort | Single global cycle |
4. Skills & competency frameworks — critical questions
Skills data powers workforce planning, internal mobility, and learning. LinkedIn's Workplace Learning Report has shown that skills-based organizations can fill roles 50% faster. Weak skills functionality limits your long-term ROI, even if the rest of the suite looks strong today.
Here are 15 skills and competency questions:
- Do you provide a pre-built skills taxonomy, and how extensive is it?
- How easy is it to add, merge, or retire skills as our business evolves?
- Can we import our existing competency models and job architecture?
- How are skills linked to roles, job families, and levels?
- Do you support proficiency levels with clear behavior indicators?
- Can employees self-assess skills, and can managers validate or adjust?
- Can employees upload evidence (projects, certifications) to prove skill levels?
- How do you avoid duplicate or overlapping skills in large organizations?
- Can we view skill gaps at individual, team, and organization level?
- Do you integrate skills with learning systems to suggest targeted content?
- Can skills drive internal job recommendations and career paths?
- How frequently is your core skills taxonomy updated?
- Can we export skills data for analysis in BI tools?
- How do you support multilingual skills libraries, including German role families?
- Do you provide best-practice templates for common roles (engineering, sales, operations)?
| Feature | Supports dynamic updates? | Integrates with LMS? |
|---|---|---|
| Skills library | Admin UI + APIs | Yes, via catalog sync |
| Competency models | Version control supported | Linked to learning paths |
| Skill evidence | Attachments and links | Completion data reused |
Make clear in your questions how you intend to use skills data over the next three to five years, not just today. For preparation, see our skill management guide and an overview of skills and competency management software.
5. Career paths & internal mobility — questions that protect retention
Transparent career paths are a major driver of retention. SHRM reports that companies with strong internal mobility see around 41% lower regrettable attrition. In Germany and Austria, internal job postings are often subject to works council co-determination — ask whether the internal job board workflow supports works council review steps.
Use these 12 questions to probe internal mobility capabilities:
- Can employees view visual career paths for their role and related roles?
- Can we configure both vertical and lateral career moves?
- How are required skills and gaps displayed for target roles?
- Do you suggest roles to employees based on their skills and interests?
- Is there an internal job board integrated with profiles and skills?
- Can employees signal career interests or mobility preferences privately?
- How do managers see potential internal candidates for open roles?
- Can we track internal mobility metrics by department and group?
- How are learning recommendations tied to desired future roles?
- Do you support succession planning views for critical roles?
- Can HR and leaders run talent reviews using shared data?
- Does the internal posting workflow support works council review steps?
| Feature | Vendor A | Vendor B |
|---|---|---|
| Career path visualization | Interactive, skill-based | Static PDFs |
| Role suggestions | AI-based, updated regularly | Manual search only |
| Learning linkage | Dynamic learning paths | Separate LMS required |
For how an internal marketplace lifts mobility and motivation, see our piece on the internal talent marketplace.
6. Engagement, analytics & AI assistants
6.1 Engagement surveys
Many organizations run surveys but struggle to act on the results. Action plans matter more than dashboards: results must turn into concrete, trackable actions.
- What types of surveys do you support (engagement, pulse, lifecycle, manager, DEI)?
- Can we target specific populations (location, role, tenure, shift)?
- Do you provide a question library with validated items and benchmarks?
- How configurable are scales, labels, and comment options?
- Can we run anonymous and identified surveys in the same platform?
- How do you protect anonymity for small teams while enabling useful insights?
- What real-time analytics do managers and HR get?
- Do you support action plans linked to survey drivers?
- Can we track progress of action plans over time?
- How do you visualize trends across multiple survey cycles?
- Can survey data be combined with performance and attrition data?
- Can managers receive coaching tips based on their team's results?
- Do you support multi-language surveys?
- How do you handle survey fatigue and smart sampling?
