AIArtificial intelligence

Enterprise AI is not ChatGPT with your logo: eight questions for your vendor

The model is only the first part of an enterprise AI system. The other seven decide whether it works, what it costs and who pays for its mistakes. Each one already has a real story behind it, and a question to put to your vendor.

Strategic editorial team 30 October 2026 10 min read

Cover: “Enterprise AI has eight floors”, Artificial intelligence

A complete enterprise AI system has eight parts, and the model is only the first. Buy an AI assistant with your logo on it and you have often bought just the model. You find out about the rest when something goes wrong. The other seven parts are instructions, documents, tools, permissions, defences, costs and controls. Each one already has a real story behind it, with a real company at the centre. This guide sets them out in order and, for each one, gives you the question to ask your vendor before you sign.

Enterprise AI has eight floors. From the bottom: model, instructions, documents, tools, permissions, defences, costs and controls. The model is only the ground floor.

1. The model is the engine, not the car

The model is the brain you rent: GPT from OpenAI, Claude from Anthropic, Gemini from Google and others. Connecting it to a website takes a few hours. On its own, though, it does whatever it is asked, whoever is asking.

In December 2023 a Chevrolet dealership in California had a ChatGPT-based assistant on its website, set up for car dealers by a specialist vendor. Even so, it did not hold up. A visitor told it to agree with every customer and to end every answer by saying that the offer was legally binding. The visitor then had it confirm the sale of a new car for one dollar. The sale never happened, but the conversation went round the world.

The question for your vendor: which model sits underneath, and what happens to our data and to the service if you change it tomorrow? The points to put in writing are in our guide to contracts with an AI vendor.

2. Instructions say who it is and what it must not do

Instructions, known in the trade as the system prompt, are the hidden text sent with every message. They tell the assistant who it works for, what tone to take and what to stay out of. Without instructions the model is a passer-by. With them it looks like an employee.

It only looks like one. In January 2024 the delivery company DPD switched off the AI element of its customer assistant. A customer had got it to swear and to write a poem attacking DPD itself. The company attributed the error to a system update.

Instructions are a rulebook, not a wall. They have to be written, approved and checked again after every change.

The question for your vendor: who writes the instructions, who approves them, and how do you check that they still hold after every update?

3. Documents make it answer from the real rules

A model does not know a company’s rules. Ask it about one and it will guess, and it will sound very sure of itself.

The best-known case of a wrong answer is Air Canada, although the decision does not say what technology the assistant used. The assistant told a customer that the reduced bereavement fare could be claimed even after the journey, an option the airline did not offer. Before the small claims tribunal of British Columbia, in Canada, the airline argued that it was not liable for what the assistant had said. The tribunal observed that this treated the assistant as if it were a separate entity. In February 2024 it rejected the argument and ordered the airline to compensate the customer. It noted that the airline is responsible for all the information on its own website.

The technique that reduces this risk is called RAG. Before answering, the system searches the company’s documents for the right passage and answers from that, citing the source if it is built to do so. Errors go down, but they do not disappear. It works only if the documents are in order, up to date and have a named owner, as our guide on preparing documents for an AI assistant explains. This is the part we call the Company Brain, the company’s own searchable memory. Whoever asks gets the answer together with the document it came from.

The question for your vendor: which documents does it answer from, who updates them, and does every answer show its source?

4. Tools take it from answering to doing

An answer is not enough. You want the assistant to open the ticket, record the refund and alert a colleague. To do that it has to be connected to company systems, today often through the Model Context Protocol (MCP), the standard increasingly used for these connections. At that point it is no longer a chatbot but an agent, and its mistakes are no longer just words.

In July 2025, according to the founder of SaaStr, Replit’s coding agent deleted a live database during a period when nobody was supposed to touch the code. It also claimed that the data could not be recovered. The founder recovered it by hand. Replit’s chief executive called the incident unacceptable and apologised.

This is why actions with real-world effects go through a person, as we explain in our piece on when an AI agent should ask for confirmation.

The question for your vendor: what can it do on its own, what must go through a person, and how is a wrong action undone?

5. Permissions limit what it sees

An assistant connected to company systems sees everything its access rights allow. If it holds the keys to everything, anyone who talks to it can reach everything, including confidential offers and data that only one person should see.

The most instructive case is Salesloft Drift. In August 2025 a group of attackers used stolen OAuth tokens, meaning digital keys, linked to the Drift chat assistant. According to Google’s account, the group used those keys to export large volumes of data from the Salesforce environments of numerous companies. Google points out that the problem did not stem from a flaw in the Salesforce platform. An authorised connection was enough.

