Direct answer
Choose a partner that can define the business outcome, baseline the current workflow, explain data and security risks, build a controlled pilot, document ownership and show how the client exits. Avoid guaranteed savings, unclear subcontracting and solutions that begin with a tool rather than the workflow.
A good partner passes three tests
Weak signals appear before any contract is signed.
Start with the buying brief
Describe the workflow, volume, users, systems, current problem and expected commercial result before asking for a solution. A supplier cannot scope responsibly from “we need AI” or “automate the business”.
Include what must not change, which data is sensitive, who approves decisions, the systems the client must continue to own and how success will be measured. This allows providers to disagree constructively instead of competing on presentation.
Questions to ask before appointing a partner
| Area | Question | Why it matters |
|---|---|---|
| Outcome | What measurable result will this scope influence? | Prevents a tool installation being mistaken for improvement |
| Evidence | How will you baseline the current workflow? | Creates a defensible before and after comparison |
| Data | What data leaves our systems, where does it go and who can access it? | Exposes privacy, security and cross-border risks |
| Controls | What requires human review and how are exceptions handled? | Defines the operating limit of automation |
| Testing | Which normal, failure and edge cases will be tested? | Shows whether the build is production-ready |
| Ownership | Who owns accounts, configuration, code, prompts, documentation and data? | Prevents avoidable lock-in |
| Exit | What happens if either party ends the relationship? | Makes continuity and handover concrete |
Practical next step
How Advery works. See the stage outputs and ownership rules Advery works to.
See the approachProtect operational ownership
Where practical, core vendor accounts, domains, data stores and production credentials should sit under client-controlled administration. The supplier can have appropriately limited access without becoming the only route to the system.
- Maintain a current access register and named account owner.
- Document integrations, workflow rules, exceptions and recovery steps.
- Identify proprietary components and what happens to them on exit.
- Define backup, monitoring, incident and change responsibilities.
- Require a handover that another capable provider could understand.
Review privacy, security and human oversight
The OAIC recommends due diligence when selecting AI products, including reviewing intended use, human oversight, privacy, security and access to personal information. The Australian Government's Guidance for AI Adoption focuses on governance, business alignment and risk. ASD and ACSC also publish practical questions for managed service providers.
Ask the provider to explain the specific controls for this use case. A policy document is not evidence that the workflow has minimum access, safe failure, appropriate review and effective logging.
Strong and weak buying signals
| Strong signal | Weak signal |
|---|---|
| Challenges scope and asks for source evidence | Promises a complete transformation before discovery |
| Separates deterministic automation from AI judgement | Adds AI to every step regardless of need |
| States assumptions, exclusions and dependencies | Uses guaranteed savings without a baseline |
| Explains access, logging, testing and recovery | Focuses only on the happy path |
| Leaves the client with documentation and control | Keeps essential accounts or knowledge opaque |
The aim is not to eliminate supplier dependence. It is to make the dependence deliberate, visible and commercially reasonable.
Sources and guidance
- OAIC: Privacy and commercially available AI products
- Australian Government: Guidance for AI adoption
- ASD ACSC: Questions to ask managed service providers