How to choose an AI assistant for your company: 12 questions to ask before you decide
Choosing well takes twelve questions, asked before you sign: where the data ends up, whether the assistant reads your documents where they live and cites the page, who sees what, who can correct it, what it costs for everyone over a year, and how you get out. Here are the questions, the answers to insist on, and a table to compare offers.
- 19% of people who use AI at work stick to tools their company provides (Politecnico di Milano)
- 58.6% of companies that considered AI without adopting it cite a lack of skills (Istat)
- 43.2% of the same companies worry about data protection (Istat)
Key takeaways
- Ask about data first: where it is stored, whether it trains models, and who processes it on the vendor’s behalf. Under the GDPR the answers belong in the data processing contract (article 28), not on a marketing page.
- A useful company assistant reads documents where they already live (Drive, SharePoint, the file server), updates itself when they change, and cites the document and page of every answer. Without the citation, checking costs more than searching.
- Decide who sees what before you start, for each person and each assistant. An assistant that respects existing permissions shows everyone everything those permissions already allow, mistakes included.
- Since 2 February 2025, companies using AI systems must support the AI literacy of their staff (AI Act, article 4, rewritten in July 2026): training is part of the choice.
- Compare the yearly cost for everyone who will use the assistant, not the list price, and ask how to leave: for a contract signed today, the EU Data Act allows at most two months’ notice and, as a rule, a 30-day switch.
01 What are the 12 questions to ask?
A company AI assistant is a program that answers people’s questions from the company’s own documents, under access rules the company sets. It can be the business version of a general-purpose assistant, such as ChatGPT, Copilot or Gemini, or a specialized one: the questions apply to both. Here they are in one list; below, what to insist on for each.
- Where is the data stored, and who processes it on the vendor’s behalf?
- Is your data used to train the models?
- Does it read documents where they already live, without uploading them again?
- Does it update itself when a file changes or is deleted?
- Does it cite the document and page of every answer, and say when it doesn’t know?
- Who sees what: can you set permissions for each person and each assistant?
- Who can correct it when it is wrong, and how?
- Does it work in your language, with your jargon and your codes?
- Who trains your people, and what gets written down?
- What does it cost for everyone, for a year, all included?
- How do you get out, with which data, and how fast?
- Who helps you start, how fast, and in which language?
Before asking, write down three real tasks you want it to handle: answering sales staff about datasheets, drafting a quote, explaining a procedure to a newcomer. Test every answer the vendor gives on those three tasks, with your own documents.
02 Where does the data end up, and does it train the models?
1. Where is the data stored? Ask for the country of the data centers, for documents and for conversations, and for the list of sub-processors: the other companies that process data on the vendor’s behalf, AI model providers included. Under the GDPR, a vendor that processes personal data for you is a processor: it must offer sufficient guarantees, sign a contract setting out its duties (article 28) and may hand work to others only with your authorization. If data leaves the European Union, the transfer must comply with Chapter V of the regulation. For cloud services, the EU Data Act also requires the provider to state on its website which jurisdiction its infrastructure is subject to (article 28).
2. Does your data train the models? The answer must be written in the contract, not on a promotional page, and it must cover three things: the connected documents, people’s questions and the answers. The personal and business versions of the same tool can have different terms: check the business ones.
Finally, ask how long conversations are kept and who inside your company can read them. The GDPR questions to ask a vendor are collected in a dedicated guide.
03 Does it read documents where they live, and stay up to date?
3. Does it read documents where they already live? A company assistant earns its keep when it works on the sources the company really uses: Google Drive, SharePoint and OneDrive, Notion, the website, the office file server. If the only way to give it a document is to upload it by hand into a chat, everyone ends up with their own copy, and copies age.
Ask for the list of connections available today, not “coming soon”, and for the formats it reads: scanned PDFs, Excel files, presentations, recordings.
4. Does it update itself? Test it: edit one file, delete another, and see how long it takes before the assistant answers with the new version. An assistant answering from an old price list is worse than no assistant, because it sounds sure of itself.
04 Does it cite the document and the page?
5. Does it cite the source, and say when it doesn’t know? Every answer should state which document it comes from, ideally which page, with one click to open it. When the answer is not in the documents, the assistant should say so instead of filling the gap with something plausible.
This is not a detail. A 2024 study by Stanford researchers tested professional legal research tools built precisely to answer from documents: they gave wrong answers, or answers not supported by the sources they cited, between 17% and 33% of the time. No assistant is infallible: the citation is there for whoever has to check, and it turns checking into a matter of seconds. How it works, in plain words: why AI that cites its sources makes fewer mistakes.
