How to choose an AI consulting firm: the 12 questions to ask before you sign

The AI consulting market has the feel of a gold rush: demand is exploding, supply is following, and the shopfronts all look alike once you get past the website veneer. How do you tell the firm that will deliver from the one that will learn its trade at your expense? Not by comparing the logos in their decks: by asking precise questions and insisting on written answers. Here are twelve, grouped into four blocks: sovereignty and hosting, method and milestones, Law 25 compliance, contract and reversibility.

Let us be straight: Cogio is an AI consulting firm, and these twelve questions apply to us as much as to anyone. We are literally inviting you to put them to us. A serious firm answers in writing, without taking offence; a firm that bristles at them has just answered in its own way.

Question 1: where does our data physically sit, and does the model run on our premises or at a third party’s? The answer that reassures names a place: your building, an identified Quebec or Canadian data centre, a specific hosting contract. The red flag: “in the cloud, it is secure.” The cloud is a computer somewhere, and that somewhere determines which laws apply, starting with the US CLOUD Act.

Question 2: will our data be used to train or improve anything at all? The answer that reassures is a contractual no: your documents are used to answer your questions, nothing else, and it is written down. The red flag: a vendor who has to check their own subcontractor’s terms before answering. If they do not control their chain, neither do you.

Question 3: who, at your firm and at your subcontractors, can reach our data? The answer that reassures describes specific roles, logged access and a short list, ideally backed by practices verified by a third party. The red flag: no access log, or a subcontracting chain nobody can describe in full.

Question 4: what is the first usable deliverable, and how soon? The answer that reassures describes a bounded pilot: a scope, named users, a date, a deliverable your people can actually try. The red flag: a full rollout sold as one block, with no intermediate stage where you can judge on the evidence.

Question 5: on what criteria will we jointly judge that it works? The answer that reassures sets acceptance criteria before starting, to be measured at your site: the share of answers judged usable, time saved on a specific task, real adoption by the teams. Our guide to measuring the return on an AI assistant shows what good indicators look like. The red flag: quantified gains promised before anyone has seen your data.

Question 6: what happens if the pilot does not deliver? The answer that reassures accepts that it might and plans for it: adjust the scope, change approach or stop cleanly, with the lessons documented. The red flag fits in one sentence: “it cannot fail.” Methodological honesty starts by admitting the opposite.

Question 7: who runs the privacy impact assessment, and when? The answer that reassures puts the assessment before deployment, with a named owner on your side and documented support from the vendor. The red flag: it is presented as an optional formality, or worse, they do not recognize the term.

Question 8: how do you find and handle personal information in our documents? The answer that reassures describes a procedure: identification, redaction or exclusion before indexing, and written rules for what follows. The red flag: “the model is secure, it is not a problem.” System security and lawful processing are two different questions.

Question 9: what is your plan for a confidentiality incident? The answer that reassures exists on paper: a notification procedure, timelines, an incident register, roles on both sides, as Law 25 requires. The red flag: improvisation, or a stated conviction that an incident is impossible.

Question 10: who will own the code, the prompts, the configurations and the documentation you deliver? The answer that reassures: you, unambiguously, with sources handed over at each milestone. The red flag: intellectual property that stays with the vendor, alongside a licence to renew, which is rent in disguise.

Question 11: if we terminate the contract, how do we get everything back, and how fast? The answer that reassures describes an orderly exit: data in standard formats, indexes that can be rebuilt, up-to-date documentation, no exit penalty. The red flag: exit fees, proprietary formats, or a carefully maintained vagueness about what “everything” means.

Question 12: what is included in the price, what recurs, and what depends on a third party? The answer that reassures breaks it out: design, any licences, hosting, upkeep, and what will move if a third-party supplier changes its rates. The red flag: a lump sum with no breakdown, where the recurring costs appear after signature.

Keep this table to hand at the next meeting. Twelve questions, twelve flags: a serious vendor clears them all, ourselves included.

Before your next meeting with a firm, pick the four questions that touch your biggest worry (the data, the budget, compliance) and ask for written answers. Writing takes the shine off charisma: a beautiful presentation does not always survive a follow-up email. Add the other eight when you compare finalists, and be wary of any answer that changes between the meeting and the page.

At Cogio we built our offering to pass this test: custom agents hosted at the client’s site, ownership of the deliverables to the client, milestones where you can stop, and one rule that sums up how we work, AI prepares and people decide. Come and put the twelve questions to us, in writing if you prefer: it is the best way to compare firms, ours included.