How to choose an AI supplier for your SME in 2026: 10 criteria and what to demand in the contract

Choosing who to trust with your company's artificial intelligence is closer to choosing a tax adviser than to buying software: you are giving them access to your data, your processes and, in part, your decisions. In 2026 the offer in Spain is enormous, from large consultancies and agencies to independent professionals and sector-specific software products, and almost all of them claim the same things: "GDPR compliant", "in line with the EU AI Act", "results in weeks".

This guide is the checklist we use at Tecnea when a client asks us to help compare proposals, including our own. It is not neutral in one sense: it is written by a company that sells exactly this service. It is neutral in another: every criterion can be checked in a one-hour meeting, and none of them depends on who applies it.

Before looking for a supplier: define the process, not the technology

Most AI projects that fail do not fail because of the model. The 2025 MIT NANDA report, based on 150 executive interviews and 300 analysed deployments, found that 95% of generative AI pilots had no measurable impact on the profit and loss account, and that the main barrier "is not infrastructure, regulation, or talent. It is learning". Gartner, for its part, predicts that over 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls.

In Spain the starting point is more modest than the headlines suggest: 20.5% of companies with ten or more employees used some AI technology in 2025, according to the ONTSI, and among those that do not, close to 80% cite a lack of internal knowledge as the main barrier, according to Fundación Cotec and ISEAK.

That is why the first step is not asking for quotes but writing one sentence: "I want [this process] to stop costing us [this time or this money]". Real examples: "I want orders that arrive on WhatsApp to stop being typed by hand into the ERP", "I want a lawyer to stop spending four hours finding the arguments we already used in a similar case", "I want to know every week how much we have spent on each site without asking anyone". If you cannot write that sentence, what you need first is a short diagnosis, not a development project.

The ten criteria

1. They talk about your process, not about models

A good supplier asks who does what, with which data, how long it takes and where time is lost, before mentioning any model. If the first meeting revolves around which AI provider is best, change supplier: models change every few months; your process does not.

2. They tell you where your data is processed, and sign it

Three questions with a mandatory answer: in which country is my data processed? Is it used to train third-party models? Who are the sub-processors? The acceptable answers for a Spanish SME are "in the European Union or in your own environment", "no" and "these ones, in writing". The data processing agreement under Article 28 GDPR is not a formality: it is the document that defines who is accountable if something goes wrong.

3. Documented compliance, not declared compliance

Since 2 August 2026 the EU AI Act requires any company using AI to train its staff (Article 4), to inform people when they interact with an AI system and to label certain generated content (Article 50). High-risk obligations were postponed to 2 December 2027 by the Digital Omnibus, and affect specific uses such as recruitment. A serious supplier delivers the inventory of systems, the risk classification of each one and the applicable obligations as part of the project, not as a separate service.

The Spanish data protection authority (AEPD) made it clear in its July 2026 technical note on data quality, accuracy and minimisation in AI systems: the accuracy of data is judged against the purpose of the processing, and saying that a tool is "GDPR compatible" is not the same as complying.

4. The figures come from your system, not from the model

A language model should never "remember" a price, a stock level or a balance. Every time it needs a figure it must look it up in the management system and return it as is. Ask to see what the application does when it does not have the data: the right answer is "I don't know, I'll check with a person", never a plausible number.

5. Human oversight by design, not improvised

Who reviews what, at which point and with which record. For high-risk uses the Regulation requires it; for everything else it is common sense: a legal brief, a commercial offer or a message to a client is signed by a person. If the supplier cannot draw that circuit on a whiteboard, they do not have one.

6. A pilot with fixed scope and fixed price

One process, a few weeks, a success criterion agreed before starting and the option to stop. Be wary of proposals that start with "the platform" or with a six-month project: the pilot is the cheapest way to check the other nine criteria.

7. Code, data and exit

Who owns the code at the end? Are there per-user licences? Can I export my data and demand its deletion? The answers that protect your company are "you", "no" and "yes, by contract". A supplier that lives off lock-in has different incentives from yours.

8. Real integration with what you already use

AI is of little use if it is not connected to the ERP, the CRM and email. Ask for references of integrations similar to yours and whether it will be done via API or file exchange when there is no API. "It integrates with everything" without examples is a warning sign.

9. Who does the work

Is the person selling the project the one who will build it? What happens if they leave? In a large consultancy the risk is that the senior team from the sale disappears during delivery; with an independent professional, that everything depends on one person. Neither disqualifies, but it is worth knowing beforehand.

10. Total cost, not development price

On top of development you have to add model consumption (paid per use), infrastructure, maintenance and training. Ask for a monthly consumption estimate with clear assumptions and ask who pays for the peaks. A project that is cheap to build can be expensive to run.

