Questions to ask an AI consulting firm before you sign anything
Twenty questions, grouped by the stage of the buying process, each with the answer you want and the answer that should end the call. The published lists we read agree on most of them, so the credit for each idea goes to the page that prints it. Use them with any firm, Digiton included.
Questions to ask an AI consulting firm
- Questions
- Twenty, in five stages
- Lists compared
- Four published guides
- Best test
- Ask for it in writing
- Checked
- 12 November 2026
The short answer
Ask an AI consulting firm who will do the work, which similar system it has shipped and still runs, how it handles your data, who owns the code and prompts, how success is measured, and how your team takes over. A good firm answers with names, documents and dates. A weak one answers with reassurance.
What the published question lists agree on
Dan Cumberland Labs published eight questions on 29 October 2026 and Prodinit published its own eight on 11 June 2026. Both are written by firms that sell AI work, and Prodinit's green-flag examples describe its own practices. Read them as a checklist to test, not as proof.
The overlap is clear. Both ask about similar completed projects, who actually does the work, how data is handled, how success is measured and what happens after the engagement ends. Geeks Ltd and Helium42 add outcomes measured 90 or more days after launch, ownership of models and data in writing, and a named delivery team. We group the questions by stage so you can use them in the order a purchase happens, and we add the ones the lists miss.
Stage one: fit and people
Ask these in the first call. They take ten minutes and remove most of the field.
| Question | A good answer | A red-flag answer |
|---|---|---|
| 1. Which system like ours have you shipped, and is it still running? | A named system, a size close to yours, a measured result and what broke after launch | Many clients, no specifics, or enterprise examples offered to a small buyer |
| 2. What did the last project that went badly teach you? | A real failure and the change it caused | Cannot name one |
| 3. Who will do the work week to week? | Named people with titles and weekly time, and a senior lead who stays involved after kickoff | Our team of experts, or a senior person who disappears after the sale |
| 4. Will the people I am speaking to be the people on the project? | Yes, and it is in the proposal | Staffing decided after signing |
| 5. What would you not take on for us? | A clear no, with a reason, and a name of who might fit better | Yes to everything |
Stage two: method and proof
These separate a firm that has a method from one that has a pitch. Prodinit and Dan Cumberland Labs both ask about discovery and measurement.
| Question | A good answer | A red-flag answer |
|---|---|---|
| 6. How do you approach discovery before recommending anything? | Stakeholder conversations, workflow mapping, constraints, and a prototype or pilot before the full build | A technology named in the first meeting, or an offer to start building at once |
| 7. How will we know it works, and by when? | Success metrics agreed before work starts, and a result checked 90 or more days after launch | Success defined as deliverables handed over |
| 8. How do you test and monitor quality once it is live? | A defined evaluation method, quality checks before each release, and a test set that is refreshed | We will set up some logging |
| 9. Can I speak to a client whose project ended six months ago? | Yes, before signing, including one that was hard | Every client under NDA, or references only from unrelated work |
Stage three: data and security
Helium42 calls data governance non-negotiable. GDPR Article 28(1) says a controller uses only processors that give sufficient guarantees of appropriate technical and organisational measures. Article 28(2) says a processor does not engage another processor without the controller's written authorisation. Those two sentences become four questions.
- 10. Which model providers and subprocessors will see our data, and in which regions? A good answer is a list you can read, with the terms that apply. A red flag is we take security seriously and nothing more.
- 11. What is retained, for how long, and can it be deleted on request? A good answer is a written policy with timelines. A red flag is silence on retention.
- 12. Is anything we send used to train a model? A good answer is a plain no, written into the contract. A red flag is it depends.
- 13. Who signs the processor terms, and will you accept ours? A good answer names the entity and shows a data processing agreement. A red flag is reluctance to put it in writing.
Our AI vendor due diligence checklist goes deeper on this stage.
Stage four: commercials and ownership
Prodinit's list treats ownership and delivery model as separate questions. We agree. Both change what you hold if the relationship ends.
| Question | A good answer | A red-flag answer |
|---|---|---|
| 14. Who owns the code, prompts, models and datasets, and from when? | All deliverables assigned to you, in your repository and accounts from the first commit | Assignment only at final payment, or licence language that is silent on prompts and models |
| 15. How is the work priced and what triggers a change? | Discovery first, then milestones with written acceptance criteria | Open-ended time and materials with no exit point, or a fixed price with no discovery |
| 16. What costs sit outside your fee? | A list with ranges for model usage, licences and hosting | There should be no extra costs |
| 17. When can we stop, and what do we keep? | A named exit point and everything built so far | A long minimum term with no stop |
The AI project scope of work checklist turns these answers into contract sections.