- What benchmark data can you share for our industry?
| Survey capability | Actionable analytics? | Action planning tools? |
|---|---|---|
| Engagement survey | Driver analysis, heatmaps | Templates per driver |
| Pulse checks | Trend views per team | Owner assignments |
| Anonymous feedback | Theme detection | Optional follow-up tasks |
6.2 Predictive analytics & AI evaluation
Vendors increasingly emphasize AI, and buyers struggle to separate marketing language from real value. From practice, we have seen cases where a vendor's claimed "AI" turned out to be a simple rules engine with no statistical basis — visible only because the buyer probed beyond the buzzwords.
- Which predictive models do you provide out of the box (attrition, promotion, engagement)?
- How are these models built (rule-based, statistical, machine learning)?
- Which data sources feed into each prediction or recommendation?
- Can we see a plain-language explanation of why a specific prediction was made?
- Can we adjust or switch off individual predictors if needed?
- What options do we have to override or correct AI suggestions?
- How do you monitor and mitigate bias in your models?
- Can you share documentation of fairness tests or external reviews?
- Where is model training data stored and processed?
- Who owns the models and derived insights, us or you?
- Can we restrict use of certain personal data fields in your models?
- How often are models retrained and on what data?
- Do line managers get practical recommendations or only scores?
- What guardrails and approvals exist around automated decisions?
- Can we export analytics data into our BI tools?
For DACH buyers, AI compliance is not optional. The EU AI Act classifies HR AI for recruitment screening, performance evaluation, and career decisions as high-risk systems under Annex III. The full compliance deadline for such high-risk systems in employment contexts is August 2, 2026 (source: HR-ON on the EU AI Act for HR in 2026). Emotion recognition in the workplace has been banned since February 2025. Ask the following AI compliance questions:
| AI compliance question | Why it matters |
|---|---|
| Have you classified your AI modules under EU AI Act Annex III? | Performance and recruiting AI count as high-risk |
| Can you provide bias-testing documentation? | Required for high-risk systems from August 2026 |
| How do you enable human-in-the-loop for AI recommendations? | Required under Art. 22 GDPR and the EU AI Act |
| Does your platform include emotion recognition? | Banned in the workplace since February 2025 |
| Do you have a roadmap for EU AI Act compliance by August 2026? | Evidence of vendor readiness |
| Can you provide a DPIA template (Art. 35 GDPR) for AI modules? | Impact assessment required for DACH deployment |
7. DACH-specific mandatory questions
In DACH, selecting talent management software is tied to three legal obligations no generic RFP covers: works council co-determination, GDPR-compliant data processing, and verifiable EU hosting. If you only clarify these after signing, you risk project delays, works agreement negotiations under time pressure — and, in the worst case, a rollout the works council blocks.
7.1 Works council co-determination (§87 BetrVG)
Under §87(1)6 BetrVG, introducing technical systems capable of monitoring employee behavior or performance is subject to works council co-determination. Courts read "capable of" broadly — no actual intent to monitor is required (source: Naegele Arbeitsrecht). A works agreement under §77 BetrVG serves a dual purpose: it satisfies co-determination and establishes a legal basis under data protection law (source: Küttner Rechtsanwälte on data protection for HR tools).
| Question for the vendor | Legal background |
|---|---|
| Have you supported DACH customers in drafting a works agreement, and can you share example documentation? | §77/§87 BetrVG — works agreement as a permission basis |
| Can you provide a demo and product documentation for the works council review? | The works council must be informed and consulted before rollout |
| Which configuration options limit the platform's monitoring potential? | §87(1)6 BetrVG — technical system for monitoring behavior |
| How do you support documenting performance criteria for the works council? | §94 BetrVG — personnel questionnaires and assessment principles |
| Can you configure aggregation rules that prevent individual performance transparency? | Works agreement standard for anonymized analytics |
7.2 GDPR & data processing
GDPR ties vendor selection to several obligations: privacy by design already during selection (Art. 25), a data processing agreement (Art. 28), a data protection impact assessment before deploying AI-based HR tools (Art. 35), and a ban on purely automated decisions with legal effect (Art. 22). For US data transfers, Schrems II requires an individual risk assessment beyond standard contractual clauses.
- Do you provide a GDPR-compliant data processing agreement (DPA) under Art. 28 GDPR?
