Generating tests from code and generating them from requirements are different operations with different failure modes. Generated tests reliably raise coverage. Whether they catch more faults is a separate question. The research answer is less flattering than the marketing.
“AI testing tool” covers at least seven different products sold under one label. They solve different problems, cost different amounts and lock you in to different degrees. Four questions separate them better than any feature list.
One tender, followed through ConcursosGov from the moment it appears on Portal BASE to the moment a team decides to bid. It covers the AI reading of the tender documents, the tender score and the decision log, using the real product at every step.
Portuguese public tenders are all public, and companies still lose contracts that suited them. ConcursosGov turns the daily flow of Portal BASE notices into a short list a team can decide on in minutes. It is live now, with a 14-day trial.
The questions to ask an AI agency have almost nothing to do with models. Seven of them separate suppliers, because they are about documentation, about who answers to the regulator, and about what stays in your house when the contract ends.
It pays off when volume is high, exceptions are rare, rules are stable and the decision is reversible. It fails when any one of those four does not hold, and the cost shows up in maintenance rather than in the initial budget.
For a company whose product is code, most of ISO 27001 lands inside the delivery process rather than in policies and binders. That tells buyers which questions test whether a supplier’s certificate means anything. It also tells software companies how much of certification is engineering work.
NIS2 supplier requirements changed who carries the risk. The obligation to manage supply chain security attaches to the covered entity, which means the security posture of whoever builds and maintains your software became part of your own exposure. If your supplier cannot evidence its practices, the finding lands on your side of the table.
Start with what you can verify on your own, before speaking to anyone. The public list of PME Líder companies, the public contracts record on the Base portal, the open source the company publishes and its filed accounts. Four sources independent of any sales conversation.
Five things changed. Keys moved from RSA to ECDSA. Contactless reading arrived over ISO/IEC 14443, protected by the PACE protocol. A six-digit CAN code was introduced for contactless access. The chip contacts moved to the back of the card. And there is no API that tells you which version is in front of you.