The test: ask five questions you know the answer to, plus two whose answer is not in your documents.
05 Who sees what, and who can correct it?
6. Can you set permissions for each person and each assistant? In a company not everyone sees everything: accounts, HR, contracts. Ask whether you can decide which documents each person sees and which each assistant sees, and whether the rule also holds inside answers: someone who cannot open a document must not read its content in an answer either.
One consequence is often overlooked: an assistant that respects existing permissions shows everyone everything those permissions already allow. If a payroll folder is shared with the whole company by mistake, the assistant will make it obvious. Microsoft says as much in the documentation of its business assistant: it shows only data the person can already see, and the permissions need to give the right people the right access. Before you start, check how the folders you will connect are shared.
7. Who can correct it, and how? The assistant will make mistakes: what matters is what happens next. Ask who can correct an answer, update a source or remove an outdated document, and whether a correction applies to everyone or only to whoever made it. The right answer is: the people you choose, for the topics they are responsible for. If only the vendor can correct it, every error stays until someone files a request; if anyone can, nobody is accountable.
06 Does it work well in your language?
8. Does it work with the way your company talks? The useful test is not whether it writes correct Italian, but whether it understands yours. Ask with the words people use at work, acronyms, product codes, internal names of departments, and with mixed documents, half in Italian and half in English. Check that it answers in Italian even when the source is in English, that it writes dates and numbers the Italian way, and that the tone is the one you would use with a customer.
07 Who trains your people?
9. Who trains your people, and what gets written down? An assistant nobody knows how to use is just a cost. There is also a rule: since 2 February 2025, article 4 of the AI Act has required those who use AI systems in a company to look after the skills of the people using them. In July 2026 the Digital Omnibus on AI (Regulation (EU) 2026/1744) rewrote it: companies must take measures to support the development of their staff’s AI literacy, taking into account knowledge, experience, training and the context of use, without having to guarantee a specific level for each person. The Commission and the member states must support companies, SMEs in particular, and the Commission will publish practical examples.
Ask the vendor what it offers: an initial session, materials you can reuse, a path for people who join later. And keep a record of what you do: it is the evidence of the measures taken.
If the assistant will also be used to make decisions about people, things change: Italy’s AI law (no. 132/2025, article 11) refers to the duty to inform workers when fully automated decision or monitoring systems are used for hiring, managing the employment relationship, assigning tasks, evaluation or surveillance. Put in writing what the assistant will be used for.
08 What does an AI assistant really cost for 50 people?
10. What does it cost for everyone, for a year, all included? There are two pricing models. The first is per seat: a license for every user, every month. The second is a platform fee plus a lower fee per person. Neither is better in absolute terms: it depends on how many people will use it.
| People | €20 per person per month | €500 per month + €8 per person |
|---|---|---|
| 15 | €3,600 | €7,440 |
| 50 | €12,000 | €10,800 |
| 150 | €36,000 | €20,400 |
Example figures to show the calculation, not any vendor’s prices.
With these figures the second model becomes cheaper from about 42 people upwards (500 + 8 × n = 20 × n). Redo the sum with real price lists, on the people who will actually use it, and add what the price list doesn’t say:
- Setup. Who connects the sources and prepares the first assistant, and how many days of work it takes on your side.
- Training. Two hours for 50 people is 100 hours of work: count them.
- Usage. If the price depends on usage, ask what happens above the threshold: you pay more, it slows down, or it stops.
- Terms. Minimum contract length, discounts for paying yearly, costs for adding or removing people.
09 How do you get out, and with which data?
11. How do you get out? Ask before you get in. What you can export (documents, conversations, assistant settings, corrections), in which format, how fast, and when the data is deleted. For personal data, the contract with the processor must provide that at the end of the service, at your choice, the data is deleted or returned (GDPR, article 28(3)(g)).
For cloud services, subscription software included, there is also the EU Data Act, which has applied since 12 September 2025. The contract must provide a notice period of at most two months to start switching to another provider, a switch completed within 30 days at the latest (up to seven months only if the provider justifies a technical impossibility), at least 30 days to retrieve your data, and full deletion at the end. From 12 January 2027 the provider can no longer charge for switching; until then it may charge only the costs it incurs. Early termination penalties, if the contract has them, remain possible: read them.
The test: during the trial, actually export something.
10 Who helps you start, and how fast?
12. Who helps you, how fast, and in which language? Ask how long it takes from signing to a first assistant working on your documents, who does the work, and what is needed from you. Then what comes after: who answers when something goes wrong, in your language, within what time, and whether there are people who know your industry.
