Hiring an AI company? 12 questions a business owner should ask first

Why the questions matter more than the demo

A demo shows a system on its best day. Your business has other days: the Monday after a holiday weekend, the morning the internet drops, the customer who calls three times about the same invoice. The questions below are about those days.

They work for any kind of seller: an AI consulting firm, a freelancer who builds automations, or a software company selling a subscription. Ask every vendor the same twelve, write down what each one says, and compare. A vendor who answers plainly is worth more than one with the best slides.

The FTC has said there is no AI exemption from the laws on the books, and its 2024 enforcement sweep, Operation AI Comply, went after companies that could not back up what they said their AI would do. Give AI claims the same scrutiny you would give any contractor's promises.

Data: where it goes and who can see it

Start with the information you would hand over: customer names and phone numbers, job notes, invoices, maybe staff schedules. Ask where it will be stored, which outside services it passes through, and which people on the vendor's side can read it. A freelancer may be stitching together several services you have never heard of. That is not wrong, but you should get the list.

Then ask whether your data trains anyone's model. Some AI products use what customers send them to improve the product unless a setting is off or the contract says otherwise. The FTC's Office of Technology has warned AI model companies that using customer data in ways they did not disclose can break the law, and that promises made in marketing or terms of service count. Get the answer in the contract, not on a sales call.

Finally, ask how the system connects to what you already use: your scheduling or CRM software, your email, your accounting system. Each connection is a door. The FTC's guide for businesses on protecting personal information says to keep only the data you need, limit access to people whose jobs require it, and put your security expectations for service providers in writing.

• 1. Where does our data go, and who can see it? A good answer names the services, the roles with access, and how long data is kept.
• 2. Is our data used to train any AI model? A good answer is a clear yes or no, written into the contract, with the setting that enforces it.
• 3. What access do you need to our existing tools? A good answer asks for the least access that does the job, read-only where possible, and lists every login it creates.

Ownership: what you keep, and how you leave

If a firm builds you a custom system, find out who owns the pieces: the instructions written for the AI, the workflows, the connections and the records the system produces. A software subscription works differently, since you are renting the product, but you should still own your data and be able to export it in a format you can open.

Ask the exit question at the start, while everyone is friendly. If you part ways, what do you get: documentation, account access, an export of your records, a walkthrough for whoever takes over? A system that only one outside person understands is a risk, whether that person works at a large firm or alone.

• 4. Who owns what you build for us, and what do you keep? A good answer is a plain split, written in the contract.
• 5. If we stop working together, what do we get, and in what form? A good answer is a written handover list and exports you can use without the vendor.

Operation: mistakes, oversight and the off switch

Every AI system makes mistakes. The useful question is what happens next. Ask for a specific example: if the system books a customer on the wrong day, or drafts a quote with last year's price, who finds out, how, and who fixes it? A vendor who says it will not make mistakes has told you something important.

Ask what a person approves. A sensible design lets the system prepare work, such as a draft reply, a sorted inbox or a filled-in estimate, while someone on your team keeps the decisions that involve money, judgement or a customer relationship. Get that line drawn on paper, task by task.

Then ask who watches it after launch and how you turn it off. Systems drift: prices change, a software update moves a field, a new service gets added. Someone should review the work on a set schedule. And your office manager should be able to pause the system without calling anyone, for example when a hurricane knocks out power, the phones get forwarded and the work needs to fall back to people for a while.

• 6. What does a person on our team approve before anything goes out?
• 7. When it gets something wrong, who notices, and how is it fixed?
• 8. Who checks the system after launch, how often, and what do they look at?
• 9. How do we switch it off, and what happens to work in progress when we do?

Money and proof: measure it, check it, write it down

Agree on how success will be measured before work starts, using things you already track: calls returned, estimates sent, invoices out the door, time your office spends typing the same details twice. Be wary of a vendor whose only measure is how many messages the system sent. Activity is not the same as finished work.

Ask for real examples. A firm with clients should be able to show work and offer references you can call; ask each reference what went wrong and how the vendor handled it. A newer firm or a freelancer may not have references yet. Then ask for a working demonstration on a sample of your own data and a plain account of what they have and have not done before. Honest about being new beats vague about being experienced.

Last, get price and scope in writing: what is included, what counts as a change, what the ongoing costs are for software and AI usage, and who pays them. Usage-based AI costs can rise with volume, which matters when seasonal residents fill your schedule. Ask what the bill looks like in your busiest months.

• 10. How will we know it is working, in numbers we already track?
• 11. Can we see real work and speak with references, or see it run on our own sample?
• 12. What is the full price, including ongoing costs, and what exactly is in scope?

How to use the answers

Put each vendor's answers side by side. Vague answers, answers that change between calls, and answers that live only in a slide deck are warning signs. Clear written answers are good signs, including "we don't do that" and "we're not sure yet, here is how we would find out."

If you want a wider frame, the AI Risk Management Framework from the National Institute of Standards and Technology (NIST) is a free guide intended for voluntary use, organized around four functions: Govern, Map, Measure and Manage. You do not need to read all of it. Its core idea fits a small business: decide who is responsible, understand where the system is used, check how it performs, and act on what you find.

These are the same questions you should ask ProcessRoot AI. A ProcessRoot AI diagnostic starts by mapping the work and tools you already have, then puts data handling, ownership and the approval line in writing before anything is built.