# How to Choose an AI Development Company: A 12 Point Checklist

URL: https://vrisic.com/blog/how-to-choose-an-ai-development-company/
Last updated: 2026-10-31

**Short answer:** Define one workflow and one success number first. Then score each vendor from 0 to 3 on twelve points, weighted by what a failure would cost you: how they test accuracy, who owns the code and data, how they price, where it runs, how they handle security, and whether they will say what AI cannot do. Reject any vendor that scores 0 on ownership, testing or data handling, and use a small paid pilot to see how they work before you commit to a full build.

In this guide

1. What to settle before you talk to any vendor
2. The kinds of AI development company
3. The 12 points at a glance
4. Points 1 to 4: scope, testing, team and pilot
5. Points 5 to 8: price, ownership, exit and support
6. Points 9 to 12: hosting, security, references and honesty
7. A weighted scoring sheet with a worked example
8. Compare quotes by three year cost, not the headline
9. Questions to ask on the first call
10. Red flags
11. Test the vendor with a paid pilot
12. How Vrisic can help
13. Sources

Most buyers pick an AI development company the way they pick a conference speaker: on a polished demo. The demo is the cheapest part of the project to fake and the least predictive of results. What decides whether you end up with working software is dull: how accuracy is tested on data like yours, who owns what, what happens when a model changes, and whether the vendor tells you early when an idea will not work.

This guide gives a checklist you can use with any vendor, including us. We are one of the companies you may be comparing, so treat our views as one input and check the claims against the sources at the end.

## What should you settle before you talk to any vendor?

Vendors can only be compared against a defined job. Spend an hour writing down five things, and you will already filter out the vendors who skip them.

1. **The workflow.** One process, described as input, decision and output. “Read supplier invoices and post them to the ERP” is a workflow. “Use AI in finance” is not.
2. **The baseline.** Items per month, minutes per item, error rate and cost per item today. Without it nobody can prove an improvement, including you.
3. **The success number.** One measurable target, for example “80% of requests handled without a person, with no more than 1 in 100 wrong”.
4. **The owner.** A named person in your business who will use the result and sign it off.
5. **The constraints.** Systems it must connect to, data that may not leave your network or country, deadlines, and a budget band.

If you cannot answer these yet, the right first purchase is not a build. Work through our AI readiness checklist, or buy a short scoping exercise. Good vendors will say so; weak ones will quote anyway.

## What kinds of AI development company are there?

The label “AI development company” covers very different organisations. Matching the type to your project matters more than comparing brand names.

| Type | Strengths | Typical risks (our view) | Fits when |
| --- | --- | --- | --- |
| Freelancer or very small studio | Low overhead, direct access to the builder, fast start | Single point of failure, thin testing and documentation, holiday and illness cover | A small, well defined task with an engineer on your side to review the work |
| Specialist boutique | Senior people on the work, narrow experience, flexible commercial terms | Limited capacity; fewer long running references; key person risk | One to three production workflows where you want direct contact with the builders |
| Large consultancy or systems integrator | Programme management, compliance depth, many specialists, global cover | Cost, junior staffing behind senior sales, slow start, change request pricing | Enterprise programmes with heavy governance, many stakeholders or regulated sectors |
| Product company with services | Working software on day one, vendor roadmap | You rent, you do not own; customisation limited to the product’s model; per seat or per volume fees | A standard use case that the product already covers |
| Platform or no code agency | Fast to launch, low cost for simple flows | Platform lock in; limits on logic, testing and integration depth | Simple, low risk flows that a platform covers; see agent builder vs custom development |

One more distinction cuts across all five: does the vendor *build* AI software, or *resell* a model with a thin wrapper? Gartner warns of “agent washing”, where vendors rebrand chatbots, assistants and robotic process automation as agentic AI without substantial agentic capability, and estimates that only about 130 of the thousands of agentic AI vendors are real ([Gartner, June 2025](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) ). Ask to see how a previous system handles errors, not just how it looks when it works.

