The market for AI services contains serious engineering companies and resellers who have wrapped someone else's model in a login page. Both present similarly. These questions separate them, and none of them require technical knowledge to ask.
On data and legal basis
1. Where exactly is our data processed?
Not "in the cloud" and not "in Europe" as a slogan — which region, and can it be written into the contract? A provider who cannot answer precisely has not thought about it, or does not control it.
2. Will you sign a data processing agreement under Art. 28 GDPR?
If you are putting personal data into their system, they are your processor and this contract is not optional. Ask to see their standard version before you commit. Read the sub-processor list in particular.
3. Who are your sub-processors, and how are we told when they change?
Every AI provider has them — at minimum whoever runs the underlying infrastructure. The correct answer is a list plus a defined notice period and a right to object.
4. Are our inputs used to train models?
Ask for this as a contractual assurance rather than a claim on a website. Website statements change without notice. Ask specifically about both their own models and any third-party models involved.
5. What happens to our data when we leave?
Ask about export format, the window in which export is possible, deletion timelines and whether deletion is confirmed in writing. Also ask about backups, where data typically persists longest.
On the service itself
6. What availability do you actually commit to, and what happens if you miss it?
A number without a consequence is marketing. Ask how availability is measured, what is excluded from the measurement, and what remedy applies. Note that generous exclusions can make an impressive figure meaningless.
7. What is your support arrangement in practice?
Service hours, response times by severity, and how you report a problem at four in the afternoon on a Friday. Ask whether response time means a human assessment or an automated acknowledgement.
8. Who owns what we build with you?
Particularly for custom integrations. Expect the provider's reusable components to remain theirs — that is normal and reasonable. What matters is that work created specifically for you is usable by you, and that this is written down.
On competence
9. What will this not do well?
The most informative question on the list. A provider who has genuinely deployed these systems will answer readily and specifically, because they have watched it fail. A provider who says it handles everything has not been to production.
10. How do you handle incorrect output?
Look for a concrete answer about review steps, confidence handling and escalation paths — not a claim that their approach prevents it.
11. What does the second year cost?
Build cost is quoted eagerly. Ask for running costs at your expected volume, maintenance, and what happens to the price when usage grows. Ask what triggers a change in pricing.
12. Can we speak to someone doing something similar?
A reference from a comparable company is worth more than any deck. If none can be offered, that is information too — it may simply mean they are early, which is fine if they say so plainly.
How to read the answers
You are not looking for perfect answers. A small provider may honestly say they have few references, or that a particular certification is not held. That is workable.
What should concern you is vagueness where precision is possible — especially on data location, sub-processors and training. Those have exact answers. A provider who blurs them either does not know or would rather you did not.