Stage five: handover and exit
Geeks Ltd warns against structuring the build so you depend on the firm to maintain it, often through a retainer. Three questions test for that.
- 18. What will we hold at the end? A good answer is a runbook, a recorded walkthrough and architecture notes. A red flag is a slide deck.
- 19. Can our own engineer ship a change before you leave? A good answer builds that test into the plan. A red flag is we will always be on call.
- 20. What support exists after go-live, and what does it cover? A good answer states hours, scope and an end date you can renew. A red flag is vague availability.
If a firm answers all twenty well, you have a shortlist. If it answers fifteen well and cannot answer data or ownership, you have a risk. Compare firms on the sheet in how to choose an AI consulting firm, and see AI consulting firm vs freelancer if the other option is one person.
How to score the answers
Do not trust the call. Ask for the evidence in writing within a day and mark each answer one of three ways: shown, said or dodged. Shown means a document, a name or a link. Said means a confident sentence with nothing behind it. Dodged means the question moved.
Count the shown answers. A firm with twelve of twenty shown has a track record you can verify. A firm with three has a good pitch. Weight data, ownership and handover more heavily than the rest, because those are the answers that cost you most when they are wrong. The wider field is mapped in the kinds of AI consulting firm, which helps you decide which questions matter for the kind you are talking to.
Where Digiton fits and where it does not
Digiton is an AI consulting firm that builds AI agents and custom AI software and takes systems built with Claude, Cursor or Lovable into production. Run it through these twenty questions like anyone else. The entry step is a 25-minute scoping call.
- For agents and workflows, see AI agent development.
- For larger builds, see custom AI development.
- For a system that exists and is not holding up, see production engineering, where we read the real repository and give you a scorecard across ten layers with evidence for each.
It is a poor fit for a board strategy deck, regulated advice, or a budget where a tool subscription already solves the problem.
Frequently asked questions
How many questions should I ask an AI consulting firm?
Twenty is a full set. Ask the five fit and people questions in the first call, then send the rest in writing and score the answers as shown, said or dodged.
What is the most revealing question to ask an AI consulting firm?
Ask who will do the work week to week and whether those people are on the call. A named team in the proposal is the clearest sign a firm will deliver what it pitched.
Which red flag matters most?
Reluctance to put ownership and data terms in writing. Helium42 calls IP ownership and data governance non-negotiable, and they are the hardest things to fix after you have signed.
Should I ask for references before signing?
Yes. Ask for a client whose project ended at least six months ago and, as Prodinit suggests, one from a challenging project.
Sources, checked 2026-11-12
5 sources
- Dan Cumberland Labs published on 29 October 2026 eight questions to ask an AI consultant, covering similar projects, discovery, who does the work, success measures, what happens after the engagement, data security, references and third-party costs.Source: dancumberlandlabs.com, checked 2026-11-12.
- Prodinit published on 11 June 2026 eight questions to ask an AI consulting firm, covering production track record, who builds the work, IP ownership, data security, delivery model, evaluation and monitoring, exit and handoff, and references.Source: prodinit.com, checked 2026-11-12.
- Geeks Ltd advises asking for outcomes measured 90 or more days after launch and warns against builds structured so the client depends on the firm to maintain them.Source: geeks.ltd, checked 2026-11-12.
- Helium42 calls data governance and IP ownership non-negotiable in its 12-point guide and recommends asking for a named delivery team.Source: helium42.com, checked 2026-11-12.
- GDPR Article 28(1) says the controller uses only processors providing sufficient guarantees for appropriate technical and organisational measures, and 28(2) says a processor shall not engage another processor without prior specific or general written authorisation of the controller.Source: eur-lex.europa.eu, checked 2026-11-12.
Digiton Dynamics OÜ is registered in Tallinn, Estonia, and delivers from Lisbon.
Update log
- Published. Read on 12 November 2026: the Dan Cumberland Labs, Prodinit, Geeks Ltd and Helium42 question and selection guides.
Each source above was opened on the date beside it. How facts get chosen and checked is written down in the editorial policy.
Talk to an engineer about your system
Book a free 25-minute scoping call. We tell you what we would build, what it takes to keep it running, and whether we are the right fit.