Direct answer: Before you sign any AI vendor contract, run 12 questions across three tiers — business model fit, integration risk, and ROI verification. If the vendor can't answer all 12 in writing, you don't sign. Print the checklist below, take it into the sales call, and treat it like a pre-deployment inspection. Fifteen minutes now beats a twelve-month contract you can't get out of.

The Pitch Never Stops, So the Inspection Can't Either

You are getting pitched AI tools every week. Chatbot for the website. Content generator for social posts. CRM add-on that "automatically" scores your leads. Analytics dashboard that promises to tell you things your P&L already tells you, just with better fonts.

Most owner-operators running a $500K to $5M business say yes to one of these every quarter. Not because the tool is good. Because the demo was good, the salesperson was likable, and nobody on your team had 15 minutes to ask the questions that matter before the card got charged.

Due diligence is non-negotiable. Not because I like paperwork. Because I spent years watching what happens when it gets skipped.

At Hartford Steam Boiler, a Munich Re company, I was an innovation scout — one of 15 people in a 55,000-person organization whose entire job was evaluating new technology before the company invested a dime. Some of those evaluations covered $50 million insurance technology decisions. Multi-year contracts. Systems that touched claims data for millions of policyholders. You do not sign that kind of commitment on a good demo and a friendly sales rep. You run it through a framework, every time, with no exceptions, because the cost of skipping the framework is measured in millions and in years you don't get back.

Here's what nobody tells you when you're running a $2M shop instead of a $50 billion reinsurer: the framework doesn't change. The stakes get smaller. The discipline doesn't. A $500-a-month AI subscription that locks up your customer data, breaks your website with an undocumented API change, and delivers nothing measurable is a smaller version of the same failure mode that kills big tech investments. The principles scale down. They don't get lighter.

This is the checklist I use now, and it's the one you should run before your next signature. Twelve questions. Three tiers. Fifteen minutes if you're organized, longer if the vendor makes it hard to get straight answers , which is itself information.

Why This Matters More Than the Sales Rep Wants You to Know

Gartner's research on generative AI initiatives found that at least 30% of GenAI projects get abandoned after proof-of-concept, and separately projects that through 2026, organizations will abandon 60% of AI projects that aren't backed by AI-ready data. That's enterprise data, with enterprise budgets and enterprise IT teams doing the vetting. You are running due diligence with a lot less staff and a lot less room for a wasted year. If a Fortune 500 company burns 30-60% of its AI bets, assume your hit rate without a checklist is worse, not better.

The vendors themselves are a bigger risk than most owner-operators price in. CB Insights tracked 431 VC-backed startups that shut down since 2023 and found the median time from a company's last fundraise to its death was 22 months. Translation: a vendor that looks flush today, with a slick site and a Series A press release, can be gone before your two-year contract is up. You need a plan for that scenario before you sign, not after their status page goes dark.

And the marketing is not neutral. The Federal Trade Commission has run active enforcement , Operation AI Comply among it , against companies making false or unsubstantiated claims about what their AI tools can actually do. The FTC's own guidance states plainly that "false or unsubstantiated claims about a product's efficacy are our bread and butter" for enforcement. If the FTC has to police an entire industry's sales claims, you should assume every demo you sit through is optimized to obscure the same limitations regulators are chasing.

This is the environment you're buying into. Treat every AI sales call like a casualty drill: assume something is going to go wrong, and find out now what that failure looks like, not six months into the contract.

Tier 1: Business Model Fit

Before you ask anything about integrations or SLAs, answer whether this tool solves a real problem you're currently paying for in a different form.

1. Does this solve a problem I'm currently paying humans to solve?

Green flag: You can name the specific task, the specific person or hours currently spent on it, and the dollar figure. "My VA spends 6 hours a week writing product descriptions at $22/hour. That's $572/month."

Red flag: "It'll help with marketing" or "it'll make the team more efficient." Vague problems get vague results. If you cannot name the task being replaced or augmented, you are buying a feeling, not a fix.

2. What's my cost per unit of output?

Green flag: You can do the math , cost per email drafted, per lead scored, per support ticket resolved , and compare it to your current cost per unit.

Red flag: The vendor prices in "seats" or "credits" that don't map cleanly to a unit of work you can measure. This is the same trap we flagged in our audit of the martech plateau , 15,505 tools and zero strategy. Tool sprawl happens exactly when nobody can answer this question, so nobody notices when three tools do the same job.

3. What happens to my data if I cancel?

Green flag: A written data retention and deletion policy, with a specific window (30/60/90 days), and a stated method for you to export everything before it's purged.