- Can you provide or support a data protection impact assessment (DPIA) under Art. 35 GDPR for AI modules?
- How do you implement data minimization and purpose limitation (Art. 5 GDPR) in configuration?
- Do you support data subject rights (access, rectification, erasure) with operational workflows?
- Who are your sub-processors and where is their data processed?
- How do you handle US data transfers under Schrems II (standard contractual clauses plus risk assessment)?
7.3 EU hosting & data residency
For many DACH companies, EU/EEA-only hosting is non-negotiable, as the data protection officer and works council require it. Schrems II makes US transfers legally complex, so clarify the hosting chain contractually.
- Where are your data centers located? Can we contractually agree on EU/EEA-only hosting?
- Which certifications do your data centers hold (ISO 27001, BSI C5)?
- Do US-based cloud services (e.g., AWS US, Azure US) process our HR data?
- Can we restrict data residency to Germany, Austria, or Switzerland?
For a deeper side-by-side, see our DACH comparison with the GDPR and works council checklist.
8. Integrations & implementation
Disconnected systems create manual work and errors. Josh Bersin has indicated that HR teams can lose up to 18 hours a month to manual data sync when integrations are weak. Implementation also decides adoption: Prosci's research suggests organizations with robust change management are up to 70% more likely to hit their objectives.
Ten core integration questions:
- Which HRIS/HRM systems do you offer certified, pre-built integrations with?
- Do you integrate with major ATS solutions for candidate data?
- Which LMS platforms do you connect to, and at what depth (enrollment, completion, catalog)?
- Do you have native integrations with Slack, Microsoft Teams, or similar tools?
- Is there an open REST API with documentation and SDKs?
- Can we create custom events or webhooks for key actions?
- How frequently can data be synced (real-time, hourly, nightly)?
- Can we control which system is the source of record for which fields?
- Who is responsible for building and maintaining integrations?
- What monitoring and alerting do you provide for integration failures?
Ten core implementation questions:
- What is your typical implementation timeline for an organization of our size?
- Which project roles do you provide (project manager, solution consultant, technical consultant)?
- What do you expect from our side in terms of project team and time commitment?
- Can you share a standard implementation plan with milestones?
- How do you handle configuration vs. customization?
- What training formats do you offer (live, on-demand, train-the-trainer)?
- In which languages are support and documentation available?
- What are your support SLAs by severity?
- Do you offer a customer success manager as a long-term contact?
- Can you provide 2–3 references of similar customers in our region and industry?
For large, multi-stage selection processes, see our guide on how to choose enterprise performance management software.
9. Security & compliance (GDPR, SSO, audit logs)
HR data is sensitive and heavily regulated. According to the European Commission's data protection information, GDPR-related fines run into the billions across sectors. This section covers the technical security fundamentals; the DACH-specific legal questions live in section 7.
- Where is our data stored geographically, and can we choose data residency?
- What certifications do you hold (ISO 27001, SOC 2, etc.)?
- Do you support SSO via SAML or OpenID Connect?
- Can you provision and deprovision users automatically via SCIM?
- How granular are role-based permissions?
- Do you provide detailed audit logs for admin and user actions?
- How long are audit logs retained, and can we export them?
- What encryption standards do you use at rest and in transit?
- How do you handle data subject rights under GDPR?
- Can we configure data retention policies per country or legal requirement?
- How do you separate client data in multi-tenant environments?
- What is your process and SLA for incident response and breach notification?
- Do you support pseudonymization or masking for analytics use cases?
- Can we run security assessments or penetration tests?
- How do you manage subcontractors and sub-processors handling our data?
| Security feature | Vendor A | Vendor B |
|---|---|---|
| SSO & SCIM | Both supported, documented | SSO only |
| Audit logs | Exportable, API access | CSV on request |
| Data residency | EU/EEA-only possible | Single global region |
10. Demo script (10 scenarios)
A good demo script ensures vendors solve your real problems instead of showing polished slides. Share this script with your shortlist and ask them to follow it closely.
- Run a full performance cycle: set a goal, hold a 1:1 check-in, complete a formal review.
