Choosing an AI development partner is a decision a portfolio barely helps with, and a demo helps even less. Any team can spend two days building something that answers ten questions you picked yourself, impressively. What actually reveals the partner is six questions, each with an answer you can match against a published document instead of taking on trust. The most important one is the question a vendor rarely asks itself.
1. Does this task need AI at all?
Start here, because the answer may save you the whole project. Google's People + AI Guidebook says plainly that a rule-based or heuristic solution often does the job just as well or better, with a bonus attached: it is easier to build, easier to explain, and far less work to debug and keep running. The guidebook lists situations where AI is probably not the better choice, among them when the value of the experience lies in being predictable, when the information is static or limited, when the cost of an error outweighs a small gain in accuracy, and when your team needs to understand exactly what the code does.
Translate that into your own operation. A pharmacy routing an order to the nearest branch is a rule on a map, not a language model. A store answering 12 fixed questions about shipping and returns gets a cheaper, more accurate and faster answer from a menu of buttons. On the other side, pulling line items out of supplier invoices that arrive in a dozen formats, sorting thousands of customer messages by topic and tone, or searching internal policies written in ordinary human language are tasks where a model adds value that a written rule struggles to reach.
A partner who tells you that this one is a rule rather than a model earns your trust and loses a line item from the quote. That by itself is a criterion. And if you are still deciding between an off-the-shelf tool and something custom, that is a separate question: ChatGPT or a custom AI solution for your company?
2. Where does your data go, and who reads it?
In regulated sectors the question that settles the contract is not whether your data is safe, because every vendor answers yes to that. Ask instead: which interface exactly will the system call, under which pricing tier, and what does the provider's own page say about that specific tier. The difference between two answers here is the difference between a contract your legal team signs and one it sends back.
All three major providers publish their policies, and those pages are open to you as much as to anyone. Here is what they say about customer data, as reviewed on 22 September 2026:
| Provider | What the official document says |
|---|---|
| OpenAI | Data controls in the OpenAI platform states that, since 1 March 2023, nothing sent through the API feeds the training or improvement of OpenAI models unless the customer explicitly opts in. Abuse monitoring logs are retained for up to 30 days by default and may contain prompts and responses. Keeping that content out of those logs, through the Zero Data Retention control or Modified Abuse Monitoring, needs prior approval from OpenAI plus additional terms. |
| Anthropic | The Commercial Terms of Service bar Anthropic from training models on customer content, and state that the customer retains rights to its inputs and owns its outputs. The privacy page covering the consumer plans (Free, Pro, Max) is a separate document that points commercial and API customers elsewhere. |
| The Gemini API Additional Terms split the service in two. On the unpaid tier, which includes the free quota and Google AI Studio, Google uses what you submit and the responses to develop its products, human reviewers may read API input and output, and the text tells developers outright to keep anything sensitive, confidential or personal off that tier. On the paid tier, prompts and responses are not used to improve products, and are logged for a limited period to detect violations of the prohibited use policy. |
Notice what the three rows do together: the protection attaches to the API and to the account tier, not to the company's name. The same Google document specifies that access to the Gemini API counts as a paid service only when it runs through a Cloud project tied to an active billing account. So a vendor who built the demo on a free key, then told you your data is protected because Google does not use business data, said something true about a tier your system does not run on.
Ask for three things in writing: the provider and model name, the account or project the requests pass through and its tier, and a link to the page that states what applies. If the data is personal data belonging to customers in Egypt or Saudi Arabia, the question extends to where processing happens and to cross-border transfer, which we covered in customer data protection in Egypt and Saudi Arabia and how to choose a hosting company.
3. How is the bill calculated, and why will nobody give you a fixed monthly figure?
Because token pricing makes cost a function of usage. Every message that goes in and every reply that comes out is metered, so the bill rises with each new customer and each longer conversation. Anyone who hands you a flat monthly number without naming the assumptions behind it either did not calculate them or is hiding where the number climbs.
A reassuring answer comes as an open formula: expected conversations per month, average question and answer length in tokens, which model handles which kind of task, the share of requests retried after a failure, and what happens to the figure if your customer count doubles. Ask for a spending cap and an alert when it is crossed as well, because that is a settings item, not a statement of intent.
Ask about the shape of the prompt too. OpenAI's prompt caching documentation explains that tokens reused from the start of a stable prompt are billed at a reduced cached-input rate, discounted by as much as 90%. A system designed so every request opens with the same prefix pays a fraction of what a system that reassembles the prompt each time pays for that portion. It is a purely engineering difference, and it shows up on your invoice month after month.
Actual token and WhatsApp message figures, dated and sourced, are laid out in how much an AI chatbot costs; take them into the meeting and hold the vendor's estimate against them.
4. How do you measure answer quality, and what happens when the model is wrong?
This is where the gap shows most clearly. The OWASP GenAI Security Project lists misinformation among the 2025 risks for LLM applications and describes hallucination as a primary cause of it: content that looks accurate but is fabricated, produced when the model fills gaps in its knowledge with statistical patterns. It adds a multiplier, overreliance, which is what happens when staff pass model output straight into decisions or processes without review.
A partner who answers that they use RAG so it does not hallucinate is describing a technique, not a measurement. The reassuring answer describes a method of verification: a held-out test set of real questions taken from your customers' own messages, a correct answer for each one written by somebody who knows the business, and a required pass rate before launch. Anthropic's documentation on success criteria and evaluations rests on the same principle: a specific, measurable criterion on a held-out set, not a general description of the order of good performance.
