AI Consulting for Companies

Red flags when hiring an AI consultant

The warning signs are rarely dramatic. They sit in the wording of a result, the scope of a pilot and the clauses about who owns what. This is what to check before signing.

By The editors · Updated · 4 min read

A procurement manager in a grey wool jacket marks clauses on a printed contract with a pen, a second proposal, reading glasses and a calculator beside it.
Most of the risk in an AI engagement is written into the contract before any work begins.
Contents
  1. Why diligence matters more with AI
  2. Nine warning signs
  3. The clauses that protect a company
  4. A diligence checklist in order
  5. Questions buyers ask
  6. Sources

No firm in our main guide shows every warning sign below, and several show none. The point of the list is to read every proposal, including the most polished, with the same questions.

Why diligence matters more with AI

AI projects fail often enough that a buyer's caution is justified. S&P Global reported in 2025 that 42% of companies had abandoned most of their AI initiatives, up from 17% a year earlier⁠1. Regulators have also taken an interest in overstated claims. In September 2024 the US Federal Trade Commission announced Operation AI Comply, with its chair stating that there is no AI exemption from existing law. One of the cases involved DoNotPay, which the FTC said marketed an AI service as a substitute for a lawyer without evidence, and which agreed to pay $193,000⁠2.

Nine warning signs

In the evidence

  1. Results without a client. Many firms publish outcomes for an unnamed "global manufacturer" or "Fortune 500 company". Fractal's home page, for example, describes most of its client results this way⁠3. It is not proof of anything wrong, but it cannot be checked. Ask for a reference you can call.
  2. Targets presented as results. When Deloitte launched Zora AI in March 2025, the figures it gave for its own finance team, 25% lower costs and 40% higher productivity, were targets⁠4. Deloitte labelled them as such. Not every proposal does, so check the tense.
  3. "Compliant" read as "certified". LeewayHertz says it is SOC 2 Type II certified and that it complies with ISO/IEC 42001 and 27001⁠5. The two words mean different things. Ask for the certificate where certification matters to you.

In the scope

  1. A pilot with no route to production. The average company in S&P Global's survey scrapped 46% of its proofs of concept⁠1. A pilot proposal should state what happens if it succeeds: the integration work, the cost and who runs it.
  2. No baseline. A result cannot be measured without a starting point taken before the work begins.
  3. Generic tools that do not touch the workflow. MIT's 2025 study attributed most failed pilots to tools that do not learn from or adapt to how the company works⁠6. A proposal that never names the systems and records the AI will work on deserves a second look.

In the contract

  1. Unclear ownership. The contract should say who owns the data, the code, prompts, configurations and documentation, and what is handed over if the relationship ends. OpenLazarus, for instance, states that its clients own the data lake it builds and that it trains their IT teams to maintain the build⁠7.
  2. Lock-in to one model. If the system can run on only one AI model, the company carries that vendor's pricing risk. Thoughtworks lists reducing vendor dependency and controlling token costs as strategy goals⁠8. OpenLazarus claims that relying on one model can leave token costs 20 to 95% higher; that is the firm's own figure⁠7.
  3. No limits on what the AI may do. A proposal should define which actions run automatically and which wait for a person, and that every action is logged. NIST's AI Risk Management Framework gives a voluntary structure for this, in four functions: govern, map, measure and manage⁠9.

The clauses that protect a company

Before signing, make sure the contract states

  • The scope, deliverables and cost cap of the first phase.
  • The metric, the baseline and the method of measurement.
  • Who owns data, code, prompts, configurations and documentation.
  • Which models the system can use, and the cost of switching.
  • Approval limits and logging for actions the AI takes.
  • Who operates the system after launch, and the monthly cost.
  • The handover process if either side ends the engagement.

A diligence checklist in order

  1. Read the evidence first. Separate named, measured results from unnamed ones and from targets.
  2. Call one reference per shortlisted firm and ask what changed, how it was measured and who runs it today.
  3. Redline the scope until the first phase has a baseline, a measure and a defined next step.
  4. Redline ownership and exit until both are explicit.
  5. Agree the governance rules for what the AI may do before the build starts.

A company that has done this signs a contract it can enforce, with a first phase that will produce a clear yes or no. To compare the firms themselves, see the main guide, and for how to build a shortlist, how to choose an AI consulting firm.

Questions buyers ask

How can I tell if an AI consultant is legitimate?

Ask for a named client you can call, a written scope for the first phase with a measured outcome, and the names of the people who will do the work. A firm that cannot provide any of the three is hard to hold to account, however strong its marketing.

What should an AI consulting contract include?

A fixed scope and cost cap for the first phase, the metric and baseline that define success, ownership of data, code and configuration, approval limits on what the AI may do, an exit and handover clause, and who operates the system after launch.

Are guaranteed AI results a red flag?

A guarantee is only as good as its definition. Treat any promised percentage as a target until the contract states how it will be measured, from which baseline and what happens if it is missed. US regulators have acted against companies that made unsupported AI claims.

Sources

  1. AI project failure rates are on the rise: report. CIO Dive, 14 Mar 2025. Accessed 8 Nov 2026.
  2. FTC announces crackdown on deceptive AI claims and schemes. US Federal Trade Commission, 25 Sep 2024. Accessed 8 Nov 2026.
  3. Fractal. Fractal Analytics. Accessed 8 Nov 2026.
  4. Deloitte unveils Zora AI, agentic AI for tomorrow’s workforce. Deloitte, 18 Mar 2025. Accessed 8 Nov 2026.
  5. About us. LeewayHertz. Accessed 8 Nov 2026.
  6. MIT report: 95% of generative AI pilots at companies are failing. Fortune, 18 Aug 2025. Accessed 8 Nov 2026.
  7. AI Architects. OpenLazarus. Accessed 8 Nov 2026.
  8. Enterprise AI services. Thoughtworks. Accessed 8 Nov 2026.
  9. AI Risk Management Framework. NIST. Accessed 8 Nov 2026.

Updated 8 Nov 2026: First published.

Further reading