AI development red flags: how to spot a bad vendor before you sign

Evaluating an AI development agency is hard if you don’t have an AI background. The proposals use similar language, the case studies are hard to verify, and the sales pitch from a mediocre agency sounds a lot like the sales pitch from a great one. What follows are specific warning signs that should give you pause, not necessarily deal-breakers individually, but worth taking seriously.

They skip the discovery phase

Any serious AI engagement starts with a period of investigation: understanding your data, your existing systems, your success criteria, and the actual shape of the problem. If an agency sends you a detailed proposal and timeline within a week of your initial brief (especially one with fixed deliverables and a fixed price), they haven’t done that investigation. They’re proposing what they already know how to build, not necessarily what you need.

Legitimate discovery takes two to four weeks and costs something. Agencies that offer it for free are either subsidising your evaluation (which some do, to their credit) or rushing it. Ask what the discovery phase involves. If they look at you blankly, that’s your answer.

Fixed-price guarantees on ML delivery

Software can be delivered at fixed price because software engineering, done well, is predictable. ML work isn’t, and any agency that tells you otherwise either doesn’t understand ML or is telling you what you want to hear.

The reason: you don’t know in advance whether a given approach will work well enough on your data. Maybe the first model architecture gets you to 78% accuracy and the second gets you to 91%. Maybe neither is good enough and you need more training data. These are not planning failures. They’re the nature of the work. A genuinely fixed-price ML contract usually means the agency has heavily constrained what they’ll try, built in a lot of contingency cost, or will renegotiate the moment reality diverges from the proposal.

What to look for instead: milestone-based pricing with defined decision points at each phase, and honest conversations about what triggers a scope change.

Vague answers about accuracy and evaluation

If you ask an agency how they measure model performance and they say “we test it against real-world data,” push harder. Testing against real-world data is not a methodology. It’s a tautology.

What you want to hear about:

• Train/test splits and cross-validation methodology
• The specific metrics they track (precision, recall, F1, AUC-ROC) and why those metrics are appropriate for your problem
• How they handle class imbalance or edge cases
• What the model does when confidence is low

An agency that can’t discuss evaluation methodology in specifics has probably not built many production ML systems. An agency that talks about accuracy without mentioning the test set the accuracy was measured on is giving you a number you can’t trust.

The demo uses their data, not yours

This is one of the oldest tricks in enterprise software sales, not limited to AI but particularly common there. The demo looks great. The model performs cleanly. The interface is polished.

Then you get into implementation and discover the model was trained on a curated dataset that looks nothing like your operational data. Your data is messier, your edge cases are different, your label distribution is different, and the accuracy numbers from the demo don’t generalise.

Before you’re impressed by a demo, ask: what data does this run on? Can I test it on a sample of my actual data? Any agency confident in their system will say yes. An agency that resists should make you wonder why.

“We have a proprietary model”

This requires some nuance because there are legitimate cases where it’s meaningful. But in most mid-market AI engagements, “proprietary model” is marketing language for one of three things:

• A fine-tuned version of an open-source model (nothing wrong with this, but not proprietary in any important sense)
• An ensemble of existing techniques wrapped in custom software
• A claim they can’t really substantiate

Ask what’s proprietary about it. What makes it different from fine-tuning GPT-4 or Llama? What’s the training process? What data was it trained on? If they can’t answer clearly, the claim isn’t meaningful.

No plan for when the model is wrong

Every model is wrong sometimes. How your system handles those errors matters as much as the accuracy rate. Ask:

• What happens when the model produces a low-confidence output?
• Is there a fallback? A human review queue? An “I don’t know” response?
• How do you detect when the model starts degrading over time?

An agency without clear answers to these questions has built a demo, not a production system. Production AI needs monitoring, alerting, and graceful degradation. If those things aren’t in the proposal or the conversation, ask why. Anthropic’s guidance on responsible AI deployment and OpenAI’s usage policies both emphasise the importance of human oversight. If your vendor doesn’t, they’re behind the curve.

