How to choose a software company for an AI project: 12 criteria and the red flags

To choose a software company for an AI project, look at three things before the price: how it works before you sign, how it protects data and systems, and what stays with you at the end. A reliable partner shows you a prototype, measures the system’s answers with test cases, tells you where the data goes and puts code and access in your name. The twelve criteria below let you check this in one or two meetings.

The 12 criteria

Method

1. It starts from the process, not the technology. The first questions are about who does what, with which data and where time is lost. A company that proposes a tool before understanding the work is selling the tool.
2. It shows a working prototype early. A few weeks, on your real cases, tried by the people who will use it. It is the fastest way to find out whether the idea holds.
3. It defines a measurable result. Time saved, cases closed without intervention, errors avoided: a number agreed beforehand and measured afterwards.

AI competence

4. It can say when AI is not needed. Many problems are solved with an integration or a rule. A serious partner says so, even if the project gets smaller.
5. It evaluates answers with test cases. A set of examples with expected answers, re-run at every change. Without it, nobody knows whether an update made the system better or worse.
6. It plans for human oversight and limits on actions. What the system can do on its own, what needs confirmation, what it can never do. We cover this in the guide to AI agents for business.

Security and data

7. It knows the risks specific to AI. Prompt injection, information leaks, excessive agency: the risks OWASP lists for applications built on language models. Ask how it tests for them. You can get a first picture with our AI security check-up.
8. It knows where the data goes. Which model, which provider, in which region, how long it is kept and whether it is used for training. The answer must be in writing. More in the guide on generative AI and data protection.
9. It knows the legal duties that concern you. The processor agreement required by the GDPR and your company’s role under the EU AI Act. It does not replace your legal adviser, but it must know the subject.

Contract and costs

10. Everything is in your name. Source code, documentation, environments, accounts for services and AI models. If the relationship ends, another supplier must be able to take over.
11. It separates costs. One-off, recurring and usage-based, with the volumes they are estimated on. The guide on what AI automation costs explains each item.
12. It says what happens after release. Who monitors the system, how quickly they step in, how model updates are handled.

Answers that reassure, answers that should worry you

Question	Reassuring	Should worry you
How do we know it works?	“We define a set of test cases and a threshold before we start”	“You will see when you use it”
Where does our data end up?	A written list of providers, regions and retention periods	“It is safe, it is all in the cloud”
What can the system do on its own?	A list of allowed actions, with confirmation for irreversible ones	“It does everything”
How much does it cost each month?	An estimate by volume, with a spending cap	Only the development price
What if we change supplier?	Code, access and documentation are already yours	“We will talk about it when it happens”

The red flags

• It promises to automate everything. Systems that work leave checks and special cases to people.
• It asks no questions about data. A company that does not ask which data it will process has not thought about protecting it.
• It only shows perfect demos. Ask to see a difficult case, or an error and how it is handled.
• It keeps the accounts. If services are in the supplier’s name and you have no access, you are tied to it.
• It never mentions security. In a system that reads documents and takes actions, security is part of the project from the start.
• It does not talk about maintenance. An AI system needs looking after: models change, and so does the data.

What a good proposal must contain

1. The goal in one sentence and the number used to measure it.
2. The phases, with what is delivered at the end of each.
3. The timing of each phase and what is needed from you.
4. The costs, split into one-off, recurring and usage-based.
5. What is excluded.
6. The security measures and the checks planned before release.
7. Who owns code, access and accounts.
8. How maintenance works after release.

How we work

At Softboom, after a first call we send a written proposal with phases, timing and costs. We have been building custom software since 2013, we build AI systems and we test the security of what we deliver. You can read some case studies, anonymous by sector, or tell us about your project.