For lists of named firms, see [best AI software development companies](https://vrisic.com/blog/best-ai-software-development-companies/) and our [comparison hub](https://vrisic.com/blog/compare-ai-development-companies/) . This guide is about the method, so it works for any of them.

Twelve things to check before you sign. Vrisic analysis

## What are the 12 points to check?

Each point below has a question to ask, a good answer and a bad answer. The next three sections explain the reasoning.

| # | Point | Ask | Good answer | Bad answer |
| --- | --- | --- | --- | --- |
| 1 | Scope | What is built, what is excluded, what do you assume of us? | A written scope with exclusions and assumptions | A price with no written scope |
| 2 | Testing | How will you measure accuracy, on what data, and who chooses it? | A test set built from your data, hidden cases, per field results | “Our models are very accurate” |
| 3 | Team | Who writes the code and who reviews it? Named roles, not firm size. | Named engineers, a lead who stays on the project | A bench to be assigned after signature |
| 4 | Pilot | Can we start with a small paid test with a pass mark? | Yes, fee credited against the build | All in, or nothing |
| 5 | Price | Fixed or capped? What is extra? How do changes work? | Fixed price per stage, change process written | Open time and materials with no cap |
| 6 | Ownership | Who owns code, prompts, test data and model accounts? | You do, in the contract | The vendor keeps the code or the model keys |
| 7 | Exit | Can another team take this over in a month? | Docs, runbook, tests, handover session | Knowledge lives in one person’s head |
| 8 | Support | What does it cost to run and fix after launch? | Priced options with response times | “We will be here for you” |
| 9 | Hosting | Whose cloud account does it run in? | Yours, with named regions | The vendor’s shared account, with your data inside |
| 10 | Security | Access, logs, retention, model provider terms, incident process? | Specific answers and a data processing agreement | A logo wall of badges, no specifics |
| 11 | References | Who can I speak to, or what can I see running? | A reference, a live system or a pilot on your data | Only slides and screenshots |
| 12 | Honesty | What would make this fail? What can AI not do here? | Specific risks and conditions | No risks mentioned |

## Points 1 to 4: how do scope, testing, team and pilot show whether a vendor can deliver?

### 1. Scope

A written scope states the process being automated, the systems touched, the inputs the system must handle and the ones it will not (for example “handwritten forms are out of scope”), the acceptance test, and what you must provide, such as sample data, API access and a reviewer’s time. The exclusions are the useful part. A vendor who has not thought about what is out of scope will meet it later as a change request.

### 2. Testing

This is the single best predictor of quality. Ask how the vendor will know the system works. A credible answer includes a test set drawn from your own data, with the right answers written by someone who owns the process; hidden cases the builders have not seen; accuracy reported per field or per category, not as a single average; and a separate count of confident wrong answers. For how large a test set must be before a number means anything, see our guide to pilots, proofs of concept and MVPs, which shows that 10 cases cannot distinguish 60% accuracy from 98%.

Be wary of accuracy figures quoted before the vendor has seen your data. Public benchmarks vary widely with the input: in one 2025 study the same model scored 96.5% on clean synthetic invoices and 92.7% on scanned invoices when given the page image, but only 63.9% on those scans when the page was converted to text first. Any vendor promising a number without seeing your documents is guessing, or selling.

### 3. Team

Ask who will write the code, how many projects they run in parallel, and whether the person on the sales call will be involved after signature. For a small project you want a named lead engineer and a reviewer. Check how they work with time zones and handovers: a remote team can work well if it overlaps with your hours and communicates in writing. See our guides on [outsourcing AI development](https://vrisic.com/blog/outsource-ai-development/) and [working with an India based team](https://vrisic.com/blog/ai-development-company-india-offshore-guide/) .

### 4. Pilot option

A vendor confident in its method will let you test it cheaply. A pilot is not a demo: it runs the real workflow on a slice of your data against a pass mark agreed before work starts. If the vendor refuses any staged approach and wants the full fee for a first version, you carry all the risk.