Four questions expose how serious the answer is, in two minutes:
- How many cases are in the test set, and who wrote the correct answers?
- What pass rate do you consider sufficient for launch, and who signs off on it?
- What does the system do when it finds no answer in the sources: apologise and hand over to a person, or guess?
- How do I see for myself, a month into operation, the questions it got wrong?
Snaabble provides a tailored technical assessment to define the right stack & exact budget.
That last one matters most in practice, because pre-launch evaluation measures what you anticipated, while operation reveals what nobody thought of.
5. What if the model is retired or its price changes?
Model retirement is a routine, announced procedure, not a distant possibility. The official pages set out the rules clearly:
- OpenAI's deprecations page sets minimum notice periods: 6 months for generally available models, 3 months for specialised variants of them, while a preview model may be retired on notice as short as two weeks. The same page also warns against putting a preview model behind anything business-critical unless your team can move on very short notice.
- Anthropic's model deprecations page commits to at least 60 days' notice before retiring a publicly released model, and notes that requests to a model past its retirement date will fail.
- Google's Gemini deprecations page publishes a table of shutdown dates, after which the endpoint is no longer available. The models page recommends that production applications use a specific stable model, and notes that preview models are discontinued on at least two weeks' notice.
Which means your system will need a migration within two or three years, whichever provider you pick. The question that measures a partner's readiness: how many days does swapping the model take in this system? An answer of about a week means there is a layer separating business logic from the model name, prompts kept in files rather than buried in code, and a test set you rerun on the new model so you learn what changed before your customer does. An answer of we would review the code and estimate means the model name is written in dozens of places.
Ask about quotas and rate limits as well, and about a fallback model actually tried on the same test set. Building production on a preview model is a decision you may take knowingly; it should not be one you discover a year after signing.
6. What do you actually own the day the engagement ends?
Ownership in AI projects comes in three layers, and it is easy to agree on one and leave the other two open.
Deliverables. Source code is the familiar part, but prompts, knowledge base files, embeddings and the test set are deliverables too. A prompt tuned over forty attempts is the substance of the product, not a marginal text file. Name it in the contract.
The provider account. Where the API key sits in the vendor's name and the billing runs on its account, you are a tenant rather than an owner, and on the day of a dispute service stops before anyone gets to the code discussion. The safer arrangement is an account in your company's name, with the team working under permissions on it.
Outputs. Anthropic's commercial terms say that the customer retains its inputs and owns its outputs, and that is a right arising between the account holder and the provider. If the account is not yours, the clause does not protect you.
One question covers all three layers: if this engagement ended next week, what could I download myself and run on my own account without your help? Ask for the answer in the contract, and apply the same logic to any software company you sign with, because none of it is specific to AI.
One page to take into the meeting
| Question | A reassuring answer | An answer worth pausing on |
|---|---|---|
| Do we need a model here? | This part is a simple rule, the model handles the other part | AI improves everything |
| Where does the data go? | Provider and tier named, with a link to the page that says so | Your data is safe with us, unelaborated |
| How is cost calculated? | A formula with its assumptions, a spending cap and an alert | A flat monthly number with no assumptions |
| How do you measure quality? | A held-out test set and an agreed pass rate | We use RAG so it does not hallucinate |
| What if the model is retired? | A stated swap time and a tested fallback | We will deal with it then |
| What do I own afterwards? | Code, prompts, knowledge base and test set, and an account in your name | The code is yours, and nothing further |
Apply the same questions to us
These criteria are written to be used against any vendor, and Snaabble is one of them. Ask us for what you would ask anyone else: the provider and tier in writing, the cost formula with its assumptions, the test set before launch, the model swap time, and the list of deliverables in the contract. And if the conversation ends with your problem being solved by a simple rule or an ordinary search, that is a correct answer too.
If you have a task you are thinking of automating, write the description to us from the AI and automation page, and within 24 hours you get back an outline of the scope and an estimate of duration and cost, at no charge and with nothing to sign.
Frequently Asked Questions
How do I tell a software company apart from a marketing agency selling «AI solutions»?
Do not ask about experience; ask for four concrete things: the provider and account tier in writing, the cost formula with its assumptions, a test set with correct answers and an agreed pass rate, and the number of days a model swap takes. Anyone selling an interface on top of an off-the-shelf tool stumbles on the last two in particular, because both require code they own and can change.
Does self-hosting an open-source model on our own servers make these questions unnecessary?
It settles the question of data leaving for a third party and leaves the rest exactly where it was. Model swapping, quality measurement, ownership of prompts and the test set are live questions either way, and self-hosting adds operations, monitoring and security updates that become your responsibility. Choosing between the two routes is a separate discussion in our piece on ready-made versus custom solutions.
What do I do if the vendor treats the prompts as its own intellectual property?
Separate a generic template it reuses with every client from a prompt tuned to your data, your policies and the way your customers speak. The second is part of your product; name it in the contract along with the knowledge base files and the test set. A flat refusal to hand it over means rebuilding the product from scratch at the first dispute, and that is a point to negotiate before signing rather than after.
Sources
Every page below was reviewed on 22 September 2026.
- OpenAI: Data controls in the OpenAI platform, Deprecations, and Prompt caching.
- Anthropic: Commercial Terms of Service, Model deprecations, and Define success criteria and build evaluations.
- Google: Gemini API Additional Terms of Service, Gemini deprecations, Models, and User Needs + Defining Success from the People + AI Guidebook.
- OWASP GenAI Security Project: LLM09:2025 Misinformation.