Red flag: "We'll work with you on that" or silence. This is Layer 1 of what we call the Sovereignty Stack , the data custody check. Before you evaluate anything else about a vendor, you confirm you own your data and can walk away with it intact. If a vendor can't answer this in one sentence, they haven't built for it, which means they don't think about it, which means it will bite you.

4. Can I export my trained models, configs, and custom workflows?

Green flag: Yes, in a standard format, documented in the terms of service, no extra fee.

Red flag: Anything you've customized , a trained chatbot personality, custom CRM scoring rules, a fine-tuned content voice , lives only inside their platform, non-transferable. We wrote about this exact trap in the constant contact audit: great needs great AI data ownership. The work you put into training the tool becomes leverage the vendor holds over you, not an asset you own.

Tier 2: Integration Risk

A tool that works in isolation and breaks your stack is not a tool. It's a liability with a monthly invoice.

5. Does it connect to my existing stack without custom development?

Green flag: Native integration with your CRM, your email platform, your accounting software , documented, tested, with existing customers using that exact combination.

Red flag: "We can build that for you" or "our API is flexible." That means it doesn't exist yet and you're the one funding the R&D.

6. What's the SLA for downtime?

Green flag: A written service level agreement with a specific uptime percentage, defined response times for outages, and financial remedies (credits, refunds) if they miss it.

Red flag: No SLA at all, or an SLA that only covers their side of the infrastructure while excluding the API calls, data pipelines, or third-party dependencies that actually break in practice.

7. Who owns the API changes , do I get broken by their updates?

Green flag: A documented deprecation policy (30, 60, 90 days notice) before breaking changes ship, with a changelog you can subscribe to.

Red flag: "We push updates automatically to give you the latest features." That's a watchstander's nightmare , a system that changes underneath you with no warning, and you find out it broke something when a customer complains, not when the vendor tells you.

8. What's the vendor's funding status , will they exist in 18 months?

Green flag: Profitable, bootstrapped, or recently and publicly funded with a runway you can estimate. They'll tell you plainly if you ask.

Red flag: Evasive answers, or a funding history that shows a company burning cash with no path to profitability. Remember the CB Insights number: median time from last raise to shutdown is 22 months. If a vendor raised 20 months ago and hasn't raised since, that is not paranoia, that is arithmetic.

Tier 3: ROI Verification

This is the tier most owner-operators skip entirely, because it requires admitting a pilot might fail before you've spent the money to find out.

9. What's the measurable metric this tool moves?

Green flag: One specific number , response time, close rate, cost per lead, hours saved , tracked before and after, with a baseline you set before turning the tool on.

Red flag: "Engagement" or "efficiency" with no defined measurement. Immeasurable claims are how a tool survives budget review for three years without ever proving it did anything.

10. What's the payback period at my usage level?

Green flag: The vendor can run the math with your actual volume , your ticket count, your lead count, your email send volume , and show you months to breakeven.

Red flag: Only case studies from companies 50x your size. Their $2,000/month tool paying off for a company processing 40,000 transactions a month tells you nothing about whether it pays off at your 400.

11. Can I run a paid pilot before an annual commitment?

Green flag: Yes , a 30 or 60-day paid pilot at a fraction of the annual rate, with a defined off-ramp if it doesn't perform.

Red flag: "We only do annual contracts, but we're confident you'll love it." Confidence is not a contract term. The SBA's guidance on small business contracting stresses that clear deliverables and defined performance terms protect the buyer , the same logic applies whether you're negotiating a $2M government contract or a $6,000 SaaS subscription. If a vendor won't let you test before you commit, ask why they need your annual payment locked in before you've proven value.

12. What does the vendor's worst customer review say?

Green flag: You can find it, read it, and the vendor has a public response addressing it directly , not defensively.

Red flag: Reviews are suspiciously uniform, all five stars, all posted within the same short window. G2's own research methodology exists specifically because review manipulation is common enough to require a dedicated "Review Safety Toolkit" , bot detection, plagiarism checks, AI content scanning , just to keep the review pool honest. If a product's reviews look too clean, they probably are.