## Points 5 to 8: how should price, ownership, exit and support be written down?

### 5. Price structure

There are three common models, and each moves risk differently.

| Model | Who carries the risk | Works when | Watch for |
| --- | --- | --- | --- |
| Fixed price per stage | Vendor, for delivery within scope | Scope is clear after discovery or a pilot | A low quote followed by a stream of change requests; check the change rate card |
| Time and materials with a cap | Shared | Scope will evolve and you want flexibility | A cap set too high to bind; weekly reporting should be a condition |
| Open time and materials or retainer | You | Ongoing improvement work after launch | No definition of done; hours that rise while results do not |

Whatever the model, ask what is not included: model usage, hosting, third party API fees, licences, testing data preparation, training sessions, and travel. For realistic market numbers by project type, see [what AI development costs](https://vrisic.com/blog/ai-development-cost/) and [AI agent development cost](https://vrisic.com/blog/ai-agent-development-cost/) .

### 6. Ownership

Write four things down: you own the source code, you own the prompts and configuration, you own the test data and evaluation results, and the model provider accounts and keys are in your name. Check what the vendor retains, usually general tools and know how, and make sure no component of your system depends on a vendor licence you cannot take with you. A contract that is silent on ownership leaves you arguing later about who holds the thing you paid for.

### 7. Exit and handover

Imagine the vendor disappears the day after launch. Could another engineer take it over within a month? Require documentation of architecture and data flows, a runbook for deployment and common failures, an automated test suite including the accuracy test set, infrastructure as code or equivalent, and a handover session. These cost a few percent of the build and are the difference between an asset and a liability.

### 8. Support and running costs

AI systems need upkeep: models are updated or retired, input formats drift, and accuracy slips as the business changes. Ask for a written price for post launch support, response times by severity, and who watches accuracy. Also ask for the monthly running cost of model usage and hosting at your volume and at three times your volume. If the vendor cannot estimate it, the first invoice will surprise you.

## Points 9 to 12: what should you ask about hosting, security, references and honesty?

### 9. Hosting

The cleanest arrangement for most businesses is that the system runs in *your* cloud account, with your own model provider keys, so you control access, logs, region and bills, and can switch vendor without migrating data. A vendor hosted system can be fine for a standard product, but then you are in a supplier relationship about data too: ask for region, retention and deletion terms in writing.

### 10. Security and data handling

Ask specific questions, and be sceptical of badge walls. Useful ones are below.

- **Which model provider and which endpoint?** OpenAI states that data sent to its API is not used to train its models by default, and that abuse monitoring logs are retained for up to 30 days; zero data retention is available only to approved customers and not for every endpoint ([OpenAI](https://developers.openai.com/api/docs/guides/your-data) ). Other providers have their own terms. Ask which settings your build will use.
- **Who can see your data?** Named staff, role based access, and logs of access. Production data should not sit on developer laptops.
- **Is there a data processing agreement?** If personal data is involved, you will need one, and the vendor should list its sub processors.
- **What happens on an incident?** Notification time, contacts, and who investigates.
- **How are prompts and outputs logged and for how long?** Logs are essential for audit and debugging, and may themselves contain personal data.

On certifications, read them for what they are. SOC 2 is an attestation report issued by an independent CPA firm, not a certification; a Type 1 report covers whether controls were designed and in place at one date, while a Type 2 report tests them over a period, typically 3 to 12 months ([Linford & Co](https://linfordco.com/blog/what-is-soc-2/) ). ISO/IEC 42001, published in December 2023, is a standard for an AI management system, and certification is voluntary and done by independent certification bodies ([ISO](https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html) ). The NIST AI Risk Management Framework is a voluntary framework built around four functions, govern, map, measure and manage ([NIST](https://airc.nist.gov/airmf-resources/airmf/0-ai-rmf-1-0) ). A small company may reasonably have none of these and still handle your data well; what matters is that the controls exist and are shown to you. If a vendor claims a certification, ask for the report or certificate and its scope and date.