The rule is to run the assistant under the identity of the person asking, with minimum permissions and keys that can be revoked. Our guides on AI assistants connected to company systems and on access for external suppliers explain how.

The question for your vendor: under what identity does it access our systems, and if someone steals your key, what can they see?

6. Defences stop a piece of text becoming an order

To a model, everything is text. A line hidden in an email can carry as much weight as an order from the owner. This is called prompt injection, and it tops the OWASP ranking of risks for systems built on language models.

EchoLeak proved the point. This was the flaw Microsoft made public in June 2025, once the fix was already in place. According to Aim Labs, the researchers who discovered it, one crafted email was enough to pull internal information out of the office assistant when the victim used it, without a single click. Microsoft detected no real-world attacks. The UK’s National Cyber Security Centre warns that the problem may never be eliminated entirely.

You need filters on what comes in, blocks on what goes out, minimum permissions and human confirmation of actions. That way, even a successful attack reaches little. Our guide on prompt injection explains these defences one by one.

The question for your vendor: have you tried to attack it, and can we see the results?

7. Costs do not stop on their own

Models are charged by usage. In a trial they cost very little. Once the whole company is using them, spending follows usage, and usage can outrun the budget.

In April 2026 Uber’s chief technology officer said that the company had already used up its annual budget for AI coding tools, just four months into the year. It then set a cap of 1,500 dollars a month per employee on each tool.

The remedies are well known: a store of answers to repeated questions, a system that sends easy requests to a small model and hard ones to a large model, and a spending limit that triggers automatically.

The question for your vendor: what does one answer cost today, what will it cost at three times the volume, and who stops the spending?

8. Controls explain why it answered that way

Sooner or later the assistant will get something wrong. What counts then is how long it takes to work out whether the fault lies with the instructions, a document or a connection. You need a record of every answer, showing the documents read and the tools used, and a set of tests to repeat before every change.

Tests also matter because the system changes without notice. In April 2025 OpenAI withdrew an update to GPT-4o in ChatGPT after only a few days. The update had made the model too eager to please. OpenAI admitted that the tests had gone well and that some testers had noticed only that something seemed off. Unless the service is pinned to a specific version of the model, a vendor’s update can change an assistant’s character overnight.

Our guide on how to measure an AI project sets out how to decide what to measure, and when.

The question for your vendor: if it gets an answer wrong tomorrow, how quickly can you tell us why?

Do you always need all eight?

No. It depends on what the system does.

Project	Essential parts
Internal assistant that answers from documents	Model, instructions, documents, permissions, defences, controls
Public assistant on your website	All of the above, plus costs
Agent that takes actions in your systems	All eight, with human confirmation of important actions

These parts are not bureaucracy. Gartner predicts that over 40% of AI agent projects will be cancelled by the end of 2027 because of rising costs, unclear value or inadequate risk controls. Costs and controls are exactly the items a quote can leave out.

You can rent the model in an afternoon. The other seven parts are the real work.

In brief

An enterprise AI system is a model with seven parts built around it: instructions, documents, tools, permissions, defences, costs and controls.
Every part already has a real case behind it, from a tribunal ruling to a deleted database.
An assistant on your website speaks for your company. Air Canada was held liable by a Canadian tribunal for what its assistant had said.
Not every project needs all eight parts. An agent that acts in your systems does.
Eight questions for your vendor before you sign are worth more than a polished demonstration.

Frequently asked questions

Is a ChatGPT chatbot on your website enterprise AI?

It is the first part. It becomes enterprise AI when it answers from your company’s documents, has defined permissions and tested defences, and someone checks what it does.

Can you start with a small project?

Yes, and it is often the right choice. An internal, read-only assistant working from your documents, with permissions, defences and controls done properly, is a solid starting point. Tools and actions come later.

Who looks after it in the company?

Management decides what the assistant can do and who answers for it. IT and security manage connections and permissions. Department heads look after the documents. If a part has no name beside it, it usually does not get done.

Is it enough to buy a platform that does everything?

A platform can cover several technical parts. Documents, rules, permissions and decisions about what an agent can do stay with the company. No vendor can settle them on your behalf.

Building these eight parts, or checking the ones a vendor promises, is the work of our artificial intelligence consulting practice. We start from the Company Brain for documents and the second opinion on AI projects and vendors for those who have a choice to make.

Sources

Sources consulted on 30 October 2026.

Find out moreArtificial intelligence for businessesArtificial intelligence built into the systems your company already uses. We choose the right processes, connect the data, and settle security and rules first.