Vetting AI Vendors When You're a Team of Five

You don't have a procurement department, a legal team, or a CISO. You're five people trying to pick an AI tool without getting burned. Here's the scaled-down diligence that covers most of the risk.

First, the data question: what exactly does the tool see, and where does it go? If the answer is vague, stop here.

Second, the paper question: will you put data handling, deletion, and breach notification in the contract? A vendor who won't write it down is telling you their real policy.

Third, the failure question: what happens when the tool is wrong, and what controls exist to catch it? You're listening for honesty, not perfection.

Fourth, the people question: can we reach a human when something breaks? Test the support channel before you need it.

Fifth, the exit question: how do we get our data out? Small teams switch tools often; make sure you can.

That's it. Five questions, one honest conversation, everything in writing. You won't catch everything a Fortune 500 diligence process catches. You'll catch the things that actually hurt small businesses, which is what matters.

I explain frameworks; I don't give legal counsel.