How To Vet An AI Vendor: Test Their Claims Before You Sign

To vet an AI vendor, turn every claim in the pitch into something you can check. Ask for written evidence, run the product on your own real cases, confirm security reports and references yourself, and put the claims you rely on into the contract. A demo and a slide deck are the weakest kind of evidence.

Vendor claims about AI are not always reliable, and regulators have started to say so. In April 2025 the US Federal Trade Commission (FTC) alleged that a company had advertised its AI content detector as 98 percent accurate when independent testing found 53 percent on general-purpose content (FTC (opens in a new tab)). In January 2025 the US Securities and Exchange Commission (SEC) found that a restaurant-technology company had described its AI as removing the need for human order-taking, while the vast majority of orders on its own AI version needed a person to step in (SEC (opens in a new tab)). In June 2025, Gartner estimated that only about 130 of the thousands of vendors selling "agentic AI" were real (Gartner (opens in a new tab)).

This guide shows how to vet an AI vendor claim by claim. It explains what counts as evidence, seven claims that deserve a check, how to test a product on your own data, what to do with the result, a worked example and the contract wording that protects you. It is written for owners and managers of businesses with roughly 10 to 500 people who already have a shortlist and want to buy something that works. If you are still comparing options, start with our guide to AI vendor selection; this guide picks up where that one ends.

What Does It Mean To Vet An AI Vendor?

Vetting an AI vendor means checking that the claims a vendor makes about its product, security, customers and results are true before you commit money or data. It is due diligence on what the vendor says, done with evidence you can verify yourself. It applies whether you are buying a ready-made tool, a platform or a custom build.

Vetting an AI vendor is easy to confuse with two nearby steps. Selecting narrows the field, and a proof of concept tests the product in depth. Vetting sits between them.

A full AI proof of concept is the deepest version of the test in this guide. What follows is a lighter version you can run on each shortlisted vendor, so that you only spend time on a full proof of concept with vendors whose claims have survived the first round.

Why AI Vendor Claims Need Checking

Many vendors describe their products fairly. But AI is sold in marketing language, which is why vetting an AI vendor means checking claims rather than trusting them. Regulators, researchers and analysts have examined several well-known claims and found gaps between what was said and what was measured. Table 2 shows six examples.

Three lessons stand out. First, accuracy numbers depend on what was tested. A figure measured on one kind of text, or on easy examples, says little about your work. Second, the label "AI" can hide older technology or people doing the work behind the scenes. Third, big names are not exempt: the legal research tools in the Stanford study came from large, established publishers.

Some of these cases ended in settlements where the company neither admitted nor denied the findings, and the FTC's statements about the "robot lawyer" and the content detector are allegations, not rulings. They are examples of where claims tend to fail, not a picture of the whole market. Enforcement also happens after products are sold, so it is no substitute for checking before you buy.

What Counts As Evidence When You Vet An AI Vendor

Not every answer from a vendor is worth the same when you vet an AI vendor. Figure 2 ranks six kinds of evidence from strongest to weakest. The ranking is Fossilite's working framework, not an official standard.

The top rung is the only one you control. You choose the cases and you score the results, so the vendor cannot shape them. The second rung is a third party's report, such as a security audit. It is valuable only if you read what it covers and when. The third rung is a named customer you contact yourself, rather than one the vendor puts on a call with you.

The fourth rung is the vendor's own written method, which is better than a promise because it can be checked and quoted back later. The bottom two rungs are what most pitches are made of. Case studies are chosen by the vendor, and a demo runs on the vendor's examples under the vendor's control.

Match the effort to the stakes. A claim your business case depends on, such as accuracy or how your data is handled, should reach the top two rungs. A claim about a minor feature can rest on written documentation.

Seven Claims To Check Before You Sign

These seven claims appear in almost every AI pitch you will meet when you vet an AI vendor. For each one, the sections below say what to ask, how to check the answer and what a warning sign looks like. A one-page version appears in the checklist later in this guide.

