Objective, scope and pilot
What the tool is meant to do, what it is not allowed to do, success criteria, tests and any pilot phase.
Before signing
Independent AI Vendor Audit
A vendor is offering you an AI solution. What should you check before you sign or go further?
A quote for an agent, chatbot or automation cannot be read like a standard web proposal. You need to know which data will be used, which model will be called, who keeps the logs, what the APIs will cost, who reviews the outputs and what happens when something goes wrong.
Mahthildis reviews the proposal as an independent counterpart: what is clear, what remains vague, what is missing and what must be secured before you commit.
Paulo Castro personally steers the engagement. You receive a usable reading so you can sign, renegotiate, ask for a pilot or wait.
Situations
Why review an AI proposal?
A vendor presents an AI agent, chatbot or automation as simple and very quick to launch.
ROI is promised without measurable assumptions or success criteria.
Data, logs, retention or access rights are not framed.
API costs, maintenance, security or contract exit remain hard to read.
A demo convinces, but the real scope of action is not written down.
The quote is already signed and you need to reframe the pilot, acceptance criteria or governance before rolling it out.
Example
An assistant connected to email and the CRM
The demo is convincing. Action rights, usage costs and contract exit remain unclear. Should you sign, ask for a conditional pilot, or wait?
- Review the scope of action, data, access, human review, usage costs, maintenance and exit.
- List the unknowns and prepare the questions to send back to the vendor.
- Define the conditions that should be in place before any commitment.
The audit helps you decide without rushing. It does not attack the vendor and it does not sell a competing solution.
Scope
What Mahthildis examines
The audit looks at the actual proposal: quote, scoping note, demo, contract or a project already under way. The exact scope is confirmed after the first conversation.
Data, models and access
Sources in use, sensitivity, access rights, models called, logs, retention and copies to external services.
Usage costs and maintenance
Licences, API costs, volumes, caps, support, later changes and what happens if usage grows.
Confidentiality, security and responsibilities
Who reviews an output, who remains accountable when something fails, and which regulatory points should be checked with the relevant advisers.
Dependency and reversibility
Exit terms, data recovery, reversibility, and what would remain locked if the vendor or the model changes.
How it works
How the engagement is run
The first conversation defines the scope. The audit itself is a paid engagement, taken through to a usable recommendation.
01
Frame the file
Clarify the proposal to review, the documents available, the decision to take and, if useful, whether a conversation with the vendor would help.
02
Read the proposal
Examine the quote, the scoping, the assumptions, the data, the access, the costs, the maintenance and the exit clauses from the material agreed in scope.
03
Clarify the gaps
Prepare the questions for the vendor and, if it helps the decision, speak with them to qualify the risks without creating an unnecessary confrontation.
04
Deliver the recommendation
Hand over a readable note: risks, points to renegotiate, possible conditions and a verdict to sign, reframe, pilot or wait.
Deliverables
What you receive
Leadership receives a structured analysis that can be used to decide. The level of detail depends on the agreed scope.
Risk note
The points that expose budget, data, dependency or accountability, written for leadership.
Questions for the vendor
The clarifications to obtain before signing or continuing, including data, APIs, tests and exit.
Points to negotiate or condition
What can be clarified, limited, put under a pilot or postponed, rather than signed as it stands.
Recommendation
A GO, NO-GO or CONDITIONAL view, with the realistic next step if you continue, reframe or wait.
Responsibility
An independent audit, with the skills it needs
Paulo Castro remains your principal counterpart and steers the audit.
Mahthildis is not a staffing firm and does not sell a competing vendor. Independent judgement is preserved: the audit is not designed to place a tool, a team or another supplier.
Additional expertise when the scope requires it
Depending on the file, Mahthildis can bring in complementary skills — data, cloud, security, AI or regulatory questions to identify — after their role and fees have been agreed.
Those contributions stay under Paulo Castro’s lead. They are not included automatically.
Format and fees
Quoted after the scope is understood. The first 20-minute conversation frames the request. The audit is a standalone engagement, distinct from an internal AI-use audit and from AI project delivery.
Limits of the engagement
- The audit does not automatically include designing or delivering a technical solution.
- A separate design, integration or delivery engagement can be proposed later if you want one. There is no obligation.
- The audit is not a legal, DPO or specialist cybersecurity opinion. Points beyond the scope are identified for the relevant advisers.
FAQ
Common questions.
Can you challenge an AI-agent quote?
Yes. The review covers the scope of action, access rights, data, API costs, maintenance, human review and reversibility.
Can you speak with the vendor?
Yes, if that helps clarify the assumptions. The aim is a sounder decision, not an unnecessary confrontation.
Is this useful if the quote is already signed?
Yes, but the objective changes: reframe the risks, the pilot, the acceptance criteria or the governance before a wider rollout.
Do you review API costs?
Yes. Usage costs, volumes, models called, caps and growth scenarios are part of what needs to be clarified.
Does the audit replace a GDPR or security opinion?
No. It identifies points of attention and situations that should be checked with the relevant advisers if needed. Compliance is not promised.
How long does it take?
Duration depends on the material available and the complexity of the proposal. It is confirmed after the first conversation. The aim remains a short reading before a decision.
Do we then need another diagnostic?
No. The AI vendor audit is a standalone engagement. It is not a mandatory step before asking Mahthildis to take on a project.
Do you have an AI proposal to review?
Book a first conversation or send your request. Mahthildis will confirm the useful scope before any engagement.
