Someone on your team found an AI tool. It demos beautifully, it costs less than a phone line, and they want to start using it on Monday. You are the person who has to say yes or no, and you do not have a CTO to ask.
The usual software questions do not quite cover this. When you bought your accounting package, the question was whether it did the job. With an AI tool the more important question is what it does with everything you feed it, because using one of these means handing over your actual business information: customer lists, contracts, pricing, patient or client details, whatever the task happens to involve.
Here is the short list I would work through before approving one.
1. Does It Train on Our Data?
This is the first question because it is the one with the least reversible consequences. If a tool uses what you submit to improve its underlying model, your information has left in a way you cannot call back.
Ask three things specifically: is training on customer data on or off by default, can it be turned off, and does turning it off require a paid tier. The answers vary widely, and the default is frequently not the one you would choose. Get the answer in writing from the vendor rather than from the person who wants the tool.
2. Where Does It Go, and Who Can Look at It?
Your data is going to sit on someone else’s computers. Reasonable questions about that:
- What is retained, and for how long? Many tools keep conversation history indefinitely by default.
- Can staff at the vendor read it? Most have some human review process for safety or debugging. That is not sinister, but you should know it exists.
- Who else is involved? Plenty of AI products are a wrapper around someone else’s model, which means a second company is also handling your data. Ask who the subprocessors are.
- What region is it stored in? This matters if you have clients with contractual requirements about data location.
3. What Happens When We Stop Paying?
Ask before signing, not at renewal. Can you export what you have built, including prompts, configurations, and history? Is your data deleted on request, and how long does that take? Does anything survive cancellation?
Tools that make this awkward to answer are telling you something. A vendor confident in their product will explain their exit process without getting defensive about it.
4. Does This Touch Anything Regulated?
This question decides whether the rest of the conversation is routine or serious. If the tool will handle payment card details, health information, financial records, or information about minors, you have obligations that exist whether or not anyone has audited you on them.
The practical version: if the answer is yes, you need paperwork from the vendor, not assurances. Vendors who work with regulated data know exactly what you are asking for and will produce it. Vendors who respond with a general statement about taking security seriously are not set up for it, and that is your answer.
5. Who Is Accountable When It Is Wrong?
AI tools produce confident, well-formatted output that is sometimes simply incorrect. That is a known property, not a defect that will be patched next quarter.
So decide in advance where a human checks the work. The rule I would apply: the more directly the output reaches a customer or a decision, the more review it needs. Drafting an internal summary needs little. Sending a quote, making a commitment, or answering a compliance question needs a person who is accountable for the answer.
Also worth asking: does the tool take actions on its own, or only produce text a person then uses? Those are meaningfully different risks, and vendors do not always distinguish them clearly in a demo.
6. What Does It Replace, and How Will We Know It Worked?
Not a technical question, but it is the one that saves the most money. Ask what specific task this removes and how many hours a week that task actually consumes. Then agree how you will judge it in ninety days.
A surprising number of AI purchases add a subscription without removing any work, because the tool was bought for a capability rather than a problem. If nobody can name the task, that is a reason to wait.
The Free Tier Is Not Free
The most common way small businesses end up exposed is not a bad purchase. It is a good employee using a free consumer tool to get their job done faster, with real company information.
Free tiers generally carry the least favorable data terms of anything a vendor offers, which is reasonable, since you are not the customer in that arrangement. The fix is not a ban, because bans mostly produce quieter usage. The fix is approving something adequate, telling people which tool to use, and being specific about what should never be pasted into any of them.
An Approval Process That Fits a Small Business
- One named approver. Probably you. Nothing with company data starts without a yes.
- A short written record per tool: what it does, what data it touches, training on or off, who the vendor is.
- A do-not-paste list everyone has read: card numbers, health information, credentials, unreleased pricing, anything covered by a client agreement.
- A ninety day check against whatever you said success would look like.
- An annual look at what is still in use, because subscriptions outlive the person who requested them.
That is a page of documentation, not a governance program. For a business under fifty people it is enough, and it is dramatically better than nothing.
How I Fit In
I am a consultant and a partner with OTG Consulting, which is a consultancy that presents the services of other providers. I do not build AI tools and I do not resell one particular platform, which means I have no reason to push you toward any specific answer.
Where I am useful is the evaluation itself: working through these questions against your actual situation, translating vendor answers into what they mean for your business, and telling you when the honest recommendation is to wait. If a tool does make sense, I can connect you with the provider whose offering fits, and that provider delivers and supports it.
Quite often the recommendation is smaller than expected. A properly configured business tier and a one-page policy solves more of this than a large project does.
Before You Approve the Next One
If a tool is already in use across your business and nobody has asked these questions about it, that is the place to start, and it costs nothing to find out where you stand.
Schedule a free consultation and we will go through what your team is actually using, what it touches, and what is worth tightening up.