How to choose an AI provider: the questions to ask before you sign

What does a serious proposal always contain?

Four things. Their absence is information in itself.

Your problem, restated. Before any technology, the proposal repeats back what you described — in its own words, with your volumes, your constraints, your trade vocabulary. If you do not recognise yourself in the first three paragraphs, the rest is not about you.

A scope. What is included, what is not, and what stays on your side: data preparation, access rights, your teams’ availability.

Acceptance criteria. A list of cases you can run yourself, with the expected result for each. Written before, not after.

What happens if the result is not there. Fixing, another iteration, stopping, handing back the work: it is an awkward question, and it is asked before signature. Afterwards, it is no longer asked at all.

How do you spot a demo seller?

A demo is prepared on hand-picked cases. Ask for the same thing on your real data: the half-filled records, the edge cases, the exceptions your teams know by heart. How that request is received tells you more than the demo itself.

Four signals deserve a pause.

A quantified guarantee of results. Nobody can promise a measured gain before seeing your data.

A refusal to name the limits. Every system has some. Anyone who names none has not looked for them, or will not tell you.

“We just plug the AI into your data”, with no mention of access rights. Who gets to see what? That is settled at design time, never afterwards.

A fixed price with no acceptance criteria. You are paying for a deliverable nobody has defined as successful.

Who owns the code once the invoice is paid?

Not you, unless it is written down. This is what business owners discover last.

Source code is protected by copyright, and nothing passes to you without a written contract: under France’s Intellectual Property Code, contracts transferring copyright must be in writing (article L131-2). A careful contract then follows article L131-3: each right transferred listed separately, the scope of exploitation defined as to its extent, its purpose, its territory and its duration. Paying the invoice transfers nothing.

Automatic transfer does exist — but only for software created by an employee in the course of their duties, where the economic rights vest in the employer unless agreed otherwise (article L113-9). An outside supplier is not an employee: the rule does not apply.

Two acceptable outcomes: an assignment, or a licence whose scope you have read. What is not acceptable: silence.

And your data, your prompts, the tuned model?

Three separate things, three separate clauses.

Your data does not become theirs — but nothing says so on your behalf. Write down what the provider may do with it, and above all what it may not do: reuse it for other clients, pass it to a model vendor, keep it after the contract ends. If it processes personal data on your behalf, it acts as a processor under the GDPR: a written contract is mandatory, and it falls to you to check its safeguards before handing anything over.

Prompts, settings and documentation are deliverables. Ask for them by name: they rarely leave on their own.

A model tuned on your data raises three questions. Who owns it? What becomes of it if you leave? Can it be used elsewhere? Settle that upfront, not on the way out.

What could you take back in-house?

Ask it the other way round: if you stopped tomorrow, what would be left with you?

What usually comes back: the code, if it was assigned to you and is documented; the data, exported in an open, readable format; the configuration, if it is written down somewhere.

What stays captive more often than people expect: the hosting, when everything runs on the provider’s account; the API keys for AI services, taken out in its name and billed to it; proprietary formats, whose export produces a file nobody else can read; and the knowledge, when none of it was ever passed to anyone on your side.

An exit clause takes a few lines to negotiate at signature and is worth a great deal two years later: export format, notice period, handover support, fate of the access rights and backups.

Who carries the AI Act obligations, them or you?

Both, but not on the same points. The EU AI Act separates the provider, who places the system on the market under its own name, from the deployer, who uses it under its own authority — you, in most cases. You become a provider if you put your name or trademark on a high-risk system already on the market, if you substantially modify it, or if you change the intended purpose of a system that was not high-risk to the point that it becomes one (Article 25).

Since 2 August 2026, the transparency obligations apply and the authorities exercise their supervisory powers. The high-risk obligations under Annex III are postponed to 2 December 2027 by Regulation (EU) 2026/1744.

In the contract this comes down to simple questions: who supplies the documentation, who answers an authority, who updates things if the text moves. A contract allocates the roles and organises your recourse; it does not put you out of reach of the authority that comes asking.

When do you not need a provider at all?

Three common situations where the right decision is to sign with nobody.

An off-the-shelf tool already does the job. Many needs — summarising, drafting, translating, finding a document — are covered by an off-the-shelf subscription and a little configuration. Bespoke work is only justified where your specificity creates the value.

The problem is not written down. Until you can say who does what today, how often, and where exactly it jams, nobody can solve it for you. A provider will make assumptions on your behalf, and you will pay for them.

The issue is organisational. Information that circulates badly, a decision nobody takes, a process two departments apply differently: AI will only make the disorder faster. Sort the organisation first, the technical question second.