References who won’t go into detail

References are mostly useful for what they won’t say. A reference who says “they were great, would recommend” without being able to tell you about a specific challenge the agency navigated, a specific decision they made that turned out to be right or wrong, or what the project actually felt like: that reference is giving you very little.

Push harder. What did they underestimate in the original scope? How did they handle it when the timeline slipped? What would you do differently? Useful references can answer these questions. References who only have positives either haven’t thought about it or are being diplomatic.

They never ask about data privacy

If you’re building an AI system that touches customer data, employee data, financial records, or health information, data privacy isn’t optional. It’s a design constraint.

Relevant regulations to know:

• GDPR (EU): affects data storage, processing consent, and retention periods
• CCPA (California): consumer data rights and disclosure requirements
• HIPAA (US healthcare): strict rules on handling protected health information
• EU AI Act: tiered risk requirements for AI systems, now in force

An agency that gets through a full discovery conversation without raising any of this hasn’t built systems in regulated industries or hasn’t thought about your specific situation. Either way, you’d be holding the compliance liability when it matters. The EU AI Act and NIST AI Risk Management Framework are the two most relevant regulatory documents for anyone building production AI systems in 2026.

The team in the room isn’t the team on the project

This happens constantly. The pitch is led by a senior partner or solutions architect. The actual delivery is done by junior engineers the client has never met. It’s not always a problem, since senior people can’t be everywhere, but it’s worth understanding the actual staffing plan before you sign.

Ask to meet the lead engineer assigned to your project. Ask what their background is. Ask how much time the senior people in the room will actually spend on the engagement. Resistance to answering these questions directly is itself informative.

If you’re evaluating individual developers rather than agencies, how to evaluate an AI developer when you’re not technical covers the signals that actually matter at that level.

The proposal doesn’t mention what happens after launch

A model in production is not a finished product. It drifts as the world changes. It needs retraining. It needs monitoring. It needs someone to own it when something goes wrong.

If an agency proposal ends at “deployment” with no mention of a maintenance plan, monitoring setup, or handoff strategy, you’re either paying for a second engagement to deal with post-launch reality or inheriting a system you have no idea how to maintain. Neither is a good position.

Ask explicitly: what does the engagement look like after go-live? What monitoring is included? Who owns retraining, and on what schedule? What happens if performance degrades six months after launch?

Frequently asked questions

How do I verify an agency’s case studies?

Ask for the client’s name and a contact. Most legitimate agencies will provide at least one reference you can call directly. Cross-reference the claim against public information: has the client mentioned the project publicly? Does the timeline add up? If an agency only offers anonymised case studies with no verifiable details, that’s worth noting.

Is it a red flag if an agency only uses the OpenAI API?

Not automatically. Many valid production AI systems are built on API calls to foundation models. The question is whether that approach is appropriate for your problem. If you need custom model training, fine-tuning on proprietary data, or something the API can’t handle, you need deeper ML engineering capability. If you need a well-integrated LLM application, an agency proficient with API-based architectures may be exactly right.

What should a legitimate discovery phase cost?

Typically $10,000–$30,000 for a thorough scoping engagement. This produces a technical architecture recommendation, a data assessment, an accurate project estimate, and defined success metrics. Agencies offering free discovery are either rushing it or rolling the cost into the project estimate. Both are fine as long as you know which you’re getting.

Should I sign an NDA before evaluating an agency?

For initial conversations and reviewing their portfolio, no. Once you’re sharing proprietary data, internal process details, or specific system architecture, yes. Most reputable agencies will sign a reasonable mutual NDA without friction. If they push back on standard NDA terms, that’s worth noting.

What does a fair AI development contract look like?

Key things it should include: clear IP ownership (you should own the model weights, training data, and code), defined performance acceptance criteria with specific metrics, a change order process that doesn’t let scope expand silently, a maintenance and support plan post-launch, and data handling and privacy provisions. See how to write an AI project brief for the context that makes a contract negotiation more productive.