How to Choose an AI Development Company: 12 Questions

Short answer: Choose the AI development company that gives clear, specific answers on four things: who owns the code, data and accounts; where your data goes; how they will prove the system works before launch; and what happens after launch when models change. A strong demo matters less than those answers. Use the 12 questions below in your first calls and ask for every answer in writing.

Key points

Ownership comes first. You should own the code, the data and the accounts the system runs on, with enough documentation that another developer could take over.
Ask where your data goes and whether any provider trains on it. Major AI providers don't train on business API data by default, but you still need that in writing.
A good vendor defines "working" before building: real test questions, a pass mark, and a plan for when the AI is wrong.
AI systems carry new security risks, like prompt injection and agents with too much access. Ask how the vendor limits what the AI can do.
Running costs and model retirements are part of the deal. Ask who pays the model bills and who updates the system when a model is shut down.

Why choosing an AI vendor is different

AI projects add three things a regular software contract often skips.

The output isn't fully predictable, so "it works" needs a test, not a demo.

The system depends on outside models that change. OpenAI, for example, says "we regularly retire older models" and that "software relying on OpenAI models may need occasional updates to keep working" (OpenAI, Deprecations).

The security risks are new. The UK's National Cyber Security Centre warns that "AI systems are subject to novel security vulnerabilities that need to be considered alongside standard cyber security threats" (NCSC, Guidelines for secure AI system development).

Public buyers have written guidance on this. The UK government's AI procurement guidelines tell buyers to "avoid black box algorithms and vendor lock in" and to make "knowledge transfer and training" part of the requirement (GOV.UK, Guidelines for AI procurement). The guidance was written for government, but it fits a 20-person company too.

The 12 questions to ask

Ownership and lock-in

1. Who owns the code, the data and the accounts it runs on? You want a plain answer: you do. That includes the code repository, the cloud and AI provider accounts (in your company's name, not the vendor's), and any prompts, test sets and configuration. If the vendor hosts everything in their own accounts, ask what it takes to move it out, and how long it would take.

Put ownership in the contract. There's one extra wrinkle with AI-assisted work. The US Copyright Office concluded in January 2025 that "copyright does not extend to purely AI-generated material, or material where there is insufficient human control over the expressive elements" (U.S. Copyright Office, Copyrightability report). Rules differ by country, so ask your lawyer how your contract should handle ownership and licenses. This guide isn't legal advice.

2. If we stopped working together, could another developer take over? Ask what the handover includes: documentation, setup steps, where the prompts and settings live, and how to run the tests. The UK guidance links explainability to this directly: it makes it "more likely for you to be able to engage with other suppliers to continue or build upon your AI system in the future, limiting the risk of vendor lock-in."

Data and privacy

3. Where does our data go, and is any of it used to train models? Ask for a list of every service your data passes through (model provider, vector database, logging, hosting), then check each one's terms. OpenAI says that for its business products and API, "we do not train our models on your data by default" (OpenAI, Enterprise privacy). Anthropic says it will not use inputs or outputs from its commercial products, including the API, to train its models by default (Anthropic Privacy Center). Both have exceptions if you opt in, for example by sending feedback, so ask the vendor how those settings are handled.

4. Will you sign a data processing agreement, and which privacy laws apply? If the system handles personal data, the vendor is usually a processor working on your behalf. Under UK GDPR, the contract must cover set terms, including processing "only on the documented instructions" of the client, security measures, use of sub-processors, and what happens at the end of the contract (ICO, What needs to be included in the contract). In the UAE, the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) came into force on 2 January 2022, and the DIFC has its own Data Protection Law (UAE Government portal, Data protection laws). A good vendor knows which rules apply to you and doesn't wave the question away.

Fit and honesty

5. What have you built that runs in production, and can we see it? A prototype is easy to make; running it daily with real users and real errors is hard. Ask what they have shipped and still maintain, what went wrong, and what they changed. If client work is under NDA, ask for a walkthrough of the architecture or a sanitized demo instead.

6. Would you tell us if we don't need AI for this? Some problems are better solved with a simple automation or a database lookup, and a vendor that says so is protecting your budget. If you're not sure what kind of system you need, our guide on AI agents vs chatbots vs automation explains the differences.

