- Three routes, and one list of questions for all of them
- The seven selection questions, in plain words
- What to ask about the model itself
- Five answers that tell a small buyer the most
- The black box and lock-in warning
- Knowledge transfer and the day the contract ends
- The rules that sit around any firm you hire
- How I'd run the shortlist in five steps
- My verdict: finish line and handover before tools
- Frequently asked questions
The useful way to compare AI consulting firms isn't brand or headcount, it's which questions each firm can answer clearly. The UK government's Guidelines for AI procurement, published on 8 June 2020 and aimed mainly at central government departments, already list those questions, and they work unchanged for a small business.
Here's the part most roundups miss. Lists of AI consulting companies tend to rank brand and headcount, while this list cares about what happens after the project. It puts knowledge transfer, end-of-contract data handling and 'can you explain the result' on the same list as accuracy. It was written for government departments, yet I'd use every question for a ten-person company.
The guidelines came from the UK Office for Artificial Intelligence, developed with the World Economic Forum Centre for the Fourth Industrial Revolution, Government Digital Service, Government Commercial Function and Crown Commercial Service. They set out ten considerations, including a data assessment before you buy, weighing benefits against risks, and planning governance and information assurance.
Three routes, and one list of questions for all of them
A small buyer has three routes: a large consultancy, a boutique firm or an independent consultant. I won't pretend one type wins, because the test is the same for all three. The guidelines tell buyers to engage early with a wide range of suppliers, including small and medium sized ones, so I'd speak to more than one route before you decide.
- Large consultancy. Here's one example of how a large firm labels its services: as of November 2026, Accenture's AI and Data services page names Industrial AI, Data Services, Generative AI, AI Strategy and Value, Responsible AI, Accenture AI Refinery, Technology Sovereignty, and AI Talent and Workforce. A label isn't an answer, so ask the questions below anyway.
- Boutique firm. Put the same questions in the same order, and write the answers down word for word so you can compare them side by side.
- Independent consultant. Same questions again, with no allowances for the route. A vague answer is vague whoever gives it.
Before you ask anything, give each one a clear problem statement rather than a detailed solution specification. The guidelines also note that AI development is iterative, so you should expect a general approach rather than a fixed plan from a supplier. A general approach isn't a dodge. Failing the questions below is.
The seven selection questions, in plain words
I'd send these selection stage questions to every firm as a written list.
- Do you have an internal AI ethics approach, and how have you applied it? Ask for the how, not only the yes.
- How do you ensure accountability for algorithm outputs? In other words, who answers for it when the output's wrong?
- How do you avoid unfairly discriminatory outputs? Put simply, how do you stop it treating people unfairly?
- How do you design for reproducibility? You're asking whether the work can be repeated and checked.
- How do you test the model under different conditions? Ask which conditions, and don't settle for a tidy demo.
- How do you define acceptable model performance? You want a definition you can check later.
- What security provisions do you have? Ask for the list rather than a reassurance.
What to ask about the model itself
The publication stage of the guidelines adds five more questions about what's under the bonnet. If a firm's building or adapting a model for you, they're all fair to ask.
- Which AI techniques does the model use?
- How are variables selected?
- What are the origin and nature of the training data?
- What are the model's limitations?
- How will you address data shortcomings?
That last one is why I'd do your own data assessment first: you can't judge the answer otherwise.
Five answers that tell a small buyer the most
If you've only got time for one short call, I'd lead with these.
| Question to ask | Stage | Why a small buyer should still ask it |
|---|---|---|
| What is your knowledge transfer and training plan? | Ongoing management | Decides whether your team can run it once the engagement ends |
| What are your end-of-contract processes for data and the system? | Ongoing management | Tells you what you keep and what you can move |
| How can your model's results be explained and understood? | Black box and lock-in | Unexplained output is hard to defend to a customer |
| What are the model's limitations? | Publication | A firm that can't name limits hasn't tested enough |
| How do you define acceptable model performance? | Selection | Gives you a measurable finish line before work starts |
The black box and lock-in warning
Avoiding black box algorithms and vendor lock-in is one of the ten considerations in its own right. The advice is to prioritise explainable methods that your team and other suppliers can interpret.
Look at the second half of that sentence, because it's the lock-in test. If another supplier couldn't make sense of what's been built, you'll find it hard to leave the firm that built it. I'd ask: could another supplier pick this up and understand it? Technical and ethical limitations should be addressed during evaluation too, not after you've signed.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Knowledge transfer and the day the contract ends
Beyond the knowledge transfer and end-of-contract questions in the table, the guidelines ask how model efficacy will be monitored after deployment. I'd press hardest here. Ask who on your team gets trained and on what, and who's watching the model once it's live, and get what happens to both the data and the system at the end in writing.
The guidelines also say to plan ongoing support, hosting and maintenance costs and keep end-to-end audit logs, so ask who'd hold those logs and whether you can still reach them after the contract. Lifecycle management is one of the ten considerations too.
The rules that sit around any firm you hire
NIST describes its AI Risk Management Framework as voluntary, with four core functions: Govern, Map, Measure and Manage. The EU AI Act has been in force since 1 August 2024. As of November 2026, prohibited practices and AI literacy obligations have applied from 2 February 2025, and governance rules and general-purpose AI model obligations from 2 August 2025. After the AI Omnibus, in force 27 July 2026, high-risk rules for Annex III use cases apply from 2 December 2027, and those for AI in regulated products from 2 August 2028. I'd ask any firm which of these it works to, and how that shows up in your project.
How I'd run the shortlist in five steps
- Write a one paragraph problem statement, not a tool wish list.
- Ask every firm the same seven selection questions.
- Get the knowledge transfer plan in writing.
- Check what happens to your data at contract end.
- Agree the finish line before any pilot starts.
My verdict: finish line and handover before tools
I'd choose the firm that agrees the finish line and the handover in writing before it talks about tools. That includes me, so hold me to the same list. I wouldn't choose on logo or headcount, and I'd walk away from any firm that can't explain its results or tell you what you keep at the end, whichever route it came through.
For the decision about the person you'll work with, read my guide to choosing an AI consultant. Once you've got a favourite, use this pre-signing check on an AI consultancy.
If your team wants AI work scoped like this and then set up and run for you, that's the kind of thing I help with. I run AI training and workshops for teams, and help businesses with AI enablement, AI automation and GEO, which is about getting your business seen and cited in AI answers. Most of that work is with SaaS marketing teams, telecom companies and small businesses. Here's how we can work together.
Frequently asked questions
Were the UK AI procurement guidelines written for small businesses?
No. They were aimed mainly at central government departments, and they were published on 8 June 2020. I'd still use the questions with AI consulting companies of any size, because none of them depends on being a government buyer.
Is the NIST AI Risk Management Framework mandatory?
No, NIST describes it as voluntary. AI RMF 1.0 was released on 26 January 2023 and the Generative AI Profile, NIST-AI-600-1, on 26 July 2024. As of November 2026, NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan, so I'd ask a firm which version it's working from.
Who should be in the room when I choose an AI consulting firm?
The guidelines say to make decisions in a diverse multidisciplinary team, and to include procurement within a strategy for AI adoption. In a small company, I'd bring in more than one person, so the decision isn't left to whoever's keenest on the tool.
