How to Evaluate AI Software Before Purchase
A practical checklist for businesses: 35 questions to ask an AI vendor about data, contracts, the EU AI Act, security, output quality, pricing and exit — before you sign.
Last reviewed: 12 October 2026
Tick questions as you get written answers. Nothing is saved or sent: the ticks live only in this browser tab.
- Define the job before you look at tools
- Data: what goes in, where it goes, how long it stays
- Contract and GDPR paperwork
- EU AI Act: your obligations as a user
- Security and access control
- Output quality on your own data
- Pricing model: how the bill grows
- Integrations, lock-in and exit
- Vendor reliability and support
- Pilot, decide, review
Define the job before you look at tools
Most failed AI purchases start with a tool, not a problem. Write down the task, who does it today, how often, and what "better" means in numbers (time per task, error rate, cost per case) before you open a single vendor page.
- The requirement is "we need AI" rather than a specific task.
Data: what goes in, where it goes, how long it stays
Anything you type, upload or connect may be stored, logged or passed on to sub-processors, including the provider of the underlying AI model. Get the answers in writing.
- The training opt-out exists only as a settings toggle, not in the contract.
- No published list of sub-processors.
Contract and GDPR paperwork
If the tool processes personal data on your behalf, GDPR Article 28 requires a contract with specific processor terms, usually called a Data Processing Agreement (DPA). Transfers of personal data outside the EEA also need a legal transfer mechanism.
- "GDPR compliant" on the website, but no DPA available on request.
EU AI Act: your obligations as a user
Under the EU AI Act, businesses that use AI systems ("deployers") have obligations of their own, and they depend on how the system is used. The AI literacy duty (Article 4) has applied since 2 February 2025 and the Article 50 transparency rules since 2 August 2026.
- The vendor cannot say whether your intended use could be high-risk.
Security and access control
An AI tool connected to your email, documents or CRM is a new door into your data. Treat it like any other system with access to business information.
- Security shown only as badges, with no report available even under NDA.
Output quality on your own data
Demos use the vendor's best examples. What matters is how often the tool is wrong on your real cases. Prepare a fixed set of real cases with known correct answers and run every shortlisted tool on the same set.
- No trial on your own data, only a scripted demo.
Pricing model: how the bill grows
AI pricing is often usage-based, so the bill depends on how much you use the tool. This page deliberately shows no prices: they change too often. Always confirm on the vendor's current pricing page and in your contract.
- Usage limits that are not stated in writing.
Integrations, lock-in and exit
The cost of switching is set on day one. Check how your data and your work leave the tool before anything goes in.
- No export, or export only on request and at extra cost.
Design the workflow in the Workbench and export it (n8n, BPMN, Excel and more) →
Vendor reliability and support
You are buying a relationship, not only software. Small vendors can be excellent, but you should know who they are and what they commit to.
- No legal entity or company address anywhere on the website.
Pilot, decide, review
A short, measured pilot beats a long debate. Use the success measures from step 1 and the same cases for every tool.
Where GateOnAI helps
- Compare AI tools side by side to build a shortlist.
- EU AI tools: tools whose providers state GDPR compliance or EU hosting. These are vendor statements; verify them with the questions above.
- How the GateOnAI Score works: computed algorithmically from measurable signals, never paid for, and not a certification.
- The Workbench: map the workflow the tool must fit into, free and without an account.
- EU AI Act guide: deadlines and obligations explained for businesses.
Frequently Asked Questions
What should a business check before buying AI software?
Start with the task and how you will measure success. Then ask the vendor where your data is processed and stored, whether it is used for training, how long it is kept and which sub-processors receive it; ask for the Data Processing Agreement; check your EU AI Act obligations as a user; review security (SSO, audit logs, an independent security report); test output quality on your own real cases; understand how the price scales with usage; check export and exit terms; and run a time-boxed pilot before you decide.
Do we need a Data Processing Agreement (DPA) with an AI vendor?
If the vendor processes personal data on your behalf, GDPR Article 28 requires a contract with specific processor terms, which is usually called a Data Processing Agreement. Ask for it before you sign and have it reviewed by your legal adviser. This page is general information, not legal advice.
Does "GDPR compliant" on a vendor's website mean the tool is compliant?
No. It is a statement by the vendor. Ask for the DPA, the list of sub-processors, where data is stored and which transfer mechanism applies, and check them against your own use. GateOnAI's EU filter shows what providers state; GateOnAI does not verify those statements.
How long should an AI software pilot last?
Long enough to cover a normal work cycle with real cases; for many teams that is a few weeks. More important than the length is measuring the same success criteria, on the same cases, for every tool you test.
Does GateOnAI recommend specific vendors on this page?
No. This page names no vendors and shows no prices, and no vendor paid to influence it. To build a shortlist, use GateOnAI's comparisons and category pages. The GateOnAI Score is computed algorithmically from measurable signals; it is not a certification.