Quality and safety

7. How will we know it works before launch? Look for a vendor that defines success before building. Anthropic's documentation says good success criteria are "specific," "measurable," "achievable" and "relevant" (Anthropic, Define success criteria and build evaluations). In practice, that means a set of real questions or tasks from your business, the expected result for each, and a pass mark agreed in writing. For document search, the RAG guide shows what that test set looks like.

8. What happens when the AI gets something wrong? It will, so ask what happens next: which actions need a person to approve them, how errors get logged, and how a user can flag a bad answer. OWASP lists "excessive agency" as a top risk for AI apps: damage caused when an AI system can act on "unexpected, ambiguous or manipulated outputs." It traces the cause to "excessive functionality," "excessive permissions" or "excessive autonomy" (OWASP LLM06:2025).

9. How do you protect the system from prompt injection and data leaks? Ask how the vendor keeps the AI from following instructions hidden in emails, documents or web pages. Ask how the AI's access is limited to what each user is allowed to see, and where secrets like API keys are stored. NIST's AI Risk Management Framework also calls for "contingency processes" to handle failures in third-party AI systems (NIST AI RMF Core, Govern 6). In plain terms: what's the plan if the model provider goes down?

Cost and support

10. What will it cost to run each month, and whose account pays for it? The build price is only part of the cost. Model usage, hosting, vector storage and monitoring are ongoing. Ask for an estimate based on your expected volume, and ask that usage-based accounts be in your name so you can see the bills yourself. Our guide to what an AI agent costs to build and run breaks down the main cost drivers.

11. What happens when the model we use is retired or changes? Providers give notice, but they do retire models. OpenAI's stated minimum notice for generally available models is "at least 6 months," and much shorter for preview models, which it doesn't recommend "for business-critical production workloads unless you can migrate on short notice" (OpenAI, Deprecations). Ask who watches for these notices, who re-runs the tests on the replacement model, and whether that work is covered or billed separately.

12. What support do we get after launch, and who does the work? Get the bug-fix period, response times and the cost of ongoing work in writing. Also ask who does the engineering: is the senior person from the sales call involved in the build, or is it handed to someone else?

Good answers and red flags at a glance

Question area	A good answer sounds like	A red flag sounds like
Ownership	"You own the code, data and accounts. Here's the handover checklist."	"It runs on our platform; you get access."
Data	A list of every service your data touches, with links to their terms	"Don't worry, it's all secure."
Testing	"Let's agree on 30 to 50 real test cases and a pass mark first."	"You'll see it works in the demo."
Errors	"These actions need approval, and everything is logged."	"The AI is very accurate, so you won't need that."
Running costs	A monthly estimate based on your volume, billed to your own accounts	No estimate, or one bundled bill with no breakdown
Model changes	"We watch deprecation notices and re-test before switching."	"We'll deal with it if it happens."
Fit	"You might not need AI for this part."	AI is the answer to every question

How to use these questions

Send the 12 questions before the first call, so the vendor can prepare real answers.
Get the key answers in writing: ownership, data handling, test plan and support.
If you can, compare vendors on a small, paid first step. It shows how a team works better than any pitch.
Have your lawyer review ownership, data processing terms and liability.

If you're adding AI to software you already run, how to add AI to your existing app without rebuilding it covers the technical side of these conversations.

FAQ

Should I choose a big agency or a small team?

Size matters less than who does the work and how they answer the questions above. A small senior team suits a focused first project; a larger firm may suit work that needs many people at once. Either way, ask who will be on your project day to day.

Is a fixed price or hourly billing better for AI projects?

A fixed price works well when the scope is small and clearly written down, such as one workflow or one assistant over one set of documents. Hourly or sprint-based billing suits work where the scope will change as you learn. Ask the vendor how they handle changes to scope before you sign.

Do I need technical knowledge to evaluate an AI vendor?

No. You need clear answers about ownership, data, testing and support, not a code review. If an answer is full of jargon, ask for it in plain English. A good vendor can do that.

What should a first AI project look like?

Small and measurable: one process, one data source, a test set built from real examples, and a clear rule for what the AI may and may not do on its own. If it proves its value, you can extend it from there.

Talk it through with us

We're happy to answer all 12 questions for your project. You own the code, data and accounts we build on, every project starts with a written scope, and we'll tell you if AI isn't the right tool. Book a free consultation, or see what we build in AI agents and AI integration.

Sources

All checked October 2026.