1. "Our AI Is 95% Accurate"

An accuracy figure means little until you know what was measured. Ninety-five percent of what: documents, fields, answers or characters? On whose data, and scored by whom? The FTC's Workado case shows how far a headline number can drift from real use. The company advertised 98 percent accuracy, and the FTC alleged that independent testing found 53 percent on general-purpose content. It also alleged the underlying model had been trained to classify only academic writing (FTC (opens in a new tab)). The FTC approved a final order in August 2025 requiring the company to hold competent and reliable evidence for such claims (FTC (opens in a new tab)).

What to ask. How the figure was measured, on how many examples, whether those examples look like your work, who scored them and how errors were counted. Ask what happens when the AI is unsure, and what its most expensive mistake looks like.

How to check it. Run the product on your own cases, as described in the testing section below. Accuracy alone can also mislead, because a tool can score well overall and still fail on the cases that matter most; our guide to evaluating machine learning models explains why.

Be especially careful with claims that a product is "hallucination-free". A hallucination is a confident answer that is false. In the Stanford study, legal research tools that their makers described as avoiding or nearly eliminating hallucinations hallucinated between 17% and 33% of the time in the researchers' tests (Stanford (opens in a new tab)). Many of these tools use retrieval-augmented generation (RAG), where the AI looks up documents before answering. Our guide to shipping RAG that doesn't hallucinate explains why such systems still need testing on real questions.

Warning sign. One number with no method, or a vendor who cannot say what was tested.

2. "It Is Powered By AI" Or "It Is An AI Agent"

AI washing means describing a product as more intelligent or more automated than it is. It can mean a rules-based tool relabelled as AI, or a product that relies on people behind the scenes. Gartner uses the term "agent washing" for vendors relabelling AI assistants, robotic process automation (RPA, software that follows fixed rules to repeat tasks) and chatbots as agentic AI, and estimated about 130 of the thousands of agentic AI vendors are real (Gartner (opens in a new tab)).

The enforcement cases show both versions. The SEC found that Presto Automation described its AI as removing the need for human order-taking while the vast majority of orders on its own AI version needed human intervention (SEC (opens in a new tab)). It also found that an investment adviser, Delphia, said it used AI and machine learning with client data when it lacked those capabilities (SEC (opens in a new tab)). Both companies settled without admitting or denying the findings.

What to ask. Which parts of the product are AI models, which are fixed rules and which are people? Which model or models does it use, and who runs them? What share of tasks finish with no human touch, how is that measured and over what period? What does the reviewing person see, and how often do they change the AI's answer?

People reviewing AI output is not a flaw. Many good systems keep a person in the loop, and our guide to human-in-the-loop design explains where review belongs. The problem is when the human work is hidden, or the price assumes it does not exist. If the product is sold as an agent that takes actions on its own, ask what it can do without approval; our guide to AI agent guardrails lists the controls to expect.

How to check it. In your test, record how many cases the tool finished without help and how much checking your staff still had to do.

Warning sign. "Proprietary AI" with no explanation of which tasks are automatic.

3. "It Integrates With Your Systems"

"Integrates" can mean anything from a tested two-way connection to a file that someone has to export and upload by hand. Both are legitimate, but they cost very different amounts of time.

What to ask. Which versions of your systems does it connect to? Does data flow one way or both ways? Who builds and maintains the connection, and what happens when it breaks? Is the connection included in the price or quoted separately? Our guide to AI agent cost lists the integration and maintenance costs that quotes often leave out.

How to check it. Watch the connection run against a test copy of your own system, not the vendor's demo account. If your data sits in scattered files or older systems, an AI readiness assessment shows what needs fixing before any tool can work well.

Warning sign. Integration shown only as logos on a slide, and no named owner for maintaining it.

4. "Your Data Is Safe"

Data safety claims need two kinds of checking: what the vendor does with your data, and what independent proof exists that it does it.

What to ask. Is your data used to train the vendor's models or anyone else's? How long is it kept, and how is it deleted? Which other companies handle it (these are called subprocessors), and where is it stored?

