The short answer
Choose the partner that asks about your work before it mentions a product. A good AI partner can connect AI to the systems you actually run, secure it, test it against your own examples and support it after launch. It tells you plainly where your data will go, who owns what it builds and what it will cost to run, and it is willing to say when AI is not the answer.
If a firm cannot show you a testing plan, or talks about "AI transformation" without naming a single use case and how it will be measured, keep looking.
What to look for
| Criterion | What good looks like |
|---|---|
| Starts with your problems | Asks about tasks, volumes, errors and owners before naming any tool |
| Vendor-neutral | Compares Microsoft 365 Copilot, cloud AI services and open-weight models you can host yourself, explains the trade-offs and discloses any commercial interest |
| Works with your real systems | Has connected AI to ERPs, Microsoft 365 and CRMs through supported APIs, respecting each user's permissions |
| Security competence | Designs against prompt injection, sensitive data disclosure and excessive agency, risks named in OWASP's Top 10 for LLM applications (OWASP) |
| Evaluation and testing | Builds a test set from your real examples and agrees accuracy thresholds before building |
| Governance and privacy | Knows how state privacy laws, sector laws such as HIPAA and new state AI laws apply, and works alongside your legal advisers |
| Support after launch | Monitors accuracy and cost, re-tests after model changes, and works under a service agreement |
| Honesty about fit | Recommends a simple rule, a report or no change when that solves the problem better |
| Clear scope and costs | A written, phased scope with one-time and ongoing costs separated, in US dollars (USD) |
| Ownership | Code, prompts, configuration, test sets and data are yours, in accounts you control |
On governance, ask for specifics. The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), for example, has applied since January 1, 2026 to organizations that do business in Texas, and Colorado and California have rules on automated decisions about people that apply from January 1, 2027. If the work touches protected health information, the AI vendor needs a HIPAA business associate agreement (see AI and HIPAA). Voluntary frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 give a partner a structured way to manage AI risk; a good one can explain how it uses them without claiming to certify you. This is general information, not legal advice.
On cost, our guide to what an AI project costs shows what a complete proposal should separate.
Red flags
- Guarantees with no testing behind them. Nobody can promise accuracy or savings before testing on your data.
- Vague "AI transformation". A program with no named use case, owner or measure is a cost, not a plan.
- No testing plan. If they cannot say how accuracy will be measured and what it must pass, you will find out in production.
- Demo-only. An impressive demo on sample data says little about your documents, permissions or systems.
- Proprietary lock-in. Your prompts, configuration and data live in their platform, with no export and no handover.
- No answer to "where does our data go?" The right answer is specific and depends on configuration. Microsoft, for example, documents that prompts sent to the models it sells through Azure are not used to train foundation models without your permission, but that "Global" deployment types may process prompts in any geography where the model is deployed (Microsoft Learn). A partner should know which applies to you.
- One answer for every problem. If every use case leads to the same product, ask why.
Questions to ask a prospective partner
- Which problem would you solve first, and how would we measure success?
- Which platforms would you consider, and do you earn anything from recommending one?
- How will it connect to our ERP, Microsoft 365 and CRM, and with whose permissions?
- Where will our data be processed and stored, and is any of it used to train models?
- If our data cannot leave our environment, can you deploy and run an open-weight model on servers we control?
- How will you test accuracy, and what must it pass before launch?
- How do you test for prompt injection and data leakage?
- What happens if the proof of concept misses its thresholds?
- Which costs are one-time, which are ongoing, and which are metered by usage?
- Who owns the code, prompts, configuration and test sets?
- Who supports it after launch, and on what terms?
- When did you last advise against using AI, and why?
Three objections, answered honestly
"We are too small for an AI consultant." Scale the project, not the discipline. A smaller organization usually needs one contained use case, a short policy and the right licenses, not a strategy program. A focused assessment or a single proof of concept is proportionate, and it stops you paying for tools nobody uses.
"Can't we just use ChatGPT?" For drafting, summarizing and learning, a business-grade general assistant under a clear policy is a sensible start, and we often recommend one. It does not know your systems, apply your permissions or update your ERP, and consumer accounts can have different data terms from business plans. Our comparison of Copilot, ChatGPT and Gemini and our AI acceptable use policy guide cover that route.
"AI moves too fast to plan." Models change quickly; your problems, data, permissions and controls do not. Plan around the use case and its test set rather than a particular model, design so the model can be swapped and re-tested, and work in short phases with decision points. That is how you keep up without starting over.
Rather talk it through? If you are comparing AI partners, bring your use case and the questions above, and we will show you exactly how we would scope, test and support it. Talk to a Promatics specialist
What working with Promatics on AI looks like
- Assessment. We review your work, data, systems, permissions and current AI use, and score candidate use cases on value, readiness, risk and cost. You own the roadmap.
- Proof of concept. We test the strongest use case on your own data, handled safely, against thresholds agreed in advance, then give you a go or no-go recommendation with a production cost estimate. See how we approach a proof of concept.
- Build. We integrate the solution with Microsoft 365, Prometheus and ERPNext or your CRM, apply permissions and logging, design approval points and test security before launch.
- Launch. We train the people who use it, roll it out in stages and monitor accuracy, adoption and running costs.
- Managed support. Monitoring, re-testing and improvements under a service agreement, with response targets set in writing. Managed-service clients get 24/7 monitoring and support.
Why this matters: AI projects rarely fail because of the model. They fail on permissions, messy data, missing integrations, weak security and nobody owning the system after launch. We already handle those every day as a managed IT, cybersecurity and business systems partner. With one accountable partner for your IT, security, ERP and AI, there is no gap between the firm that built the assistant and the firm that runs the systems it depends on.
When to bring in help
If you are trying Copilot Chat or AI features built into software you already use, on non-sensitive work, with a policy in place, you may not need a partner yet. Bring one in when AI will touch personal information, money or decisions about people; when it must connect to core systems; when a board, funder, regulator or agency client wants evidence of control; or when you lack in-house skills for evaluation and security testing.
Our AI strategy and readiness service is the usual starting point, and AI governance and security covers policy, risk assessment and testing.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- AI Risk Management Framework, National Institute of Standards and Technology (NIST)
- Top 10 risks and mitigations for LLMs and generative AI apps, OWASP Gen AI Security Project
- Data, privacy, and security for Foundry Models sold by Azure in Microsoft Foundry, Microsoft Learn
- Texas Responsible Artificial Intelligence Governance Act (HB 149), bill history, Texas Legislature Online
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.