The questions to ask an AI agency have almost nothing to do with models. Seven of them separate suppliers, because they are about documentation, about who answers to the regulator, and about what stays in your house when the contract ends.
The reason is legal. Since 2 August 2026 the AI Act transparency obligations and the supervisory powers of national authorities have applied. Whoever answers to the supervisor is, as a rule, whoever places the system on the market or uses it. Not the agency that built it.
Regulation (EU) 2024/1689 was amended by Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The high-risk obligations for standalone Annex III systems moved to 2 December 2027, and those for AI embedded in Annex I products to 2 August 2028. The Article 50 obligations were not deferred.
Who answers to the regulator, you or the agency?
As a rule, you. And this is the question that changes all the others, which is why it is worth settling before discussing scope or price.
The AI Act distributes obligations by role. The provider is whoever develops and places on the market under their own name or trademark. The deployer is whoever uses the system under their own authority. An agency that builds a system for you, which is then used under your brand, places it in your sphere of responsibility rather than its own.
Article 25 addresses precisely the situations where the role changes hands, such as putting your name or trademark on a system, substantially modifying it, or changing its intended purpose. Regulation (EU) 2026/1744 added selected Article 25 duties to the middle penalty tier, which is a signal that the question of roles has stopped being academic.
The seven questions to ask an AI agency
Each one produces measurably different answers between suppliers. We include the answer that should make you uncomfortable.
Which artefacts should you require on delivery?
Four. What unites them is that none can be produced afterwards, which makes them contract clauses rather than requests at the end of a project.
What changes on 2 December 2026?
Article 50(2) reaches systems already in production. It is the nearest date and the least discussed. Article 50 requires AI-generated content to be marked in a machine-readable format so it can be detected as artificially generated. It applied to new systems from 2 August 2026. Systems already on the market at that date have until 2 December 2026.
Three questions to ask the agency, if anything in your product generates content. How many paths in the product produce generated output, knowing the honest answer is usually more than the initial list. Is the marking applied at generation or at presentation, knowing that marking at the presentation layer disappears when content leaves your interface. And if the model is third-party, do they mark, and do you inherit it, a question for now rather than for November.
And a note of honesty worth demanding. The robustness of marking has known limits: re-encoding, cropping and format conversion degrade or remove many marks. An agency guaranteeing unremovable marking is promising what it cannot deliver, and that is more concerning than admitting the limit. We covered what actually changed in the AI Act in August 2026 separately, and our Claude Partner Network note covers how we build against model-provider guidance rather than reverse-engineering it.
Which clauses are missing from most AI contracts?
Six, and none is exotic. They are missing because the contracts were drafted before the obligations existed. Delivery of the four artefacts as a condition of acceptance rather than a desirable annex. Explicit allocation of the provider and deployer roles. Inference location and a retention policy for prompts and outputs. A right to run the evaluation set independently. An obligation to notify changes to the model or the underlying model provider. And an orderly exit, covering what is delivered, in what format and within what deadline.
The fifth is the least obvious and the most useful. If the agency swaps the underlying model without telling you, your system behaviour changes and your documentation stops describing what is in production. That is your problem, not theirs, and it may amount to a substantial modification in the Article 25 sense.
Which signals suggest the project will not reach production?
None of these is disqualifying. All are worth a second question before signing. The proposal describes model capabilities rather than the business problem. There is no written success criterion, which means nobody can say the project failed and it lives indefinitely in pilot. Nothing describes what happens when the system gets it wrong, despite AI systems erring by design. The demonstration is flawless and there is no evaluation environment, which is the difference between a sample they chose and one you chose. Nobody asks for your real data, despite that being where the surprises live. And the word pilot appears without an exit condition.
Frequently asked questions
Responsibility and penalties
Who answers to the regulator, the company or the AI agency?
What are the AI Act penalties?
AI Act deadlines
What changes on 2 December 2026?
Was the AI Act delayed?
Questions to ask an AI agency about documentation and exit
What documentation should you require from an AI agency?
What should stay with us if we change AI supplier?
