Skip to content

STRATEGICRepublic of San Marino

AboutContact
ItalianoEnglish
Client area
Contact

Second opinion on AI projects and vendors

A second opinion on AI projects and vendors, before you sign

The demo was convincing, the quote is on the table and the vendor wants a signature. Before you commit the company for years, we read the proposal, the architecture and the contract with a technical eye. Where does the data go? What will it cost over time? How do you get out? In this service we do not offer products of our own.

Ask for a second opinionThe three questions
Example of a second opinion. The contract for an AI assistant is annotated in the margin on four points: data in the European Union is clear, use for training and logs need clarifying, and the return of data needs renegotiating. Beside it, the summary for management and the steps before signing.
Example · the contract and vendor shown are not real
The reviewer isn’t selling
no stake in the proposal under review
Technology and contract together
read alongside the company’s lawyer
A written report
the points to clarify before signing

01 · copy the link to this sectionThe situation

The demo wins people over. The contract usually goes unread.

An AI proposal has two parts to assess: what you see in the demo and what the clauses say.

The presentation went well. The assistant answered every question, the screens looked polished and the vendor is in a hurry to start. What is left on the table is a quote, a service contract and a data processing agreement that procurement has to approve by the end of the week.

The demo runs on carefully chosen documents. The company’s own documents are many and old, and they come in several versions. The first-year price is clear. The third-year price depends on usage. And almost nobody asks how to get out.

Finding out later is expensive. Customer data may be processed in a country nobody expected, bills grow with usage and the system cannot be moved. Before signing, these questions take one email to the vendor. After signing, they become a negotiation.

A demo of an AI assistant answering well on documents prepared by the vendor. Beside it, a contract with annexes and a usage-based price list that nobody has read, a quote with no line for exit, and an email asking for a signature by Friday.

02 · copy the link to this sectionBefore signing

The three questions to ask before you sign

Three simple questions to put to any vendor. The answers already tell you a lot.

AIQuestion 1 Does your adviser also profit from the sale? If the people recommending the solution also sell it and build it, the advice is not neutral. That is not necessarily a bad thing, but you need to know. Compare the proposal with at least one alternative, on the same criteria.
AIQuestion 2 How do you get out? Think of the data, the uploaded documents, the configurations and the instructions given to the model. What comes back to the company, in what format, how quickly and at what cost? If the answer is vague, the cost of leaving is already hidden in the price.
AIQuestion 3 Where does the data go, and who uses it? Ask which countries it is processed in, how long it is kept and whether it can be used to train the vendor’s models, meaning to improve them with your company’s content. The answer must be written in the contract, not said in a meeting.

03 · copy the link to this sectionWhat we do

What we look at

Six parts of the same decision. For each one, we set out what the proposal says and what is missing.

AI The proposal What the system really does, what is and isn’t included, and what the company has to do on its side. Vague promises become precise questions.
AI The architecture Where the system reads data from, how it connects to your ERP, archives and email, which model it uses and whether that model can be replaced. We explain the weak points in plain language.
AI The contract and the data Who processes the data and in what role, where the servers are, how long information is kept, whether it is used for training and which other suppliers are involved.
AI Costs over time Licences, model usage, integrations, support and your own staff’s hours. We work out what it may cost over the years, not just in the first, with the assumptions written down.
AI

Exit

The format of the data you get back, timelines, costs and support when moving to another vendor or to an in-house system. In the European Union, the Data Act sets minimum rules for cloud services. The rules that matter
AI Security Permissions, access logs, defences against instructions hidden in documents (so-called prompt injection) and incident handling. We also check what the vendor’s stated assurances really cover.

04 · copy the link to this sectionTransparency rule

In this service we do not offer our own products

Strategic also develops and distributes AI software (DIREKTA, Kristina Reply, Autochatter). That is why the rule is written down here.

  • We assess the proposal from the vendor the company is considering. We do not replace it with one of our own.

  • If the company explicitly asks for alternatives and one of them is a Strategic tool, we label it as ours and compare it with the others on the same criteria.

