Six questions to ask any AI vendor before you sign
What to ask an AI vendor about working features, human review, data access and ongoing costs. Six questions you can ask without a technical background.
Coding agents can put together an AI application with a chat window, document upload and dashboard in days. We use them ourselves. A demo can show you whether an application would be useful, but it rarely shows how the software handles mistakes, protects your data or works when you stop paying the vendor.
These six questions help you check those details before signing a contract. You can ask them without a technical background. If an answer is vague, ask for a working example or documentation.
1. Can I see the code and its tests before I sign?
Ask to inspect the source code and its tests. If the vendor cannot share them with you directly, ask whether an independent reviewer can examine them under an NDA. Find out what can be reviewed and when, before committing to the purchase.
How we answer: the libraries our applications are built from are MIT-licensed, and their source is public with its tests from November 2026. Until then, the documentation of every package is on this site, so you can read what each one does before you have spoken to us.
2. Which of the features I just saw exist today?
Go through the features you need and ask which ones you can use now. If a feature has not been built, your purchase is funding its development. You bear some of the delivery risk. For anything planned or custom-built, agree on the scope, delivery date and acceptance criteria. Your contract should make clear what happens if the delivered feature does not work as demonstrated.
How we answer: our AI integration page has a section titled “What the kit does not do yet”, which lists the current gaps.
3. What happens when the model is wrong?
Models make mistakes. Can the AI change your records directly, or does it propose a change that a person accepts or rejects? If a person accepts it and it turns out to be wrong, can it be undone, and what does the undo leave behind?
How we answer: in our applications the model never writes to the database. It returns a proposal with the current values and the proposed changes, and a person decides. An applied change can be reversed, and the reversal is recorded as a new entry. The original entry is not erased.
4. Can the audit log be changed afterwards, and how would I find out?
Ask the vendor to explain how the log is protected. Someone with sufficient database permissions may be able to edit it. Would an edited or deleted entry be detected? Who would be notified?
How we answer: the ledger is hash-chained. Each entry carries the hash of the one before it, and the latest hash is stored on a schedule outside the database. Rewriting an entry breaks the chain. Rewriting the whole chain no longer matches the stored hash.
5. What does the model see, and where does it run?
Which data is sent to which model, and is there a rule that decides it, or is it up to whoever wrote each feature? Can confidential content stay with a model in your own environment?
How we answer: content is classified before every model call. Confidential content goes only to a model you run yourself, and an automated check fails as soon as any code can reach a model without going through the classification.
6. What does leaving cost me?
Ask what you keep if you stop paying: the application, the data, the workflows you configured. Ask in what format, and whether anything still runs without the vendor’s platform. What would you have to replace or rebuild to leave? Include that work when comparing costs, along with the notice period, export options and any fees for moving to another system.
How we answer: for an application we build for you, you pay a fixed price and, if you want, a monthly fee for maintenance. The code is in your repository and runs on your infrastructure. Ending maintenance does not stop the application from running.
What a good answer sounds like
Ask for something you can check alongside each answer: a test result, documentation or access to a working application. Record any limitations that matter to your project and make sure the proposal accounts for them.
You can try Approval in your own demo instance, which is deleted after 24 hours. No sign-up is needed. To discuss your project, write to us.