- Launch a 360° feedback process: reviewer selection, anonymity settings, final report.
- Show a skills profile and skill-gap analysis for one employee.
- Map career paths and open internal roles for that employee based on skills.
- Launch an engagement survey: targeting options, results, and action planning.
- Generate a predictive attrition risk score, explain the factors, and derive actions.
- Simulate a live integration with HRIS and LMS (new hire, course completion).
- Simulate a works council demo: which monitoring features can be disabled? Show aggregation rules for anonymized analytics.
- Demonstrate GDPR settings: data deletion, a data subject request, and audit logs.
- Walk through a support case: ticket creation, escalation, communication, resolution.
11. Scoring matrix & TCO
To reduce the "demo glow" bias, fix the weights before the first demo. For DACH, we recommend an adjusted weighting: security and compliance rise to 25%, because a works council block or a GDPR breach can kill the entire project. Score each module from 1 to 5, multiply by the weight, and compare the totals.
| Module | Standard | DACH weighting |
|---|---|---|
| Performance & 1:1s | 25% | 20% |
| Skills & competencies | 20% | 15% |
| Career paths & mobility | 15% | 10% |
| Engagement & surveys | 10% | 10% |
| Analytics & AI assistant | 10% | 5% |
| Integrations | 10% | 10% |
| Security & compliance (GDPR/BetrVG) | 5% | 25% |
| Implementation & support | 5% | 5% |
Do not forget total cost of ownership. License fees are only one part. Include at least these line items:
- Annual license or subscription fees (including future modules if planned)
- Implementation and configuration services
- Integration work (vendor, third-party, or internal teams)
- Training for admins, managers, and employees
- Ongoing support or customer success packages
- Data migration and historical data imports
- Customization or development of unique workflows
- Change management and communication costs
For a detailed comparison of modules, pricing, and RFP criteria, see our skill management software comparison.
Conclusion: building a smarter RFP for 2026
Targeted, module-specific questions help you move beyond generic feature lists and see how vendors truly support your processes. The decisive DACH difference lies in three mandatory blocks: works council, GDPR, and EU hosting — engaged from day one, not just before signing.
The EU AI Act deadline on August 2, 2026 means RFPs you write in 2026 must include compliance questions now. Involve the works council, the data protection officer, and IT security early, and review your RFP annually based on real usage.
Frequently Asked Questions (FAQ)
What questions should I ask in a talent management RFP?
Cover all key modules: performance, skills, career paths, engagement, analytics and AI, integrations, and security. For DACH, add works council, GDPR, and EU hosting. Good questions test workflow fit, not just feature lists.
Does the works council need to approve talent management software?
Usually yes. §87(1)6 BetrVG triggers co-determination for any system capable of monitoring behavior or performance. Involve the works council before signing, ideally through a works agreement (Betriebsvereinbarung).
What GDPR requirements apply when selecting a vendor?
The key ones are privacy by design (Art. 25), a data processing agreement (Art. 28), a data protection impact assessment for AI tools (Art. 35), and the ban on purely automated decisions with legal effect (Art. 22). EU/EEA hosting is standard in practice.
What does the EU AI Act mean for talent management software?
AI for recruitment screening, performance evaluation, and career decisions is classified as high-risk under Annex III. The full compliance deadline for such systems in employment contexts is August 2, 2026. RFPs should include readiness questions now.
How long does implementation take?
For smaller organizations, 4–8 weeks is realistic; for large enterprises with DACH compliance steps, expect 3–6 months. Add 2–3 months of buffer for works council consultation and the works agreement in Germany.
How do I build a vendor scoring matrix?
Fix the weights per module before demos. For DACH, weight compliance and security at 20–25% instead of the generic 5%, because a works council rejection or a GDPR breach can stop the project. Score on a 1–5 scale, multiply by weight, and compare totals.
Jürgen Ulbrich
Jürgen Ulbrich has more than a decade of experience in developing and leading high-performing teams and companies. As an expert in employee referral programs as well as feedback and performance processes, Jürgen has helped over 100 organizations optimize their talent acquisition and development strategies.
