Vetting AI Vendors: Questions to Ask First
Before signing up any AI tool for your business, a short set of questions about data handling tells you most of what you need to know. If a vendor cannot answer them clearly, treat that as a warning sign, not a technicality.
Reading is great. Tracking makes it stick. Sign up for a free Dashboard to tick off tasks and see your Security Score.
Get my free Dashboard →
Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.
Why data handling matters as much as features
New AI tools for small business appear constantly, promising to save time on everything from customer emails to bookkeeping. Not all of them handle your data responsibly. Business owners often judge an AI tool by its features and price alone, the same way they would judge any other app. Data handling deserves equal weight, since a data breach or GDPR failure can cost far more than the tool itself.
Questions to ask any AI vendor
Five questions that reveal most of what you need to know.
5 steps
How it goes wrong
This is how a data handling gap becomes a real problem months later:
4 steps
How to protect yourself
3 steps
Frequently asked questions
Do I need a data processing agreement for every AI tool?
Only when the tool processes personal data on your behalf. Purely internal tools with no personal data may not need one, but check.
What is a reasonable data retention period for an AI vendor?
No single legal number, but it should be stated clearly and tied to a business purpose, not indefinite by default.
Should I avoid free AI tools for business use entirely?
Not necessarily, but free tiers often have weaker data protections than paid business tiers.
Track your AI safety progress. Free.
Create a free account to tick off tasks, see your Security Score improve, and know exactly what you've done and what's still to do.
Start your free security check