The Checklist

Print this. Bring it into the next sales call. Do not sign until every row has a green flag or a documented reason why the red flag doesn't apply to you.

| # | Question | Green Flag | Red Flag | |---|----------|-----------|----------| | 1 | Does this solve a problem I'm currently paying humans to solve? | Specific task, hours, and dollar figure named | "It'll help with marketing/efficiency" | | 2 | What's my cost per unit of output? | Clear cost-per-unit math you can run yourself | Pricing in vague "seats" or "credits" | | 3 | What happens to my data if I cancel? | Written retention/deletion policy with export window | "We'll work with you on that" | | 4 | Can I export my trained models/configs? | Yes, standard format, no extra fee | Customizations locked inside their platform | | 5 | Does it connect to my stack without custom dev? | Native, documented, proven with similar customers | "We can build that for you" | | 6 | What's the SLA for downtime? | Written uptime %, response times, financial remedy | No SLA, or one that excludes the parts that actually break | | 7 | Who owns the API changes? | Documented deprecation notice, subscribable changelog | Silent auto-updates with no warning | | 8 | What's the vendor's funding status? | Profitable or clear, estimable runway | Evasive, or burning cash with no path to profit | | 9 | What's the measurable metric this moves? | One specific number, baseline set in advance | "Engagement" or "efficiency" with no definition | | 10 | What's the payback period at my usage level? | Math run on your actual volume | Only case studies from companies 50x your size | | 11 | Can I run a paid pilot before annual commitment? | Yes, 30-60 day pilot with defined off-ramp | "We only do annual contracts" | | 12 | What does the worst customer review say? | Findable, with a direct vendor response | Suspiciously uniform five-star reviews |

What a Bad Answer Actually Sounds Like

Here's the pattern I see most: a vendor answers questions 1, 2, 9, and 10 well , because those are the ROI-facing questions their sales deck is built to answer , and goes soft on 3, 4, 6, 7, and 8. That's not an accident. Those are the questions that expose lock-in, downtime risk, and vendor mortality. The sales team is trained to sell outcomes and trained to deflect on custody, integration risk, and company stability.

That's exactly why this framework doesn't treat all 12 questions as equally weighted by the vendor's willingness to answer them. It treats every unanswered question as a red flag on its own, regardless of how good the demo looked. This is the same failure mode we flagged in our piece on why consolidation platforms are the wrong problem , systems, not subscriptions. Owner-operators keep buying more subscriptions to solve a systems problem, and due diligence is the one habit that catches that mistake before the invoice hits your bank account instead of after.

Run the Drill Before You Sign

On a submarine, you don't wait for a casualty to find out whether your emergency procedures work. You drill them, over and over, so that when something actually goes wrong, the response is automatic. Vendor due diligence works the same way. You don't want to be improvising these 12 questions for the first time while a salesperson is walking you toward a signature. You want them memorized, printed, and non-negotiable before the call even starts.

The framework I used to vet $50 million insurance technology decisions and the framework you need for a $500-a-month chatbot are the same framework. The zeros change. The discipline that protects you from a bad bet does not.

Fifteen minutes. Twelve questions. Every time. That's the whole system.

FAQ

How long should a proper AI vendor due diligence review actually take?

For most owner-operator purchases , tools under $10,000 a year , 15 to 30 minutes is enough if you have the checklist in front of you and the vendor is straight with you. If getting answers takes longer than that, the delay itself is data. A vendor with clean answers to all 12 questions can usually produce them fast because the answers already exist in their documentation.

What if the vendor won't offer a paid pilot at all?

Ask for a month-to-month option instead of annual, even at a higher per-month rate. Paying 20% more per month to preserve your exit option is cheap insurance compared to being locked into a 12-month contract with a tool that isn't working. If they refuse both a pilot and month-to-month, that refusal is your answer.

Does this checklist apply to free AI tools too?

Apply it especially to free tools. "Free" usually means your data is the product, which makes question 3 , what happens to my data if I cancel , the single most important question you'll ask. Free tiers also tend to have the weakest SLAs and the least funding stability, because there's no direct revenue holding the company up.

How do I evaluate a vendor's funding status if they're private and don't disclose numbers?

Ask directly. A financially healthy private company will usually tell you they're profitable or self-funded, because it's a selling point. Evasiveness or a pivot to talking about "growth" instead of stability is itself an answer. You can also check how long it's been since their last public funding announcement , if it's past 18-24 months with no update, treat that as a flag per the CB Insights data on time-to-shutdown after a last raise.

Should I run this checklist even for tools my team is already using?

Yes, and you'll be surprised how many existing subscriptions fail it. Due diligence isn't just a pre-purchase filter , it's an audit tool for the tools you already pay for. If a vendor you've used for a year can't answer questions 3, 4, or 8 cleanly today, that's information you needed a year ago and are getting late. Better late than never.

*Jeff Barnes is the founder of demg.ai and Digital Evolution Marketing Group. He has no personal financial position in any company, tool, or platform named in this article unless explicitly stated. demg.ai provides marketing education and systems for owner-operators, not investment advice. All business outcomes described are illustrative and not guaranteed. Your results depend on your execution.*