How to check it. Ask for the vendor's SOC 2 report. SOC 2 is an audit of a company's security controls by an outside accountant. A Type I report checks that the controls are designed properly at a single point in time. A Type II report also tests that they worked over a period, which usually runs from three to twelve months (A-LIGN (opens in a new tab)). Ask for Type II, read the period it covers and check that the product you are buying is inside its scope.

You may also see ISO/IEC 42001, a standard published in December 2023 that sets requirements for an AI management system, meaning the policies and processes an organization uses to run its AI work (ISO (opens in a new tab)). In plain terms, it covers how a company manages AI. It is not a test of how well any one product performs. Ask for the certificate and its scope statement.

Put the answers into a data processing agreement, the contract that sets out how the vendor handles your data, and have a lawyer review it.

Warning sign. A security page full of badges and no report, or a report that is out of date or covers only the hosting provider.

5. "Customers Like You Use It"

Logos on a website show that someone signed up at some point. They do not show that the product works in daily use.

What to ask. Two or three references of similar size and use case, live for several months. Speak to them yourself, without the vendor on the call. Ask what they expected and what they got, how long it took to work in daily use, what went wrong, how the vendor responded, what it really cost and whether they would buy it again.

Ask to see a real production system, one that is live and in daily use, rather than a demo. SensViz, an AI development company, makes a similar point in its guide on choosing between an LLM development company and a generic AI vendor (opens in a new tab), recommending a live system and what the team learned after launch. If confidentiality limits what a vendor can show, an anonymized walkthrough or a reference the customer has approved can stand in.

Warning sign. References who are all new customers, who are friends of the vendor, or who the vendor insists on joining on the call.

6. "You Will Save 60%"

Savings claims come from other companies' situations, which is why AI ROI (return on investment) measurement has to start from your own numbers. A figure earned in a business with a slow manual process may not apply to yours.

What to ask. What was the baseline before the product was used, how was it measured, over what period and for how many customers? Did the saving include setup cost, subscription fees and the time people spend checking the AI's work?

How to check it. Work out your own numbers. Measure how long the task takes today, how often it goes wrong and what each error costs, then subtract the time your staff will spend reviewing output. Step 1 of our guide to an AI proof of concept shows how to build that baseline.

Warning sign. A saving quoted as "up to" with no baseline, or one that counts the time saved but not the time spent checking.

7. "We Will Support It And Keep It Working"

AI products change after you buy them. A vendor may switch the underlying model, change prices or retire a feature, and any of these can change how the product behaves on your work. The UK government's AI procurement guidelines note that testing a model on an ongoing basis is necessary to maintain its accuracy (GOV.UK (opens in a new tab)).

What to ask. What does onboarding involve, and how much of it is your staff's time? How much notice will you get before the model or features change? Will the vendor share change notes, and can you re-run your test cases afterwards? What are the support response times, and what does the vendor owe you if it misses them? Is usage-based pricing capped? How do you export your data and leave? Our AI vendor selection guide covers what belongs in an exit plan.

Warning sign. No commitment to tell you about changes, and no way to export your data.

How To Test An AI Vendor On Your Own Data

This is the step in vetting an AI vendor that no sales material can replace, and it is the most reliable way to evaluate software vendors with AI features, because it uses your cases rather than theirs. It is a smaller version of the test in our AI proof of concept guide, built to be run on each shortlisted vendor in a short time.

1. 1

   Measure today's process first. Count the cases, the time each takes and how often mistakes happen. Without this you cannot tell whether the tool is better than what you do now.

2. 2

   Collect at least 50 real cases, and ideally closer to 100, with the right answer recorded. Include typical cases, awkward ones and unusual ones. OpenAI's guidance says test data should include typical, edge and adversarial cases (OpenAI (opens in a new tab)). Remove personal details unless the contract covers them.

3. 3

   Write the pass mark and the stop line before you see results. Anthropic's guidance says good success criteria are specific and measurable, and that most use cases need several of them (Anthropic (opens in a new tab)). Set targets for quality, serious errors, speed, cost per case and how much checking staff still do. The stop line is the result below which you walk away, for example under 85% on a key measure.

4. 4

   Keep half the cases hidden. Let the vendor see the first half and adjust the product to it. Run the hidden half yourself, or watch the vendor run it live, so the result is not tuned to the test.

