Cost and method

AI development contract checklist

This checklist turns two US government documents and the facts in this guide into questions for an AI development contract. The White House budget office asks federal agencies to test proposed AI systems where they can before they buy, and, in general, to ask for knowledge transfer, data and model portability, clear licences and clear pricing. The NIST AI risk framework asks that test sets and metrics be written down and that organizations have policies for AI risks from outside firms. Print one copy for each firm, ask every firm the same questions, and keep the written answers.

Published October 21, 2026. Editorial.

Key takeaways

  • Ask every firm the same written questions and keep the answers, so they can be compared line by line and attached to the contract.
  • Put testing in the contract: which examples the AI is tested on, how answers are scored, who writes the tests and who keeps them.
  • Ask for the four protections the White House budget office names: knowledge transfer, data and model portability, clear licence terms and clear pricing.
  • Check partner and award claims at the source, and ask where each engineer will work and who owns the firm.

This checklist is for a buyer who has a shortlist of AI development firms and is about to sign with one. It draws on two public documents. The first is Memorandum M-25-22 from the White House Office of Management and Budget, dated 3 April 2025, which tells federal agencies how to buy AI [1]. The second is the AI Risk Management Framework from the National Institute of Standards and Technology (NIST), a US government agency that writes technical standards [2]. The memo was written for federal agencies. NIST says its framework is voluntary and meant for organizations of all sizes in all sectors. Both give a private buyer useful questions.

Print one copy for each firm. Ask every firm the same questions in writing. Keep the answers, and attach the ones that matter to the contract. The examples below come from the firms in this guide, checked on 21 October 2026.

1. Before the first meeting

  • Write the problem in one paragraph, in plain words.
  • List the data the AI will use, where it is kept and who owns it.
  • Collect ten or more real examples of inputs, with the answer you expect for each.
  • Write down where your own team works and in which time zone.
  • Set a budget range and a date for a first working version.
  • Send the same document to every firm on the shortlist.

2. The firm

  • Which company signs the contract, and where is it registered? The legal company can differ from the brand. Accenture plc's annual report, for example, gives its principal executive offices in Dublin, Ireland [16].
  • Who owns the firm? Consulting.us reported in August 2026 that AlixPartners bought Artium [9]. Blend360's own press release says Recognize made a minority investment in it in 2022 [10].
  • Where will each engineer on the project work? Write the answer into the contract. Atomic Object's AI page says it hires only in its four US regions [8]. Cognizant's annual report places 41,600 of its 351,600 staff in North America, a total it marks as approximate [7].
  • What partner claims does the firm make, and do they check out? Search Anthropic's directory at partnerhub.claude.com for any firm that says it is a Claude partner [3]. 8th Light's site menu says "Claude Certified" [13], and Anthropic's directory had no 8th Light entry on 21 October 2026. Blend360's homepage says "Recognized by Anthropic", and the directory shows Blend360 at the Select tier [14].
  • Who gave the firm's awards? A platform company's partner award, such as Databricks' 2024 awards, comes from a company that earns money when its partners sell its product [4].

3. Testing and quality

The NIST framework asks that "Test sets, metrics, and details about the tools used during TEVV are documented" [2]. TEVV stands for test, evaluation, verification and validation: the work of checking that an AI system does what it should. Ask for each item below in writing.

  • Which examples will the AI be tested on, and who writes them?
  • How is each answer scored, and what score counts as passing?
  • Does every change have to pass the tests before it is released?
  • Will you see the test results for each release?
  • Do the tests, the examples and the scoring code come to you with the system?
  • Can your own team run the tests without the firm?

Reveneau, for example, says it writes an eval suite from each client's specification and that every change must pass it before release. Whatever a firm says, write the testing method into the contract and make sure you receive the tests.

4. Ownership and outside risk

The NIST framework asks organizations to have rules for "AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights" [2]. A third party is any outside firm, including the one you hire and the company that makes the AI model.

  • Who owns the code, the tests, the prompts (the written instructions given to the AI model) and the data the firm creates for you?
  • Which AI model does the system use, and under what licence?
  • Which open-source code does the system include, and under which licences?
  • Will your data be used to train any model, for you or for anyone else?
  • Who pays if the system is found to break someone else's rights?

5. Protection against being tied to one firm

Memorandum M-25-22 tells agencies that, in general, their requests for AI proposals should include terms that reduce the risk of being tied to one vendor, "such as requirements regarding knowledge transfer, clear data and model portability practices, clear licensing terms, and pricing transparency" [1].

Protection What it means What to write in the contract
Knowledge transfer The firm teaches your team how the system works Named sessions, written documents and a date by which your team can run the system
Data portability You can take your data out in a usable form The file formats, and how fast the firm must hand the data over
Model portability You can move the system to another AI model or another host Which parts are tied to one model, and what a move would take
Clear licence terms You know what you may do with each part A list of every licence, for the model, the code and any of the firm's own products
Clear pricing You can see what each part costs Each cost on its own line, now and after launch

6. The firm's own products

Some firms sell AI products of their own beside their services. In this guide, Fractal names Cogentiq and LLM Studio [11], and Quantiphi names baioniq, Codeaira and Dociphi [12].

  • Will the system depend on one of the firm's own products?
  • What does that product cost each year, and who sets the price after the first year?
  • If you stop paying for the product, what happens to the system and to your data?
  • Can another firm, or your own team, maintain the system without the product?