The most honest test is a field test: a few weeks with your people and your documents say more than any presentation.
11 How do you compare the offers?
Put the offers side by side with a table like this one. Give each question a weight that reflects your priorities, score each vendor from 1 to 5 and multiply. Questions with a high weight and a low score are the ones to ask again before signing.
| Question | Suggested weight | Answer to insist on | How to check |
|---|---|---|---|
| Where the data is | 3 | Data center country and sub-processors in the contract | Read the data processing contract |
| Model training | 3 | No, for documents, questions and answers | A written clause |
| Connected sources | 3 | Yours, connected and not uploaded again | Connect a real folder |
| Updates | 2 | Automatic, within stated times | Edit and delete a file |
| Citations | 3 | Document and page, and “I don’t know” when needed | 5 known questions and 2 without an answer |
| Permissions | 3 | Per person and per assistant, inside answers too | Try two accounts |
| Corrections | 2 | The people you choose, for everyone | Correct an answer |
| Language | 2 | Your jargon, mixed sources | Questions with acronyms and codes |
| Training | 2 | Kick-off, materials, newcomers | Ask for the program |
| Yearly cost | 3 | Total for everyone, setup and usage included | Redo the sum on the price list |
| Exit | 2 | Export and deletion in writing | Export something during the trial |
| Start and support | 2 | Times, people, language | Ask for times and references |
Weights suggested for an SME: change them to match your priorities. Add one column per offer with its score from 1 to 5.
In the interest of transparency, ekory’s answers to these questions are public: data stored in Europe, content never used to train the models, permissions on every document, folder and Eko (see Security); a price from €199 a month for the platform plus a per-person fee, with a calculator for your headcount (see Pricing). You can try it for two weeks with your team.
Frequently asked questions
What is the best AI assistant for a company?
There is no best one in absolute terms: it depends on your documents, on the people who will use it and on your rules about who sees what. The most reliable method is to ask two or three vendors the same twelve questions and test their answers with your own documents, for a few weeks, with real people.
Can you use ChatGPT at work?
Yes, but using a personal account for work moves documents and results into private accounts, and the work stays with one person. The business versions of the main general-purpose assistants have terms that differ from the personal ones: assess them with the same questions on data, training, permissions and exit. We explain why in Personal ChatGPT is not your company’s memory.
How much does an AI assistant for a company cost?
It depends on the pricing model: a license per person, or a platform fee plus a per-person fee. Compare the yearly cost for everyone who will use it, adding setup, training and any usage above the threshold. With round example figures, 50 people cost €12,000 a year at €20 each per month, or €10,800 with a €500 platform fee plus €8 per person.
Do employees need training before using AI?
Yes, and not just as common sense: article 4 of the AI Act, applicable since 2 February 2025 and rewritten in July 2026, requires those who use AI systems to take measures to support the skills of their staff. No specific level has to be guaranteed for each person, but the measures must be concrete and suited to who uses the tool and for what.
Is data uploaded to an AI assistant used to train the models?
It depends on the vendor and the contract, and it often differs between the personal and business versions of the same tool. Ask for a written clause covering documents, questions and answers, and check who processes the data on the vendor’s behalf.
How do you switch AI vendor without losing your data?
Ask what can be exported, and in which format, before you sign. For cloud services contracted today, the EU Data Act provides at most two months’ notice, as a rule a switch within 30 days, and at least 30 days to retrieve the data; from 12 January 2027 switching cannot be charged.
Sources
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex, articles 4 and 113.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), 8 July 2026, published on 24 July 2026, EUR-Lex.
- Regulation (EU) 2016/679 (GDPR), EUR-Lex, article 28 and Chapter V.
- Regulation (EU) 2023/2854 (Data Act), EUR-Lex, articles 25, 28, 29 and 50.
- Italian Law no. 132 of 23 September 2025, Gazzetta Ufficiale, article 11, and Legislative Decree no. 152 of 26 May 1997, article 1-bis.
- Istat, Imprese e ICT, anno 2025, 15 December 2025.
- Osservatorio Artificial Intelligence, Politecnico di Milano, Intelligenza Artificiale in Italia, February 2026.
- V. Magesh, F. Surani, M. Dahl, M. Suzgun, C. D. Manning and D. E. Ho, Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools, Stanford University, 2024.
- Microsoft, Data, Privacy, and Security for Microsoft Copilot, Microsoft Learn, updated October 2026.