Regulation also affects choice. In the EU, the AI Omnibus, published in the Official Journal on 24 July 2026, moved the date for stand-alone high risk AI system obligations to 2 December 2027 and for high risk systems embedded in regulated products to 2 August 2028, with transparency obligations for certain AI systems under Article 50 applying from 2 August 2026 ([Future of Privacy Forum](https://fpf.org/blog/the-ai-act-implementation-timeline-what-changes-under-the-ai-omnibus/) ). If your system touches hiring, credit, education or other high risk areas, ask the vendor how it classifies your use case. This is not legal advice; take it to your lawyer.

### 11. References and proof

A reference call is the best evidence, but a young or specialist firm may have few public ones. Substitute proof that fits the situation: a live system you can use, a pilot on your own data, an engineer you can interview, or code samples and documentation of a comparable build. Be wary of case studies without numbers, and of named logos with no one to speak to. Anonymous references are acceptable if the vendor can show the system and the metrics behind them.

### 12. Honesty about limits

The most revealing question is “what would make this project fail?”. A good vendor names specific risks: your data may be too inconsistent, the volume may be too low to justify a build, a packaged tool might already do the job, or a human review step will always be needed for some cases. A vendor who answers “nothing” is telling you that you will find out later.

The best references did not win the score. Vrisic illustrative example; vendors and scores are invented

## How do you score vendors? A weighted sheet with a worked example

Score each point from 0 to 3: 0 means no answer or a bad one, 1 means vague, 2 means specific but unproven, 3 means specific and shown. Then weight the points by what a failure would cost *you* . The weights below are a starting point for a business with sensitive data; change them to suit.

| Point | Weight | Vendor A (polished agency) | Vendor B (specialist boutique) | Vendor C (freelancer) |
| --- | --- | --- | --- | --- |
| 1. Scope | 10 | 2 | 3 | 1 |
| 2. Testing | 12 | 1 | 3 | 1 |
| 3. Team | 8 | 1 | 3 | 3 |
| 4. Pilot option | 5 | 1 | 3 | 2 |
| 5. Price structure | 10 | 2 | 3 | 2 |
| 6. Ownership | 12 | 1 | 3 | 2 |
| 7. Exit and handover | 7 | 1 | 2 | 1 |
| 8. Support | 6 | 2 | 2 | 1 |
| 9. Hosting | 6 | 1 | 3 | 2 |
| 10. Security | 8 | 2 | 2 | 1 |
| 11. References | 8 | 3 | 1 | 2 |
| 12. Honesty | 8 | 1 | 3 | 2 |
| **Weighted score** | 100 | **50%** | **88%** | **55%** |

The arithmetic: multiply each score by its weight, add the results, and divide by 300, the maximum. Vendor A gets 150 out of 300, which is 50%. Vendor B gets 263, which is 88%. Vendor C gets 165, which is 55%. These vendors are invented for the example.

Notice what the weighting does. Vendor A has the best references, a full 24 of 24 possible points, and still comes last, because it is vague on testing, ownership and honesty. Ranking vendors by reputation alone would have picked it.

### Two rules on top of the score

1. **Hard gates.** A score of 0 on ownership, testing or data handling removes a vendor whatever the total.
2. **A tie breaker.** If two vendors are within about 10 points, pick the one who will run a paid pilot on your data. Evidence beats scoring.

