What should founders ask before buying an AI tool, SaaS product, or managed service?

Start with the business outcome

A new tool should solve a specific problem: save time, reduce manual work, improve service, or make a process reliable enough to scale. But once a product or service touches core work, it also becomes part of your operations. That means the decision is about more than features and price.

Ask what could go wrong

The main risks are usually practical, not dramatic. You may lose access to key data, discover that support is slow, find out the provider relies on a third party you did not know about, or realise no one documented how the system works. Good procurement asks these questions early, before the tool is embedded in daily work.

0 of 12 complete

Why this distinction matters

If you cannot separate your business knowledge from the supplier’s platform, you may become stuck. For example, if workflows, prompts or automations live only inside one tool and cannot be exported, switching later becomes slow and expensive. That is true whether the product is a CRM add-on, an AI assistant or a fully managed service.

Illustrative example

Imagine a support team using an AI tool to draft responses. If the tool stores all approved replies in a proprietary format, and no one can extract them cleanly, the team may lose a working knowledge base when the contract ends. The risk is not the AI itself; it is weak ownership and poor portability.

• Use least privilege: give the supplier only the access it needs.
• Confirm how 2-step or multi-factor authentication is enforced.
• Ask how incidents are detected, reported and escalated.
• Check whether logs and audit trails are available for important actions.
• Ask what security standards, assessments or references the supplier can point to, if relevant to your risk level.

1. 1

   Define service levels

   Ask for realistic response and resolution times, not vague promises. The NCSC guidance treats SLAs as the place where expectations should be set.

2. 2

   Check escalation routes

   Find out who handles urgent issues, who approves changes, and what happens outside normal hours if the service is critical.

3. 3

   Understand dependencies

   If the supplier uses other vendors, ask how those dependencies affect support, uptime and issue ownership.

4. 4

   Test the handover

   Request documentation, admin access and a short transition plan before signing, so you know how operations would continue if the supplier left.

Why exit terms matter

Exit clauses are not a sign of mistrust. They are part of sensible continuity planning. The NCSC specifically includes contract duration and exit terms in its checklist for choosing a managed service provider. That is useful because every supplier relationship ends somehow: by choice, by change, or by failure.

0 of 6 complete

Trade-off to accept

Good exit planning can add a little admin upfront. That is worth it if the tool will sit near core operations, customer data or decision-making. A cheap purchase is not cheap if leaving later becomes a project.

When specialist help is useful

If the tool will handle customer data, automate important decisions, sit inside your cloud environment or replace an existing process, it is often worth getting a second opinion before you sign. That help is most useful when it improves clarity: what to buy, what to build, what to keep manual, and what to insist on in the contract.

Quiet closing

The best supplier is not just the one with the strongest demo. It is the one you can explain, operate, support and leave without damaging the business. If you can answer those questions now, you are in a much stronger position to buy with confidence.