  • If we conclude that the proposal is fine as it is, the report says so.

Our other AI services follow the general rule. When one of the options is our own product, we declare it and compare it with the alternatives. Updated 16 September 2026.

How we use artificial intelligence

05 · copy the link to this sectionHow we work

From the proposal you received to a report for the decision-makers

Each step answers a practical question: what is needed, who handles it and what stays in the company’s hands.

Example of a second-opinion report: a confidential cover page with the contents, a table of the points to clarify before signing with the status of each, and a summary for management with questions for the vendor, changes for the lawyer and cost assumptions.
Example · the report and vendor are not real

Scoping conversation

We clarify what needs reading, when you need an answer and who will make the decision.

Document review

We read the proposal, the contract, the data processing terms and the technical documentation. The review draws on software development, database and security expertise. The clauses are examined together with the company’s lawyer.

Questions to the vendor

Unclear points become written questions. With the company’s consent, they can also be discussed in a meeting with the vendor. An unanswered question already tells you something.

Report and debrief meeting

You receive a written report with the points to clarify before signing, the changes to request from the vendor and a summary for management. We present it in a meeting with the decision-makers.

After the decision

If the company signs, we can check the launch against the criteria set down in writing, covering data, acceptance testing and costs. If it does not sign, the report remains a basis for comparing another vendor.

Timing
Timing is agreed around the signing deadline. In the scoping conversation we check whether that deadline fits the volume of documents to read. If it doesn’t, we say so straight away.
Costs
They depend on how many documents there are and how many systems the project touches. The first conversation carries no commitment. If there is work to be done, you receive a written proposal for the initial assessment, usually one or two days of work with the people involved. After the assessment comes the proposal for the project, with phases, timing and costs.
What the company keeps
You keep the report with the points to clarify and the proposed changes, and the summary for management to attach to the decision. You also keep the written questions sent to the vendor with the answers received, and the cost assumptions over the years with the calculations.

06 · copy the link to this sectionReference

The rules that matter in an AI contract

Updated 16 September 2026

A contract with an AI vendor touches several different laws. This table sets out briefly what they require and where to look in the contract.

LawWhat it requires, in briefWhat it means for you: where to look in the contract
GDPR, Regulation (EU) 2016/679, Article 28, in the European UnionIf the vendor processes personal data on the company’s behalf, a contract is required. Among other things, it must cover documented instructions, confidentiality, security, rules for engaging sub-processors, deletion or return of the data at the end of the service, and the information needed for auditsThe data processing agreement, the list of sub-processors, what happens to the data at the end
GDPR, transfers outside Europe (Articles 44–49)Personal data may leave the European Economic Area only under the conditions the law sets outWhere the servers and support are located, and on what legal basis any transfers take place
Data Act, Regulation (EU) 2023/2854, Articles 23–25, 29 and 31, applicable from 12 September 2025For data processing services, including cloud and subscription software, the contract must allow you to switch provider. The notice period may not exceed two months, the transition period is normally no longer than 30 days and the data must be exportable. From 12 January 2027 the provider can no longer charge for switching. Some obligations do not apply to custom-built services or to services provided on a trial basis (Article 31)The termination and exit clause, data format, timelines, costs and support during the switch
AI Act, Regulation (EU) 2024/1689, Article 26, with the timeline set by Regulation (EU) 2026/1744Organisations that use a high-risk system must, among other things, follow its instructions for use, assign its oversight to competent people and keep the logs it generates for at least six months, unless other rules apply. For Annex III systems, such as recruitment, this applies from 2 December 2027The instructions for use, access to logs, information for the people who oversee the system
AI Act, Article 25Anyone who puts their own name or trademark on a high-risk system, substantially modifies it, or changes its purpose so that it becomes high-risk takes on the obligations of the providerWho does what: customisation, branding, intended purpose
Legislative Decree 138/2024 (Italy’s NIS2 law), for companies subject to NIS2The required security measures include oversight of suppliersThe AI vendor falls within your supplier assessment
Law No. 171 of 21 December 2018, in San MarinoProtection of individuals with regard to the processing of personal dataThe reference law for organisations in San Marino

This box is for information only and is not legal advice. The clauses are assessed with the company’s lawyer. For businesses in San Marino the framework is different and must be assessed case by case.

