How to check an AI consultant is legitimate

An hour of checking, ordered by how much each step actually reveals. The first two are worth more than the rest combined.

Ask them to show you something working

Not a recording, not a slide, not a case study. A live thing, and then you drive it.

Type something odd into it. Ask it something outside its scope. Give it the awkward case from your own business. What you are watching for is not whether it handles everything, because nothing does. You are watching what it does when it cannot: does it stop cleanly and hand over, or does it improvise confidently?

Anybody who has shipped this work will offer a demonstration readily. Reluctance, or a demonstration you are not allowed to touch, is the finding.

Ask about a failure, in detail

Covered elsewhere and it belongs at the top of any verification list, because it cannot be faked by someone who has not done the work.

Real practitioners produce specifics: the exception rate nobody anticipated, the field a vendor renamed that broke everything silently, the team that quietly refused to use it. People who have not done it describe a challenge that was overcome.

Check the company exists properly

Boring and quick. Whatever the business register is where they operate, look them up. Confirm the entity exists, how long it has, and that the name on the proposal matches the name on the bank details.

Check they have professional indemnity cover and ask for the certificate. Legitimate firms produce this without fuss.

Look at who works there

Find the individuals, not the company page. Do their histories support the claims being made? Has the person you are meeting done this kind of work, or only sold it?

Then ask the question that catches the commonest substitution: who specifically will be on my project, are they still employed here, and will you put the names in the agreement.

Test the references properly

Ask for a client who will take a phone call, not a written testimonial. Then ask that client the questions that produce real answers: what went wrong, what took longer than expected, would you use them again, what would you do differently.

If no reference is available, that is not automatically disqualifying, particularly for a new firm. It does mean the demonstration in step one has to carry more weight. Judging a track record when NDAs hide the work.

Read what they have written, and check where you found them

Sourcing matters as much as vetting, and search results in this category mostly measure marketing budget. Where the good ones turn up.

Look for specific technical writing about how something was built and what the tradeoffs were. That kind of detail is very hard to produce without having done it.

Discount thought leadership about how AI will transform your sector. Discount certifications from bodies that exist to sell certifications, and partner badges that require a fee and a form.

Ask what the thing is built on

A straight question: which platforms, models, and services does this run on?

Normal firms answer immediately, because there is no shame in assembling existing components and nearly all good work does. Evasion here usually means the fee is a markup on a subscription you could buy yourself. The mechanics of that.

Check they raise data before you do

In any real engagement they will touch your systems and your customer information. The conversation about where data goes, who processes it, what is retained, and whether anybody trains on it should come from them, unprompted, early.

If you have to introduce it, note that. It means either they have not thought about it or they would rather you did not.

The confirmation that costs nothing

Give them a small paid piece of work before the large one.

A diagnostic engagement, a review of a plan you already have, a scoped first automation. You learn more from two weeks of working with somebody than from any amount of verification, and it is a clean stopping point if the answer is no.

Suppliers who resist this and push for a long commitment upfront are managing their revenue rather than your risk.

Applying this to us

We are new, so steps three through five will not tell you much, and that is a real limitation rather than something to argue away.

Which means we should be judged on step one and step two: make us show you a working agent and let you try to break it, and ask us what went wrong on previous builds. Those are the checks that do not depend on how long a company has existed. How the engagement is set up, and the red flags list including the ones that apply to us.