This article is part of the AI in the Real World series — practical guides for AI adoption, governance, and implementation in business.

Introduction

Every software vendor now claims to have AI. Most of them are lying — or at best, exaggerating. As a buyer, you need a framework to separate genuine AI capabilities from marketing buzzwords. This guide gives you the questions that make vendors uncomfortable.

The AI Hype Detector

Red Flags That Scream "Fake AI"

  • "AI-powered" without specifics — If they cannot explain what the AI actually does, it does not exist
  • Magical accuracy claims — "99% accurate" without methodology is meaningless
  • No training data discussion — Real AI vendors can explain their data sources
  • Instant results promises — AI requires tuning; anyone promising plug-and-play is overselling
  • Avoiding technical questions — If the sales team cannot connect you to engineers, worry

Signs of Genuine AI Capability

  • Clear explanation of the underlying model architecture
  • Honest discussion of limitations and failure modes
  • Documented training data and bias assessments
  • Measurable performance metrics with methodology
  • Willingness to run proof-of-concept on your data

The Technical Due Diligence Checklist

1. Model Architecture

Ask these questions:

  • What type of model is it? (LLM, computer vision, predictive, etc.)
  • Is it a foundation model, fine-tuned model, or custom trained?
  • If using third-party models (OpenAI, Anthropic), which ones and how?
  • Where does inference happen? (On-premise, cloud, edge)

2. Training Data

  • What data was the model trained on?
  • How was consent obtained for training data?
  • What preprocessing and cleaning was performed?
  • How is bias detected and mitigated?
  • Is the training data refreshed, and how often?

3. Performance Metrics

  • What metrics do you measure? (Accuracy, precision, recall, F1)
  • On what test dataset were these measured?
  • How do metrics vary across different user segments?
  • What is the latency for inference?
  • How does performance degrade with scale?

4. Security and Privacy

  • Where is customer data processed and stored?
  • Is customer data used for model training? (It should not be without consent)
  • What encryption is used in transit and at rest?
  • What certifications do you hold? (ISO 27001, SOC 2, etc.)
  • How do you handle data deletion requests?

5. Integration and Operations

  • What APIs are available?
  • What is the SLA for uptime and response time?
  • How do you handle model updates and versioning?
  • What monitoring and observability tools are provided?
  • How do you handle incidents and rollbacks?

The Proof-of-Concept Test

Never buy AI without testing it on your data. A proper PoC should include:

Phase 1: Data Preparation (Week 1)

  • Provide representative sample of your data
  • Define success criteria before testing
  • Establish baseline performance from current process

Phase 2: Testing (Weeks 2-3)

  • Run AI on your data, not demo data
  • Test edge cases and failure scenarios
  • Measure actual performance against criteria

Phase 3: Evaluation (Week 4)

  • Compare AI results to baseline
  • Calculate real ROI, not vendor projections
  • Assess integration complexity honestly

Contract Clauses That Protect You

  • Performance guarantees — Minimum accuracy levels with measurement methodology
  • Data ownership — Your data is never used for training without explicit consent
  • Model transparency — Right to audit or receive explanations of model decisions
  • Exit clause — Clear data export and transition assistance if you leave
  • Liability for AI errors — Who is responsible when the AI makes harmful decisions?
  • Compliance updates — Vendor commits to EU AI Act compliance at no extra cost

Questions Vendors Hate (Ask Them Anyway)

  1. "Can I see the model card?"
  2. "What happens when your AI is wrong? Show me an example."
  3. "If I stop paying, what happens to my data and customisations?"
  4. "Can I run a PoC on my data for free before committing?"
  5. "Who trained the model, and where are they based?"
  6. "Show me your EU AI Act compliance roadmap."

Conclusion

The AI market is flooded with hype. Your defence is rigorous due diligence. Use this checklist not to be difficult, but to be informed. Vendors with genuine AI capabilities will welcome these questions. Those selling snake oil will squirm — and that tells you everything you need to know.