What to demand in the contract

These ten clauses are not exotic; any supplier that works well has them ready:

1. Object and scope of the pilot, with the agreed success criterion.
2. Fixed price per phase and milestone calendar.
3. Intellectual property: code and documentation pass to your company upon payment.
4. Data processing agreement (Article 28 GDPR), with the list of sub-processors and the location of the data.
5. Express prohibition on using your data to train models, the supplier's or third parties'.
6. Logging and traceability: what the AI was asked, with which data and what it answered.
7. EU AI Act compliance documentation as a deliverable: inventory, risk classification, transparency measures and training.
8. Service levels and support after delivery, with response times.
9. Exit: data export in an open format and certified deletion.
10. Liability and professional indemnity insurance on the supplier's side.

Seven warning signs

• They promise "an AI that does everything" before knowing your process.
• They do not ask about your data or where it is.
• Opaque per-user prices or "on request" without explanation.
• No mention of human oversight or of what happens when the AI is wrong.
• The demo uses made-up data and never yours.
• They cannot say in which country the data is hosted.
• "GDPR compliant" without a processing agreement or a list of sub-processors.

Which type of supplier fits each case

| Supplier type | When it fits | Main risk | |---|---|---| | Large consultancy | Companies with more than 250 employees, projects of several hundred thousand euros, several departments involved | The team that sells is not the team that delivers; the minimum cost leaves SMEs out | | Integrator specialised in SMEs (Tecnea's case) | Companies of 20 to 100 people with no IT department, one specific process, ERP and CRM integration | Check real technical capacity and a stable team | | Independent professional | Small, well-defined projects, tight budget | Dependence on one person; continuity and support | | Sector-specific software product | Your process is standard and matches what the product does | Your data and your process adapt to the product, not the other way round; per-user licences |

Twelve questions to bring to the meeting

1. Which of my processes will you improve and how do we measure the result?
2. In which country is my data processed and who are the sub-processors?
3. Is my data used to train any model?
4. What do you deliver regarding EU AI Act and GDPR compliance?
5. Where does the AI get prices, stock and balances from?
6. What does the system do when it does not know the answer?
7. Who reviews what before anything reaches a client?
8. How long does the pilot last, how much does it cost and what happens if it does not work?
9. Who owns the code at the end and are there per-user licences?
10. Which ERPs and CRMs have you integrated with and how?
11. Who will do the work and what happens if that person leaves?
12. How much will model consumption, infrastructure and maintenance cost per month?

Frequently asked questions

Does an SME need an external supplier to comply with the EU AI Act? Not necessarily. The 2026 obligations for AI users (training, transparency, no prohibited practices) can be met with internal resources if someone in the company takes them on. What does matter is that the supplier implementing the AI delivers its share documented: which systems exist, what risk they carry and which measures have been taken.

Is a general-purpose AI tool better than custom development? It depends on whether your process is standard. General-purpose tools do not know your prices, your customers or your processes, and the team ends up pasting company data into them. Custom development integrates AI where the work happens, with your data and under your control. For a process that is the same in every company, a sector-specific product is usually enough.

How long should a first project take? A pilot in production on one process usually takes four to eight weeks from the diagnosis. If the initial proposal is six months and several processes, ask to have it split.

What about the AI my team already uses on its own? It is the norm: in companies of 50 to 500 people, 64% of employees use unauthorised AI tools, according to WatchGuard. The first deliverable of any project should be that inventory, and the fix is usually to give them a private tool that is better than the one they use quietly.

Can I ask for a second opinion on a proposal I already have? Yes. Reviewing a proposal against these ten criteria takes an hour and avoids months-long contracts. At Tecnea we do it with no obligation, also when the proposal comes from another supplier.

Comparing AI proposals for your company? Tell us about the process you want to improve and we will tell you, with no obligation, whether an AI application makes sense, what the pilot's scope would be and how long it would take. You can also estimate in one minute how much your company could save or read how we work in AI consulting and implementation for SMEs and custom application development with AI.

Sources

1. Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text on EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
2. AESIA, practical guides for AI Act compliance: https://aesia.digital.gob.es/en/present/resources/practical-guides-for-ai-act-compliance
3. AEPD, technical note on data quality, accuracy and minimisation in processing carried out with AI systems, 21 July 2026: https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/aepd-analiza-calidad-exactitud-y-minimizacion-de-datos-personales-en-tratamientos-con-ia
4. ONTSI, "Indicadores de uso de inteligencia artificial en España", 2026 edition (2025 data): https://www.ontsi.es/sites/ontsi/files/2026-07/indicadores-de-uso-de-inteligencia-articifial_1.pdf
5. Fundación Cotec and ISEAK, "Inteligencia artificial y sus efectos en la productividad laboral. Evidencia de las empresas españolas": https://cotec.es/proyectos-cpt/ia-inteligencia-artificial-efectos-en-la-productividad/
6. MIT NANDA, "The GenAI Divide: State of AI in Business 2025" (July 2025). Academic study with no product to sell; 150 interviews, 350 surveys and 300 deployments.
7. Gartner, "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027", press release, June 2025. Gartner sells technology advisory services.
8. WatchGuard Technologies, "2026 Cybersecurity Hygiene Report" (April 2026), survey of companies with 50 to 500 employees. WatchGuard sells cybersecurity products. Our analysis: Shadow AI in 2026.
9. Tecnea, EU AI Act: what changes on 2 August and what has been postponed.