5. 5

   Score it yourself, with your own definition of "correct". Use the same definition the vendor's claim uses, so the two numbers can be compared. Also record what the tool does when it is unsure.

6. 6

   Repeat a sample on another day. Generative AI, meaning AI that writes or produces answers, can give different answers to the same input. Re-run about 20 cases to see whether the results hold.

Even a hidden half of 25 to 50 cases will not give a precise percentage, but it is usually enough to show a claim that is badly off, such as 98% against 70%. OpenAI's guidance warns against "vibe-based evals", meaning judging by the impression that something seems to work, and that is what a demo invites (OpenAI (opens in a new tab)).

If a vendor will not let you test on your own cases, treat that as an answer. Offer a short paid pilot with written criteria instead. If that is also refused, move to the next vendor on your list.

What To Do With The Results

Compare the test with the vendor's claims and with the pass mark you set. Three outcomes are common, and Figure 3 sets out what each means.

When the claims hold, the next step is a limited pilot in real work. Our plan for moving from AI demo to production in six weeks shows how to run one with clear gates. When the claims partly hold, the most useful move is to narrow the scope to what works and write the measured numbers into the contract. When they do not hold, or the vendor will not let you check, walking away usually costs less than discovering the gap after you have signed.

A Worked Example: Vetting A Document-Reading AI Tool (Illustrative)

This example is hypothetical. The business, figures and results are invented to show the method, not taken from a Fossilite client.

A 45-person accounting firm handles about 800 client documents a month, mostly bank statements and phone photos of receipts. Staff type the figures into the firm's accounting software, which takes about four minutes per document. A spot check of 200 entries last month found mistakes in about 3% of fields. The firm is about to vet an AI vendor whose tool reads the documents and fills in the fields. The vendor has made four claims: 99% accuracy, SOC 2 compliance, a direct connection to the firm's accounting software, and a 70% cut in data entry time.

Before the next call, the office manager writes the four claims down and asks the vendor for the evidence behind each. She then builds a test set of 120 real documents with personal details removed: 80 digital statements and 40 phone photos of receipts. A senior bookkeeper records the correct figures for each. She sets the marks in advance and applies them to the tool's output before anyone corrects it. The pass mark is 97% of fields correct on statements, matching staff, and 90% on photos. The stop line, below which the firm walks away from that part of the work, is 90% on statements and 80% on photos. Half the set is kept hidden from the vendor.

The reference calls added one more finding. Two of the vendor's three references had been live for under two months. The third, live for over a year, used the tool only for digital statements.

The statement result is just under the pass mark but above the stop line, so it is worth a narrower trial. The photo result is far below the stop line. The firm does not walk away, and it does not sign the standard contract. It offers a 60-day paid pilot limited to digital statements, with a written pass mark of 97% of fields correct after review. Phone photos stay out of scope until the vendor reaches 90% on a fresh hidden set. The contract also gives the firm the right to leave if no Type II report is delivered by the end of the pilot, bars training on the firm's data and requires deletion within 30 days of exit. The vendor agrees.

Without the test, the firm would have bought a 99% claim and received about 88%. With it, the firm buys a narrower product whose limits are written down.

What To Put In The Contract

Evidence from vetting an AI vendor is only useful if it ends up in the agreement. The points below are a starting list to raise with your lawyer. They are not legal advice.

• The claims in writing. Attach the vendor's written answers and performance statements as a schedule, so the claims you relied on become part of the agreement.

• An acceptance test and pass mark. State the test cases, the score needed and what happens if the product misses it, such as fixes within a set period, a refund or the right to leave.

• Data terms. No training on your data unless you agree, limits on how long it is kept, deletion on request and on exit, and a list of approved subprocessors.

• Change notice. Advance warning of changes to the underlying model, features or pricing, and the right to re-run your tests afterwards.

• Support commitments. Response times, and what the vendor owes you when it misses them.

• Price protection. Caps on usage-based price rises and a clear statement of what is included.

• Exit. Export of your data and settings in a usable format, and help moving to another product.