The cheaper build costs $18,600 more. Vrisic illustrative example with assumed prices; not real quotes

## How do you compare quotes by three year cost, not the headline?

The cheapest build price often costs the most. This illustrative example uses assumed numbers, not real quotes, for the same workflow with 25 users.

| Cost line | Quote A: low build price | Quote B: higher build price |
| --- | --- | --- |
| Build, fixed price | $9,000 | $15,000 |
| Where it runs | Vendor platform, $900 a month including 25 seats | Your cloud account, about $250 a month for hosting and model usage at cost, no seat fees |
| 36 months of running cost | 36 x $900 = $32,400 | 36 x $250 = $9,000 |
| Changes: 20 hours a year over 3 years | 60 hours x $120 = $7,200 | 60 hours x $100 = $6,000 |
| Three year total | $48,600 | $30,000 |
| Who owns the code | Vendor | You |

Quote B costs $6,000 more up front and $650 less each month, so it breaks even after about 9 months and saves $18,600 over three years on these assumptions. If the workflow were small and short lived, Quote A could still be right. The point is to put *every* quote on the same three year basis, including support, seat fees, usage, hosting and the cost of leaving.

## What should you ask on the first call?

Twenty minutes of these questions tells you more than a two hour presentation.

1. What would you build first, and what would you leave out of the first version?
2. How will you measure accuracy, and who chooses the test cases?
3. What accuracy would make you tell us to stop?
4. Who exactly will write the code, and how many other projects will they be on?
5. What is the price, what is excluded, and what does a change cost per hour?
6. Who owns the code, prompts, test data and the model accounts?
7. Whose cloud will it run in, in which region?
8. Which model provider will you use, with what retention settings, and can we switch?
9. What does it cost to run per month at our volume and at three times it?
10. What happens when the model provider changes or retires a model?
11. How do you handle a wrong answer in production? Show us one.
12. Can we start with a small paid pilot with a pass mark?
13. Can another team maintain this? What do we receive at handover?
14. What are the three most likely reasons this project fails?
15. Would a packaged product do this for less? Which one?

The last question is a useful test of integrity. A vendor who can name a cheaper alternative, and explain when it falls short, is optimising for your result.

## What red flags should make you walk away?

- **A price with no written scope,** or a scope with no acceptance test.
- **Accuracy promises before seeing your data,** especially “99% accurate” or “zero hallucinations”.
- **A demo on the vendor’s data only,** or one that refuses to run a case you supply.
- **Per seat or per user fees that grow without a cap,** for software that you cannot take elsewhere.
- **Code, prompts or model keys held by the vendor,** or an unclear answer on who owns what.
- **Your data in the vendor’s accounts,** with no region, retention or deletion terms.
- **“Agent” claims that turn out to be a chatbot.** Ask what actions it takes in which systems, and what happens when it is wrong.
- **Pressure to sign this week,** or a discount that expires before you can test.
- **No mention of risks,** human review or monitoring.
- **Junior team behind senior sales,** with no named lead on the project.
- **Refusing a pilot,** on any terms.

One or two flags can be explained. Three or more, or any single flag on ownership or data, is reason enough to look elsewhere.

## How do you test a vendor before committing?

The best evidence of how a vendor works is working with them for a short, bounded task. A sound pilot has a written pass mark, uses a test set from your data, includes real users, ends with a decision date, and its fee is credited against the build if you proceed. You learn four things that no presentation shows: how they handle a missing field in your data, whether they report bad news early, how clear their written updates are, and whether the numbers survive your sceptical questions. If the pilot fails, you have spent a small amount and kept the test set and the findings.

Run the same pilot brief with two vendors if you can; the comparison is more informative than any score. Our guide to the AI development process and timeline shows what each stage after the pilot should produce.

## How Vrisic can help

Vrisic is a young company with a remote team in India working US, UK and UAE hours, so we do not offer a wall of logos. We offer a clear method you can check. Builds are fixed price after a free scoping call; they run in your own cloud account with your own model keys; you own the code, prompts and test data; and there are no per seat fees. Typical ranges are $8,000 to $25,000 for a single task agent over 3 to 6 weeks and $25,000 to $60,000 for an integrated agent over 6 to 10 weeks.

To test us the way this guide suggests, take the [AI Pilot](https://vrisic.com/ai-pilot/) : $1,500 (£1,200, AED 5,500), 10 business days, credited in full against a build started within 60 days. Read [how we work](https://vrisic.com/how-we-work/) first, then [book a free scoping call](https://vrisic.com/contact/) , and bring this checklist.

