1. Can your AI do anything other than produce text? This one answer decides most of the price. An assistant that answers questions has a small attack surface; one that can call a tool, change a record or reach an API has a large one.
Text only it answers questions and nothing else It can look things up read-only calls to an API or database It can change things creates, updates, refunds, sends messages, books I am not sure we will work it out on the call
2. How many tools, functions or MCP servers can it call? Count each distinct action it can take. If it calls one API with six endpoints, that is six.
None 1 to 5 6 to 12 More than 12 I do not know yet
3. Does it read documents or data belonging to your customers? A retrieval pipeline over per-customer data is where cross-customer exposure lives, and testing it needs an account in each of two tenants.
No documents at all Yes, but the same public documents for everyone Yes, internal documents shared across all our staff Yes, and each customer sees only their own multi-tenant
4. Who can talk to it? An assistant reachable by anyone outside your company has a larger population of potential attackers than one behind a staff login.
Anyone on the internet no login required Your customers, after they log in Your own staff only A handful of internal users
5. Is there a test environment we can work against? Testing in production is workable and it narrows what we are allowed to do. A staging instance with dummy data lets us prove more.
Yes, staging with dummy data Yes, but it holds real data Production only I need to check
6. When do you need the result? Booking three weeks or more ahead is reflected in the quote. Short notice carries a premium because it displaces scheduled work.
As soon as possible inside 2 weeks Within a month Within three months No fixed date budgeting or planning ahead
7. Who reads the report? A report going to a customer, an auditor or a certification body is written differently from one that stays with your engineers.
Our engineers only Our management or board A customer who asked us for evidence An auditor or certification body ISO 27001, NIS2, a tender
8. Anything that would get in the way of testing? Pick every one that applies. None of these stops the work; each one changes how it is planned.
Rate limiting on the endpoint we will ask you to allowlist a test account A WAF or bot protection in front A change freeze or maintenance window A third party built or hosts it None that I know of
9. Anything else we should know?
What the assistant is for, what worries you about it, a deadline you are working to, or a question you want answered on the call.
10. Who is asking?
Optional. Filling these in means the reply can carry a price.