The demo is not the product
Every AI vendor demo looks brilliant, because demos are rehearsed on the vendor's best cases with the vendor's own data. What you are actually buying is different: a service whose underlying models will change, whose pricing may not survive contact with the market, and whose handling of your data will matter long after the demo is forgotten. The AI market in 2026 is consolidating fast; products get acquired, repriced and retired. The contract, not the demo, is what protects you.
The twelve questions below fit on one page. Send them before the second meeting and ask for written answers. The speed and clarity of the response is itself a useful signal.
Data: questions 1 to 4
- 1. Is our data used to train your models, or anyone else's? The only acceptable answer for business data is no by default, written into the contract, not buried in a settings toggle
- 2. Where is our data hosted and processed? UK or EU hosting keeps things simple under UK GDPR; transfers to the US or elsewhere need proper safeguards such as the UK's International Data Transfer Agreement or addendum
- 3. Who are your sub-processors, and which foundation models sit underneath? Many AI products are thin layers over OpenAI, Anthropic or Google models, and you are entitled to know whose infrastructure actually touches your data
- 4. How long is our data retained, and how do we get it deleted? Look for defined retention periods, deletion on request and written confirmation when it happens
Need a hand with this?
Our team delivers AI & Machine Learning for UK businesses — with a free initial consultation, transparent fixed quotes and no lock-in contracts. Tell us what you're working on →
Reliability and change: questions 5 to 8
- 5. What uptime do you commit to, and what happens when you miss it? An SLA with service credits beats a marketing page claiming 99.9%
- 6. What notice do we get before you change or swap the underlying model? Model changes can quietly alter the output quality and behaviour your workflows depend on; ask for advance notice and a testing window
- 7. What are the real usage limits? "Unlimited" plans carry fair-use clauses; get the actual numbers in writing
- 8. What happens if your upstream model provider raises prices or changes terms? A vendor with no answer has no plan, and their problem becomes your renewal surprise
Money and exit: questions 9 and 10
- 9. What exactly drives the price: seats, usage, or both, and what caps apply at renewal? Usage-based AI pricing can balloon, so ask for a worked example at three times your expected volume and negotiate a cap on renewal increases
- 10. How do we leave? You want your data exported in a usable format (CSV or JSON, not a proprietary blob), a defined transition period, and no termination fee buried in a schedule. If the product accumulates valuable assets, such as a trained chatbot or a tagged dataset, ask specifically whether those leave with you
Exit terms are easiest to negotiate before you sign and nearly impossible afterwards, which is exactly why vendors rarely raise them first.
Accountability: questions 11 and 12
- 11. Will you sign a UK GDPR-compliant data processing agreement, and what certifications do you hold? ISO 27001 and SOC 2 are the common ones worth seeing evidence for, and Cyber Essentials is a reasonable minimum for smaller UK vendors
- 12. Who is liable when the AI gets it wrong? Read the indemnity and liability clauses: does the vendor stand behind output that infringes copyright or breaches confidentiality, or is everything AI-related carved out? Some larger providers now offer copyright indemnities, so a blanket exclusion of all output liability is worth challenging
Red-flag answers to walk away from
- "We can't disclose which models we use." You cannot assess data flows you are not allowed to see
- "Data may be used to improve our services" with no opt-out: that is training permission dressed in soft language
- No data processing agreement, or a promise to "look into it": for a product handling personal data, this is disqualifying
- Uptime described as "best efforts" with no service credits
- Silence on exit, or data export "available on request" with no format or timescale
- Pressure to sign a multi-year term at a discount before the written answers arrive
Key Takeaway
Get written answers to twelve questions before signing: no training on your data by default, UK or EU hosting, named sub-processors, defined retention and deletion, an uptime SLA with credits, notice before model changes, real usage limits, upstream price protection, a renewal cap, a clean exit with usable data exports, a signed DPA with certifications, and clear liability for bad output. Any vendor who dodges the data or exit questions is answering them anyway.
Score it like any supplier decision
Put the twelve answers into a simple traffic-light grid, weight the data and exit questions highest, and pilot with one team and non-sensitive data before rolling anything out company-wide. A vendor that answers plainly, in writing, without wriggling is telling you something as valuable as the answers themselves.
If you would like a second pair of eyes on a shortlist or a contract, our team helps UK businesses evaluate and integrate AI tools.