The UK government's AI procurement guidelines point the same way. They list defining acceptable model performance among the practices suppliers should demonstrate, and say testing a model on an ongoing basis is necessary to maintain its accuracy (GOV.UK (opens in a new tab)).

AI Vendor Vetting Checklist

This AI vendor vetting checklist turns the seven claims into a one-page form you can fill in for each vendor on your shortlist.

AI Vendor Red Flags

One red flag is a question to ask. Several together are a reason to walk away. These are the ones that matter most when you vet an AI vendor:

• One accuracy figure with no method. The number comes without a description of the data, the scoring or who did it.

• "Proprietary AI" and nothing more. The vendor cannot say which tasks use AI models, which use rules and which use people.

• No test on your cases. The vendor refuses, or only offers its own examples.

• Security proof that does not fit. The report is missing, out of date or covers only the hosting provider.

• Thin references. All are new customers, or the vendor insists on joining the call.

• Savings with no baseline. The figure has no period, no starting point and no mention of review time.

• Pressure and lock-in. You are pushed to sign or share data before terms are agreed, or there is no way to export your data.

How Fossilite Approaches Vendor Vetting

We build custom AI and software ourselves, so we are also a vendor. Treat this guide as you would any vendor's advice, and run the same checks on us. Our approach to vetting an AI vendor is to start with the workflow and what the work costs today, check whether an existing tool already does the job, and test any shortlisted product on the business's own cases before recommending it. We suggest custom software or AI only where it is justified.

When To Get Outside Help

Outside help with vetting an AI vendor is worth considering when the purchase is large, the data is sensitive, or the claims are technical enough that you cannot judge them yourself. It also helps when nobody on your team has time to build a test set and score it. Choose someone who earns no commission from the vendor, and ask them the same evidence questions. Our guide to choosing an AI consulting partner explains how.

Frequently Asked Questions

These are the questions business owners ask most often when they vet an AI vendor. Each answer stands on its own.

How Do You Vet An AI Vendor?

To vet an AI vendor, list every claim in the pitch, ask for written evidence and check it. Read security reports and what they cover, call customers yourself, test the product on your own cases with part of the test kept hidden, and put the claims you rely on into the contract. Decide your pass mark before testing.

What Is AI Vendor Due Diligence?

AI vendor due diligence is the process of checking a vendor's claims, security, customers and contract terms before you buy. It covers what the product does, how it handles your data, who else uses it and what happens if you leave. Vetting focuses on testing whether the claims are true, while due diligence also includes legal and financial review.

What Are The Biggest AI Vendor Red Flags?

The biggest AI vendor red flags are one accuracy figure with no method, refusal to test on your cases, vague answers about what is AI and what is manual work, a missing or outdated security report, references limited to new customers, savings claims without a baseline, and no way to export your data. Several together mean you should walk away.

How Can I Tell If A Vendor Is AI Washing?

AI washing means describing a product as more intelligent or automated than it is. To spot it, ask which parts use AI models, which use fixed rules and which rely on people, and what share of tasks finish with no human touch. Then measure that share on your own cases rather than accepting the vendor's figure.

Is A SOC 2 Report Enough To Trust An AI Vendor?

No. A SOC 2 report covers a company's security controls, not how accurate its AI is. Ask for a Type II report, which tests controls over a period, and check its dates and scope, including whether the product you are buying is covered. Then test accuracy, data handling and support terms separately.

How Long Does It Take To Vet An AI Vendor?

There is no standard timeline. As a rough planning range, a focused check of one shortlisted vendor, including a test on 50 to 100 of your own cases and reference calls, can take a few weeks. Security review and contract negotiation can add more, so start the security paperwork while testing runs.

What If A Vendor Will Not Let Me Test On My Own Data?

Treat the refusal as information. Offer a short paid pilot with written success criteria and a stop line, using data you are allowed to share with personal details removed. If the vendor still refuses any test on your cases, its claims cannot be checked, so move to the next vendor on your shortlist.

If you are still comparing vendors, our guide to AI vendor selection is the next read. If you are ready for a fuller test, our guide to an AI proof of concept covers it step by step.