How to Check a Vendor's AI Claim Before You Buy It

Every agency, software vendor and consultancy now says AI-powered, and from the outside a buyer cannot tell an automated pipeline from a person with a chatbot tab open. The difference matters for price, for where your data goes, and for who is accountable when the output is wrong. Regulators on both sides of the Atlantic have started saying so in enforceable terms, which gives a buyer something better than instinct to point at.

This post is a checklist a founder or operations lead can send to any vendor as it stands. It gives ten questions, maps each to the risk it retires, lists the answers that should end the conversation, and quotes what the US Federal Trade Commission and the EU AI Act have actually said, with dates. It is not legal advice. And it applies to us: Digital Applied sells AI services, and every question below is one we expect to be asked.

On September 25, 2024 the Federal Trade Commission announced Operation AI Comply, a sweep against companies it said were using AI claims to deceive. Its then chair, Lina Khan, is quoted in the release: "there is no AI exemption from the laws on the books." The first cases included a company that sold an AI service it called the world's first robot lawyer; the FTC's complaint said the company had not tested whether the product matched a human lawyer and had hired none. Its proposed order required a $193,000 payment and barred claims that the service could substitute for a professional without evidence.

The pattern continued under the next administration, with a narrower stated focus. On April 28, 2025 the FTC announced an order against Workado, which had advertised an AI content detector as 98 percent accurate; the FTC said independent testing found about 53 percent on general-purpose content. On December 22, 2025 the same agency set aside an earlier order against an AI writing tool, saying its focus is fraud and tangible consumer harm. On July 1, 2026 it opened comment on a policy statement about AI accuracy. And on August 27, 2026 it finalised orders against Cox Media Group and two other firms over an "Active Listening" marketing service they had claimed used AI on voice data from smart devices; the FTC said the service was not based on voice data and consumers had not opted in. The three firms pay $930,000 in total.

The dates have moved, so they are quoted from the European Commission's own AI Act page as read on September 22, 2026. The Act entered into force on August 1, 2024 and became applicable on August 2, 2026, with exceptions. The rules for general-purpose AI models applied from August 2, 2025. The transparency rules came into effect in August 2026; the Commission's enforcement notice for August 2, 2026 says chatbots and other interactive systems must tell users they are dealing with AI, deepfakes must be labelled, and AI-generated or altered content must carry machine-readable marks. The high-risk obligations were delayed by the AI Omnibus, which entered into force on July 27, 2026: the sensitive-area use cases in Annex III now apply from December 2, 2027, and systems embedded in regulated products from August 2, 2028.

For a buyer of an AI-labelled service, the practical consequence is the transparency layer. If a vendor puts a chatbot in front of your customers in the EU, or generates content your business publishes there, the disclosure and marking obligations exist now and someone has to own them in the contract. The Commission's guidelines on transparency obligations and its code of practice on marking AI-generated content, both linked from the pages above, are the documents to ask the vendor about.

Send the left column. Keep the right column for yourself; it is why each question is there, and the order in which to weigh the answers.

Most vendors will answer most of the questions well. These are the answers that mean you stop, because each one is the shape of a claim a regulator has already tested.

Good answers have a recognisable shape. They name things: a model provider, a region, a retention period, a person's role. They attach a method to every number and a remedy to every promise. And they distinguish, without being pushed, between what the system does alone, what a person does with it, and what a person does without it. Three answer patterns cover most vendors.

Two of our earlier posts help with the data questions in particular. Who can read your conversations with an AI product, by vendor, is in our human-review census; what people are actually willing to let an agent do on their behalf, by survey, is in our access-permissions statistics post. And how the frontier labs themselves are evaluated, which is question 4 one level up, is the subject of our census of independent evaluation arrangements. If you would rather have the ten questions answered about our own services before you ask them, our AI transformation service page is where to start.