## Sources

1. [Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) (Gartner, 25 June 2025)
2. [Data controls in the OpenAI platform](https://developers.openai.com/api/docs/guides/your-data) (OpenAI)
3. [What is SOC 2?](https://linfordco.com/blog/what-is-soc-2/) (Linford & Co)
4. [ISO/IEC 42001 explained](https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html) (International Organization for Standardization)
5. [AI Risk Management Framework 1.0](https://airc.nist.gov/airmf-resources/airmf/0-ai-rmf-1-0) (NIST AI Resource Center)
6. [The AI Act implementation timeline: what changes under the AI Omnibus](https://fpf.org/blog/the-ai-act-implementation-timeline-what-changes-under-the-ai-omnibus/) (Future of Privacy Forum, July 2026)
7. [Multi-Modal Vision vs. Text-Based Parsing: Benchmarking LLM Strategies for Invoice Processing](https://arxiv.org/pdf/2509.04469) (Fraunhofer IAIS and Lamarr Institute, arXiv, 2025)

Regulatory dates and vendor terms were checked in October 2026 and change often. The scoring example and the three year cost comparison use invented vendors and assumed numbers. This guide is not legal advice; have a lawyer review any contract.

## Frequently asked questions

### How do I choose an AI development company?

Write down one workflow, its baseline and a success number, then score vendors from 0 to 3 on twelve points, weighted by the cost of failure: scope, testing, team, pilot option, price structure, ownership, exit, support, hosting, security, references and honesty. Disqualify any vendor scoring 0 on ownership, testing or data handling, and break ties by running a short paid pilot on your own data.

### What should an AI development contract include?

A written scope with exclusions and an acceptance test; fixed or capped pricing per stage with a change rate; ownership of code, prompts, test data and model accounts; hosting location and data retention terms; a data processing agreement if personal data is involved; support and response times; and a handover package with documentation, a runbook and automated tests. Ask a lawyer to review it.

### Is a cheap AI vendor a bad sign?

Not by itself, but compare quotes over three years, not on build price. In our illustrative example a $9,000 build on a vendor platform with $900 a month in fees totalled $48,600 over 36 months, against $30,000 for a $15,000 build running in the client’s own cloud. Low quotes become expensive when seat fees, hosting, change requests and lock in are added.

### Should I start with a pilot before hiring an AI development company?

Usually yes, if the task is not trivial. A paid pilot runs the real workflow on a slice of your data against a pass mark agreed in advance, and shows how the vendor communicates and handles bad news. At least 100 real test cases are needed before an accuracy figure means much. Pick a vendor whose pilot fee is credited against the build.

### Do I need a vendor with SOC 2 or ISO 42001 certification?

Not always. SOC 2 is an attestation by an independent CPA firm, and a Type 2 report covers controls over a period, typically 3 to 12 months. ISO/IEC 42001 certification is voluntary. A small vendor can handle data well without either, but then ask for specifics: access controls, logging, retention, sub processors and incident process. Large or regulated buyers may require them in procurement.

### How can I tell if a vendor’s AI agent is real?

Ask which actions it takes in which of your systems, what it does when it is unsure, how errors are caught and how many test cases it was measured on. Gartner estimates that only about 130 of thousands of agentic AI vendors are real, with many rebranding chatbots and automation. Request a demo on a case you supply, and ask to see a wrong answer being handled.

### Where should my AI system be hosted?

For most businesses, in your own cloud account with your own model provider keys, so you control access, region, logs and cost, and can change vendor without migrating data. A vendor hosted system can be acceptable for a standard product, but get region, retention, deletion and sub processor terms in writing, and confirm that your data is not used to train models.

---
Vrisic · https://vrisic.com/ · Contact: info@vrisic.com · Book a call: https://vrisic.com/contact/