Sources (consulted on 16 September 2026)

07 · copy the link to this sectionIf the project goes ahead

After the second opinion

A second opinion settles one decision, but it often opens others. If the project starts, the same questions come back as work: connecting the system to the data without exposing it, securing it and preparing the people who will use it.

The rule on our own products applies here too. If, after the second opinion, the company asks Strategic to build the project, the report already delivered does not change.

Example of Company Brain: an answer with its sources cited and permissions applied.

08 · copy the link to this sectionPrinciples

What we don’t do

  • We don’t give legal opinions. The clauses are examined with the company’s lawyer, who signs off the legal assessments.
  • Alternatives from Strategic appear only if the company asks for them, and they are labelled as ours.
  • We don’t hand out seals of approval. The report describes risks and open questions. The decision stays with management.
  • We don’t assess a demo without documents. Without the proposal and the contract, a second opinion says too little.
  • We don’t promise savings. Sometimes the conclusion is that the proposal is fine as it is, and we put that in writing.
A good demo shows that the system can work. The contract tells you what happens when it doesn’t.

09 · copy the link to this sectionFrequently asked questions

Frequently asked questions about the second opinion

What is a second opinion on an AI vendor?
It is a technical review of the proposal, the architecture and the contract, carried out before signing by someone with no stake in the sale. It checks where the data goes, whether it can be used to train models, what the system will cost over the years, how to get out and how it is protected. The result is a written report with the points to clarify, the changes to request and a summary for management.
How is it different from a legal opinion?
A lawyer assesses whether the clauses are valid and protect the company. The second opinion checks whether what the contract describes matches how the system actually works. Where does the data go? What does the vendor keep? What can be exported, and in what format? The two reviews complement each other. That is why we work alongside the company’s lawyer, without replacing them.
Which documents do you need?
We usually need the technical and commercial proposal, the contract or general terms, the data processing agreement, the service levels and any technical documentation. If any are missing, asking the vendor for them is already the first step. A serious vendor makes them available before signing. Documents are sent after the first contact, through the agreed channel, not through the website form.
How long does it take?
It depends on the volume of documents and the number of systems involved. We agree the timing by working back from the date the decision has to be made. In the scoping conversation we check whether that date allows a serious review. If it doesn’t, we say so straight away. The company can then ask the vendor for more time or limit the review to the most important points.
How much does a second opinion cost?
We don’t publish price lists. The cost depends on how many documents need reading, how many systems the project touches and how many meetings with the vendor are needed. After the scoping conversation we send a written proposal with the cost, the timing and what is included and excluded. That way the company knows what it will spend before work begins.
Can the vendor use our data to train its models?
It depends on the terms of service. These often differ between consumer and business versions, and they can change over time. You need to check the contract and the data processing terms. Can the content be used to improve the models? How long is it kept? Who can access it? If the wording is unclear, ask for the answer in writing before signing.

10 · copy the link to this sectionObservatory

From the Observatory: artificial intelligence

Analysis and guides from the Strategic editorial team.

All articles on artificial intelligence

The essential parts of this page print as a short summary of a few pages, without images or invitations to get in touch.

11 · copy the link to this sectionContact

A proposal on the table? Let us read it before you sign

A few lines are enough. Tell us what the vendor is proposing, when the decision has to be made and who will make it. We reply by email, usually within two working days.

Please do not put contracts, quotes or confidential data in the form. Documents are sent after the first contact, through an agreed channel.

Or write to us:WhatsAppstaff@strategic.sm

On WhatsApp, messages are answered by Strategic’s AI assistant.

Your requestAISecond opinion on an AI project or vendor

Do any of these questions sound familiar? tick the ones that apply to you

The form opens with the topic and the questions already filled in.