How to choose who implements AI in your business

Judge the method before the portfolio

An impressive demo can be prepared with perfect data. Ask the provider to work through a real case from your business and say what information is missing. Watch whether they ask about the current process, exceptions, permissions and the consequences of a mistake. That ability to do discovery predicts results better than a list of tools.

The implementer should tell prototype, pilot and production apart. A prototype tests an interaction; a pilot runs with limited scope and users; production requires monitoring, support, security and continuity. If those stages are blurred, you can end up paying for a demo nobody knows how to operate.

What they should answer in writing

Ask which data goes in, where it is processed, what is kept and who can see it. Ask for the list of external accounts, separate costs and the owner of each account. Confirm how knowledge is updated, who approves changes and how to return to a previous version.

Also ask what happens if the system does not know, if a provider fails or if the commercial relationship ends. You should be able to recover data and continue with your essential assets. You do not need to demand all the code on every project, but you should understand dependencies, licences and portability before paying.

• Scope and exclusions
• Acceptance criteria
• Data and permissions
• Third-party costs
• Ownership and portability
• Support, incidents and exit

How to review security without being a specialist

Ask for a simple diagram of the data flow and examples of permissions. A serious provider can explain it without hiding behind acronyms. Check that they use the business’s own accounts where appropriate, strong authentication and minimum access. Passwords should not travel by chat or sit in project documents.

Ask how they test for malicious requests, documents that contain instructions and leakage between clients. No system is infallible, but there should be layers: tool limits, validation, filters, logs and review. “The prompt says not to” is not a sufficient security strategy.

A small contract, a large learning

The first phase should be small enough to stop and real enough to learn from. Define one process, test examples, duration, deliverables and who takes part. Avoid committing to a full transformation before you have checked the collaboration and the quality of the system.

At the end, ask for a review with evidence: which cases passed, which failed, what stays manual and what changed from the start. The decision to expand should come from that review. A good implementer does not need to promise universal results; they can show limits, decisions and verifiable work.