With today's AI tools, anyone can build an impressive demo in a weekend. It reads an email, writes a reply and puts the data in a spreadsheet. In a meeting, it looks finished.
Six months later, the model changes, the email provider changes its login or the person who built it leaves. The demo stops working, often quietly. We call this "vibe-coded" AI: built fast and by feel, without a process, tests or an owner.
The web had the same phase. Many companies bought cheap WordPress sites built from themes and plugins. They started fast. A few years later, nobody dared to update anything, because every update broke something.
This article gives you a checklist. Use it with any supplier, including us. Good answers do not need to be long. They need to be specific.
Questions about the process
1. Which process does this automate, and who mapped it?
A good supplier can show you the process on one page: input, steps, decisions and output. If the answer is "the AI handles your inbox", ask for the map. Without it, nobody knows what "done" means. Read Process first, then AI to see why this matters.
2. How will we measure the result?
Ask what the supplier will measure before and after: hours spent, time to reply, number of errors. If there is no "before" number, there will be no proof later.
Questions about control
3. What does a person approve, and what can AI do alone?
You want a clear list. For example, the AI may sort emails and draft replies. A person approves quotes, payments and deletions. If the answer is "the AI is smart enough to decide", that is a warning sign.
4. What access does the AI get?
The safe default is least privilege. This means the AI gets only the access the workflow needs. Read-only access comes first. Write access comes later, only for specific actions and only with approval. Ask the supplier to list every system and every permission. Our article MCP for business owners explains how this works in practice.
5. How do we see what the AI did?
Every AI step should be logged: what it read, what it decided, what it wrote and who approved it. When a customer complains, you need to find the cause in minutes, not days.
Questions about data
6. Where does our data go?
Ask for a list of services that touch your data and where they run. Ask where the application and the database are hosted. We host applications and databases in the EU.
Be careful with a promise that data "never leaves the EU". A request to an AI model can be processed outside the EU. An honest supplier tells you that.
7. Can the model provider train on our data?
The business terms of the model providers we use forbid training on customer data. Consumer chat apps can have different rules. Ask which account and which terms the workflow uses.
8. What does the supplier document for GDPR and the EU AI Act?
No supplier can promise that a workflow makes you compliant. A good supplier documents what personal data the workflow uses, where it is stored and where a person decides. That document helps you and your advisor with the rest.
Questions about ownership
9. Who owns the code, the data and the accounts?
The answer should be: you. The code is in your repository. The cloud accounts and the AI accounts are in your company's name. If the supplier owns the accounts, you do not own the system. You rent it.
10. What happens if we stop working together?
Ask how you would move to another supplier. Is the code documented? Can another developer read it? Can you export the data? A good supplier makes it easy to leave. Then it must earn your trust to stay.
Questions about the future
11. What happens when the model or an API changes?
Models change several times a year. Software vendors change their APIs, the interfaces that let programs exchange data. Ask how the supplier will know that something broke.
The best answer includes test cases that run after every change. It also includes monitoring that sends an alert when results look wrong. We explain this in Models change every few months.
12. What does it cost to run each month?
There are two costs: model usage and maintenance. Ask for an estimate of both. Ask who pays when model usage grows. Ask what maintenance includes. A system with no maintenance plan is a demo with a delay.
Warning signs
Be careful when you hear one of these sentences:
- "It is 100% automatic. Nobody needs to check anything."
- "We use our own account. You do not need to worry about access."
- "Tests are not necessary. The AI is very accurate."
- "We write the prompt once, and it works forever."
- "We can start to build tomorrow. We do not need to see your process."
None of these is always a lie. But each one tells you that the supplier sells a demo.
Why demos are tempting
Demos are not bad. A demo shows what is possible, and that is useful. The problem starts when a company uses a demo as if it were a system.
A demo is cheap because it skips the hard parts. It has no process map, no approval rules, no tests, no logs and no plan for the next model version. Those parts are boring in a meeting. They are also the parts that keep the workflow alive after the first month.
When you compare offers, compare these hidden parts. A higher price with tests, logs and maintenance can be cheaper over two years than a low price without them.
What a good answer looks like
A good supplier answers most of these questions before you ask them. You get a process map, a list of approvals, a list of permissions, a data map and a maintenance plan. The price is fixed for a defined scope.
That is how we work. Our first step is always a process audit, because most of the answers above come from the process, not from the AI.
Start with the process audit
If you compare AI automation offers, start with a process audit. In one week, we map one process, write the rules and approval points and choose what to automate first. You get 3–5 automation opportunities with time saved, risk and price. You also get a fixed-price offer for the first workflow. The audit costs €1,490 + VAT. The result is yours, and any supplier can use the plan.