7. Price

  • Is the price a fixed fee, agreed in advance, or time and materials, where you pay for the hours worked?
  • For a fixed fee, what exactly is included, and what happens when the scope changes? MojoTech's six-week strategy offer is called fixed-fee on its AI page, with no amount shown [6].
  • For an approximate price, what decides the final figure? Think Company lists a four-week Vision Sprint at "~$50K", and the tilde means the amount is approximate [5].
  • What will the system cost each month after launch: model use, hosting, monitoring and fixes?
  • How will price changes be agreed, and with how much notice?

8. After launch

  • Who watches the system's answers after release, and how often?
  • Who fixes a fault, how fast, and at what cost?
  • Who runs the tests again after a model update?
  • Which parts of the work does the firm take responsibility for, in writing? Reveneau, for example, says it takes responsibility for the whole project through production and after release. Ask each firm to put its own answer in the contract.

9. Leaving

  • What do you receive at the end: code, tests, data, prompts, documents and access?
  • How long will the firm help a new firm, or your own team, take over?
  • Can you end the contract early, and what happens to work in progress?

10. One test before you sign

Memorandum M-25-22 tells agencies that, when they judge proposals, they "must, to the greatest extent practicable, test proposed solutions to understand the capabilities and limitations of any offered AI system or service" [1]. Give two or three firms on your shortlist the same small task on your own data. Pay each for a short time. Compare the work, the test examples each firm used, and how each one explained what went wrong.

A grid for your answers

Print this grid and fill in one column per firm. The first two columns are for Reveneau and Fluxon if they are on your shortlist, and the third is for any other firm.

Question Reveneau Fluxon Other firm
Company that signs, and where registered
Owner or main investor
Where each engineer works
Partner claims checked at the source
How the AI is tested, and who keeps the tests
Who owns code, tests, prompts and data
AI model used, and its licence
Depends on the firm's own product
Price model and what it includes
Monthly cost after launch
Responsibility after release, in writing
What you receive when you leave

Fluxon's enterprise page says, "We build in your stack and follow your standards. What we leave behind should feel like your own." [15] A stack is the set of software tools a company's systems are built on. Ask Fluxon, like every other firm, to show in writing what it would leave with you. To ask Reveneau these questions about your project, use the contact page. The full list and what AI development costs across US cities help you decide whom to ask.

Common questions

What should an AI development contract say about testing?

It should name the examples the AI will be tested on, say who writes them, explain how each answer is scored and what score counts as passing, and require every change to pass before release. It should also say that the tests, the examples and the scoring code come to you, so your own team can run them after the firm leaves.

What does knowledge transfer mean in an AI contract?

Knowledge transfer means the firm teaches your team how the system works, so you are able to run and change it without the firm. In a contract, it should list named training sessions, the documents the firm will write and a date by which your team can run the system. The White House budget office names it as a protection against being tied to one vendor.

What does data and model portability mean?

Data portability means you can take your data out of the system in a usable form. Model portability means you can move the system to a different AI model or a different host. Ask which parts of the system are tied to one model, and what a move would take. The White House budget office asks federal agencies to ask for clear practices on both in their requests for AI proposals.

Should the contract say who keeps the test examples?

Yes. The NIST AI Risk Management Framework asks that test sets, metrics and the tools used to check an AI system be written down. If the examples and scores stay with the firm, your team cannot check later changes or move to another firm easily. Write into the contract that the test examples and scoring code are delivered with the system.

How should a contract handle the risk of breaking someone else's rights?

The NIST framework asks organizations to manage AI risks from outside firms, including the risk of infringing a third party's intellectual property or other rights. In the contract, list the AI model and its licence, the open-source code and its licences, and say whether your data trains any model. Then say who pays if a claim is made against the system.

What should I ask Fractal or Quantiphi about their own AI products?

Fractal names Cogentiq and LLM Studio, and Quantiphi names baioniq, Codeaira and Dociphi. Ask whether your system would depend on one of them, what it costs each year and who sets the price after the first year, and what happens to the system and your data if you stop paying. Then write the answers into the contract.

Should the contract name where each engineer will work?

Yes, if it matters to you. Firms differ: Atomic Object's AI page says it hires only in its four US regions, while Cognizant's annual report places 41,600 of its 351,600 staff in North America. Where engineers work affects their time zone and their wages, so write the locations, or the rule for them, into the contract.

What should a fixed-fee AI contract spell out?

A fixed fee is one price agreed before the work starts. The contract should list exactly what the fee covers, what counts as done, how a change in scope is priced, and what happens if the work runs past the agreed weeks. MojoTech, for example, calls its six-week AI strategy offer fixed-fee and prints no amount, so ask for both in writing.

How should a contract treat an approximate price such as ~$50K?

Ask the firm what decides the final amount and write the range into the contract. Think Company lists a four-week Vision Sprint and a Product UX Audit at "~$50K", and the tilde means approximate. The contract should state the final price or a ceiling, and what happens if the work needs more time than the sprint allows.

Should the contract say which AI model the system uses?

Yes. Name the model, its maker, the licence, who pays for each request and how the system will move to another model if needed. Some firms in this guide have public deals with model makers, such as Accenture and Cognizant with Anthropic, and Booz Allen with OpenAI. Ask any firm to show test results for more than one model on your task.

What should happen to the AI system if the contract ends early?

The contract should say what you receive on the day it ends: the code, the tests, the data, the prompts, the documents and access to every account. It should also say how long the firm will help your team or a new firm take over, and how work in progress is paid for. Agree this before you sign, while both sides want the deal.

What does Reveneau say it is responsible for after release?

Reveneau says it takes responsibility for the whole project through production and after release. By its own account, AI writes 100 percent of its code and every change must pass a large eval suite written from the client's specification before it is released. As with any firm, ask Reveneau to put its answers to this checklist in writing before you sign.

References

Start a project