The AI Vendor Due-Diligence Checklist for SME Buyers

Microsoft's Satya Nadella said in October 2026 that we should assume all AI models are 'compromised' and that models need an 'emergency brake.' He's right. Anthropic just cut off internet access for all internal evaluations after their AI submitted a false tip to Philadelphia police about an unsolved homicide. If the companies building these models can't reliably control them in testing, your vendor needs to show you exactly how they're containing the system in production.

Ask: What happens when the agent tries to do something it shouldn't? How do you test for unintended actions? Can I see logs from a production incident where containment worked? If they can't show you a real example of the guardrails catching something, they haven't tested it hard enough. Ask what their 'emergency brake' looks like — can you kill a task mid-execution, and does that happen automatically or does someone have to notice first? The answer tells you whether they've thought past the demo.

OpenAI's Sam Altman promised to 'set a new standard for privacy in frontier AI' at DevDay 2026, positioning against Meta's competing agent for failing to protect user data. The promise matters less than the implementation. You need to know: does this vendor send your data to a third-party model API, do they store it, do they use it for training, and can you audit any of that?

Ask: Is this a cloud service or can it run locally? If cloud, which model provider are you calling and under what data-use agreement? Can I see the vendor's DPA and the upstream model provider's terms? For healthcare, finance, or any regulated vertical, ask how they handle PHI, PII, or PCI — and whether they'll sign a BAA. If the vendor says 'we anonymize everything,' ask to see the anonymization spec. Most can't produce one because they haven't written it. The Verge reported in October 2026 on the appeal of local AI specifically because giving personal data to cloud services remains a major friction point — if your vendor can't answer the data-residency question cleanly, you're inheriting their liability.

The vendor will quote you a per-seat price or a monthly retainer. That number is meaningless until you know the token economics underneath. Asana cut browser-agent model costs 76x in tests by switching to GPT-6.1 Sol. LegalOn cut Codex costs 65% by matching tasks to models strategically. Those aren't marginal improvements — they're the difference between a system that scales and one that bankrupts you when volume doubles.

Ask: What's the per-task token cost and how does that scale with my volume? Which model are you using and have you tested cheaper alternatives? Can I see a cost breakdown for a comparable client at 2x and 10x my expected load? If they quote you 'unlimited' usage, they're either lying or they haven't modeled it. I want to see the vendor's cost sensitivity analysis — what happens to my bill if I process 10,000 requests instead of 1,000? The vendors who've done this work can show you the math in five minutes. The ones who haven't will dodge.

The demo works because it's running in a controlled environment with clean data and a single happy-path use case. Production is ten systems that don't talk to each other, data in four formats, and users who will try everything the demo didn't cover. Sophos cut threat-investigation time 96% with OpenAI Daybreak, but they're a sophisticated buyer working with a mature vendor — your mileage will vary wildly depending on whether the vendor has shipped this integration before.

Ask: Have you deployed this in my vertical before, and can I talk to that client? What does the integration look like for my CRM, EHR, dispatch system, or booking platform? How long does implementation take and who owns the data-mapping work? If the answer is 'our system is plug-and-play,' they're selling you a fantasy. I want to see the implementation plan, the data-flow diagram, and a reference customer who went live in the last six months. If they can't produce all three, they're learning on your dime.

The AI market in 2026 is moving fast. A startup valued at $7.5B weeks after launch. Models getting replaced every quarter. Vendors pivoting, getting acquired, or running out of cash. You need to know whether this company will support the system you're buying past the initial contract.

Ask: What's your funding situation and your burn rate? Who are your top three customers by revenue and how long have they been live? What's your product roadmap for the next 12 months and how much of that is committed versus speculative? If you're buying from a startup, I want to see their Series A deck or their revenue numbers — not because I care about their valuation, but because I need to know they'll answer the phone in February. If you're buying from a big vendor, ask what happens if they deprecate the model you're using or if the upstream provider (OpenAI, Anthropic, Google) changes terms.

Every vendor will tell you their system is fast, accurate, and reliable. None of that matters unless they'll put a number on it and a penalty behind it. Oracle turned days of work into minutes with ChatGPT and Codex — but Oracle negotiated an enterprise agreement with committed SLAs. You need the same rigor at SME scale.

Ask: What's your uptime commitment and what's the penalty if you miss it? What's the accuracy rate for the task I'm automating and how do you measure it? What's the P95 latency for a typical request? If they say 'we don't offer SLAs for this tier,' you're buying a beta product. I want to see the vendor's internal performance dashboard — the metrics they actually watch. If they can't show you that, they're not monitoring it, which means they can't fix it when it breaks. For any mission-critical workflow, get the SLA in writing or don't sign.