This is a complete requirements checklist for evaluating digital asset management systems. It's ungated — copy it into your own document, delete what doesn't apply, and use what's left as your evaluation sheet or as the requirements section of an RFP.

Every line is phrased as a testable requirement: something you can verify in a demo or a trial, not a feature name you have to take on faith. "AI-powered search" is a claim; "a search for a phrase that appears only in a video's spoken audio returns that video" is a test. Insist on the second kind.

New to the topic? Read what digital asset management is first — this list will make more sense.

How to use this list

1. Delete before you add. A shorter list you actually verify beats a long one you skim. Cut every line that doesn't map to a real pain your team has today.
2. Mark priorities. Tag each remaining line Must / Should / Nice. Be stingy with Must — a system that clears 15 genuine Musts beats one that half-clears 40.
3. Test, don't ask. In demos and trials, run each line as written with your own files, not the vendor's polished sample library. A 2 GB layered design file and a 40-minute video expose more than any feature tour.
4. Record evidence. For each line: pass, fail, or "works but awkward" — with a note. "Awkward" is the category that predicts whether your team will actually use the thing daily.

Ingestion

• [ ] Drag-and-drop upload handles at least 100 files in one batch without failures or manual retries
• [ ] Bulk upload preserves the source folder structure as collections or an equivalent grouping
• [ ] Automated import syncs from existing storage (S3-compatible buckets, WebDAV shares, Google Drive) on a schedule, not just one-off
• [ ] Every upload is virus-scanned before it becomes available to other users
• [ ] Duplicate and near-duplicate files are flagged at ingest, before they pollute the library
• [ ] Previews and thumbnails generate automatically for images, video, audio, and documents — including layered design files and multi-page PDFs
• [ ] Embedded metadata (EXIF, IPTC, XMP) is extracted and mapped to fields automatically on upload
• [ ] A failed or interrupted upload reports clearly what happened and can be retried without creating duplicates

Metadata and search

• [ ] Administrators can define custom metadata fields (text, date, select, multi-select) without vendor involvement
• [ ] Controlled vocabularies constrain tagging fields so two users can't invent two spellings for the same term
• [ ] AI enrichment runs automatically on upload: tags and captions for images, transcription for video and audio, OCR for text in images and scans
• [ ] AI-generated metadata is editable and correctable — humans can override the machine, per asset and in bulk
• [ ] Semantic search returns relevant results for a natural-language description ("team celebrating outdoors") that shares no keywords with the asset's metadata
• [ ] Visual similarity search finds look-alike images starting from an asset in the library
• [ ] Search results can be filtered by any structured field (type, date, orientation, custom fields) without leaving the results view
• [ ] Metadata for hundreds of assets can be edited in one bulk operation with visible progress

Rights and governance

• [ ] Usage rights, license windows, and expiry dates are stored on the asset itself, not in a separate spreadsheet
• [ ] Rights rules are enforced, not just displayed: an expired or embargoed asset is actually blocked from download for non-privileged users
• [ ] Model and property consent records can be attached to the assets they cover
• [ ] Access rules can restrict who may view, download, or share an asset by user, group, or region, and support a machine-readable policy standard (ODRL)
• [ ] An administrator can preview exactly what a given user or guest can access before saving a permission change
• [ ] Every access and download decision is logged with who, what, and when, and the log is exportable
• [ ] Versioning keeps prior versions retrievable and shows what changed between versions
• [ ] Deleting or archiving an asset is recoverable within a defined window

Sharing and distribution

• [ ] Share links support three access levels — public, email-restricted, and password-protected — each with optional expiry
• [ ] Share recipients can download in formats you define (original, web-optimized, watermarked) without needing an account
• [ ] A brand portal gives external partners self-service access to approved assets only, with no login required for public portals
• [ ] Portals and share pages can carry your branding, not the vendor's
• [ ] Watermarks can be applied automatically and can embed recipient-specific details (name, date)
• [ ] Access tracking shows who downloaded what, and when, per share link
• [ ] Bulk export produces zip archives and contact sheets for delivery scenarios
• [ ] A shared asset that's later updated can serve the new version through the same link

Integrations and API

• [ ] A documented REST API covers the full asset lifecycle: upload, metadata edit, search, collections, sharing, and user management
• [ ] API authentication uses scoped tokens that can be issued and revoked per integration
• [ ] Webhooks notify external systems in real time when assets are created, updated, or deleted
• [ ] A typed SDK (TypeScript) exists and is maintained in step with the API
• [ ] AI assistants can operate the library through an MCP server — search, fetch, and organize assets by conversation
• [ ] On-the-fly image transformations (resize, crop, format) are available via URL, so downstream sites never store their own renditions
• [ ] API documentation is generated from the running system, so it can't drift out of date
• [ ] Published rate limits are sufficient for your integration volume, and the limit behavior is documented

Deployment and security

• [ ] Single sign-on works with your identity provider (Google, Microsoft) on the plan you intend to buy
• [ ] Roles and groups can mirror your org structure, and permissions can be assigned to groups rather than person by person
• [ ] A self-hosted deployment option exists, runs fully dockerized, and is the same product as the hosted service — see self-hosting
• [ ] You can specify or control where asset data is stored, to meet data-residency requirements
• [ ] Assets are stored on standard object storage you could extract from — no proprietary lock-in format
• [ ] A full export of assets and metadata is possible at any time, in a documented format
• [ ] Security posture is documented: encryption in transit and at rest, backup strategy, and a way to report vulnerabilities
• [ ] Uptime, incident history, or status reporting is available for the hosted service

Adoption and administration

• [ ] A non-technical user can find a specific asset within their first session, without training
• [ ] Viewers and occasional users don't consume paid seats — pricing doesn't punish giving everyone access (see the cost guide)
• [ ] Administrators can bulk-invite users from a spreadsheet and assign them to groups on import
• [ ] The interface is available in the languages your team works in
• [ ] Analytics show what people search for, what they fail to find, and what gets downloaded — so you can fix gaps
• [ ] Settings changes are tracked with history, so a misconfiguration can be identified and rolled back
• [ ] End-user documentation exists, is current, and is searchable from inside the product
• [ ] You can evaluate with a free plan or trial using your own assets, before any contract discussion

What to do with the results

Score each candidate against your pruned list, weight by priority, and then do one more thing the scoresheet won't tell you: watch a colleague who wasn't in the evaluation try to find an asset. Systems that pass requirements but fail that test fail in production too.

If you're running a formal procurement, the RFP template turns this checklist into vendor-ready requirement tables. If you've already chosen, the implementation guide covers the rollout.

Want to run this checklist against a live system right now? Open the demo — it's a working freedam library you can test line by line.