AI partner situation checklist

This checklist is for a company that wants an AI development firm to build software for it. Print it, fill in each part, and send the same copy to every firm you are considering. When the answers come back, put them side by side in the table in Part 7.

How to use this checklist

1. Fill in Parts 1 to 6 yourself, in plain words. If you do not know an answer yet, write that down.
2. Send it to all the firms at once, and give each the same deadline for written answers.
3. Ask each firm to answer every item in Part 7, in the same order.
4. Compare the answers. Mark every answer you can check yourself, such as a registration number or a certificate in a public register.
5. Invite the firms whose answers you could check to a meeting.

Part 1: Your situation

Tick every box that applies.

• A startup building its first AI product
• A large company adding AI to the systems it already runs
• A company in a regulated industry: health, finance, insurance, legal services or government
• A company whose earlier AI or software build failed and needs a rescue, meaning fixing or rebuilding software that did not work
• A company that wants outside engineers placed inside its own team

If you tick more than one box, fill in the questions for each one in Part 3. Where two parts ask about rules or approvals, use the stricter answer.

Part 2: What you have today

• What the AI product should do, in one paragraph: ______________________
• Who will use it, and how many people: ______________________
• What exists today: an idea / a written specification / a prototype / a working system / a failed build
• The systems the product must connect to: ______________________
• A written specification, meaning a document that states what the software must do: yes / no / in draft
• What must never happen, such as a wrong answer to a customer or a record shown to the wrong person: ______________________

Part 3: Questions for your situation

If you are a startup

• What will the first version do, and what will it leave for later? Ask for both lists.
• How long is each step, in dates? Altar.io's MVP page describes its first step as both a 7-day and a 15-day process [9], which shows why to ask.
• How will our own engineers take over the code when we hire them?

If you are a large company

• Which of our systems will you read from, and which will you change?
• How will your plan fit our security review, our change board and our supplier review?
• Who approves each change, and how is that approval recorded?

If you are in a regulated industry

• Which rules apply to this product, and how will each one be tested before every release?
• Where will our data be stored, in which country, and who at your firm can read it?
• If the product may count as a medical device, which FDA submission numbers can you give us? FDA's list of AI-enabled devices says, "The list is not a comprehensive resource of AI-enabled medical devices." [7]
• If we sell into the EU, does the product fall under the AI Act's high-risk category? The European Commission's page, read on 21 October 2026, says high-risk AI systems face strict obligations "Starting on 2 December 2027" [6], and that for AI built into products such as lifts or toys the rules apply from 2 August 2028.

If your earlier build failed

• What will you review first, how long will it take, and what will the review cost on its own?
• Will you write tests that record what the old software does before you change it?
• What would make you recommend stopping? Pragmatic Coders' rescue page says, "Sometimes the best decision is to restart or shut it down." [10]
• Who will hold the code repositories, the places where the code is stored, during the work?

If you want engineers inside your team

• Who manages each engineer each day: our manager or yours?
• Where will each engineer work, and how many hours will they overlap with our team?
• How do we replace an engineer who does not fit, and how fast?

Part 4: Rules and certificates

• The laws or regulators that apply to us: ______________________
• The certificates or audit reports our own rules require from a supplier: ______________________

For every certificate a firm names, ask for these five things, then look the certificate up in the certifier's register:

Item	What to ask for	Why
Certifier	The name of the body that issued it	A register lists only its own certifier's certificates
Company	The exact company named on it	A group can hold a certificate in one company and sign with another
Standard	The standard and its year, such as ISO/IEC 27001:2022	Editions differ
Scope	The scope text, word for word	Schellman's register shows that Accenture LLP's certificate covers the systems behind two named Accenture services [5]
Dates	Issue date and expiry date	It must be valid for the whole project

For a SOC 2 report, a report on a firm's security controls written by an outside accounting firm, ask for the report itself. The Journal of Accountancy says SOC 2 reports "are restricted to specified parties" [4], so only the firm can give you a copy.

Part 5: Data

• What data the AI needs, and where it is kept today: ______________________
• Whether that data exists in the amount and quality needed: yes / no / not known
• Whether it contains personal details, such as names, addresses or health records: yes / no
• Who in our company may approve its use: ______________________

RAND interviewed 65 experienced data scientists and engineers for a report published on 13 August 2024. Its summary names five leading root causes of failure, and one is that "the organization lacks the necessary data to adequately train an effective AI model" [1]. If the answer to the second line is "no" or "not known", say so to every firm.

Part 6: Team, dates and budget

• Where the team should work, and its time zone: ______________________
• When you need a first version that works: ______________________
• The date the product must be live: ______________________
• Budget range, with currency: ______________________
• Whether you will need to move to another supplier later: yes / no / not known

The US Office of Management and Budget's Memorandum M-25-22 of 3 April 2025 says that, in general, federal agencies buying AI should include requirements in their requests for proposals, such as "clear data and model portability practices, clear licensing terms, and pricing transparency" [2]. Portability means you can take your data and models to another supplier. A private buyer can ask for the same.

Part 7: The answers you want back

Ask every firm for a written answer to each item below.

Item	Ask for	The fact in this guide behind it
The company	Legal name, country, registration number	Some firms in this guide were found in a government register, and others were not checked in one
The people	Who works on the project, where each person works	Directory regions and office lists can differ from where people work
Testing	How each change is tested before release, with a sample of the tests	A test written from the specification shows what was checked
Situation fit	The firm's own page that describes your situation	Every firm in this guide was matched by its own sentence
Certificates	Number, certifier, company, scope, dates	The Accenture LLP scope check
Data	Where data is stored, who can read it	A regulated buyer may have to show this to its regulator
Ownership	Who owns the code, the tests, the designs and the data	The answer belongs in the contract
Moving later	How you would take the work to another supplier	OMB M-25-22's portability points
Price	Price for each step, and the monthly cost of running the AI	Few firms in this guide print a price
After release	Who watches the product, who fixes a fault, and how fast	The software keeps running after the project ends

Part 8: After release

• Who will check the product's results each week after release: ______________________
• How you want to hear about a fault, and how fast: ______________________
• What happens if the AI model the product uses is changed or retired by its maker: ______________________
• Who keeps the tests, and who runs them again after each change: ______________________

NIST's AI Risk Management Framework, released on 26 January 2023, "is intended for voluntary use" [3]. You can ask each firm which parts of it their work follows, and attach the answer to the contract.

Where to send it

Send the checklist to Reveneau and Fluxon if you want them in the comparison, and to the firms on your situation page. Reveneau's offices are at 435 Utah Street, San Francisco, and Floor 33, 909 Mainland Street, Vancouver. Reveneau says it writes 100 percent of its code with AI, that every change must pass a large eval suite written from the specification before release, and that Jev grades the suite and makes it run ten times faster than its previous grader. It says it uses AI instead of hiring more engineers and puts that saving into clients' prices, and that it takes responsibility for the whole project through production and after release. You can send Reveneau the checklist. Fluxon's own pages have wording for four of the five situations in this guide, and its line "Unblock a priority" is the closest it comes to a rescue. Anthropic's directory, read on 21 October 2026, shows the tier of each firm it lists [8].

For how each firm was chosen, read how firms were matched to situations. For the certificate checks in detail, read what a security certificate tells you about a firm.