How to Choose an AI Implementation Partner: A 10-Point Checklist for Your RFP
Choosing an AI implementation partner is a procurement decision. Treat it like one. The firms bidding will sound alike on the first call. The differences show up in the contract, the architecture and the people. This checklist puts ten questions in your RFP so every bidder answers the same things in writing. Score them on the same ten, and the choice gets clearer.
A quick definition before the list. An AI implementation partner is the firm responsible for getting AI to work inside your business and staying accountable after launch, per Master of Code (source). If you are still deciding whether you need one, start with What is an AI implementation partner? and the comparison with consultants, agencies and managed services.
The ten questions at a glance:
Who owns it
Who runs it after launch
Which KPI they answer for
Security posture, stated plainly
Single-tenant deployment
Exit terms
Pricing per function or seat
Proof with named clients
The first 90 days
Who does the work
1Who owns the code, the data and the infrastructure?
Ask for a plain answer, in writing, for each of the three. Code includes the prompts, the agent logic and the connectors. Data includes the knowledge base and every log. Infrastructure means the cloud accounts, the model API accounts and the credentials.
A good answer
All three sit in your accounts from day one. If the partner leaves, the system keeps running. You can hand the code to another firm or an internal hire.
A red flag. The system runs on the partner’s platform and you get access. That is a rental, and the function stops the day you cancel.
ShooflyAI’s position is that the client owns all of it. Other partners have other models. Get each one in writing.
2Who runs the system after launch?
A build with no operator drifts within a quarter. Ask who watches it weekly and who handles exceptions. Ask who adjusts prompts when the process changes, and who adds the next agent.
A good answer
The same team that built it operates it under a retainer, with named people and a response commitment. Alternatively, the partner trains your team and hands over documented runbooks.
A red flag. Support is a ticket queue with no owner, or the answer is “it just runs.”
3Which KPI is the partner accountable for?
The partner should name the function’s KPI before the build starts. Days to close. Lead response time. Onboarding cycle time. Hours of admin per week.
A good answer
A baseline measured before launch, a target agreed in writing, and a review cadence. The retainer conversation references that number.
A red flag. Vague productivity claims, or a KPI the partner picks after the build.
4What is the security posture, stated plainly?
Ask whether the partner holds SOC 2, and if so which type and report date. Ask how credentials are stored, how access is scoped, what is logged, and how model providers handle your data. Ask about BAAs if you are in healthcare and about data residency if you are regulated.
For the record, ShooflyAI does not hold SOC 2 today and has not commissioned a third-party penetration test. It says so on the first call. What it does have: single-tenant deployments in the client’s own accounts, a documented threat model, capability gating and approval routing in the runtime, and a 72-hour breach notice in the agreement. If SOC 2 is a hard gate for you this quarter, that is a reason to choose someone else, and a good partner will tell you that.
A good answer
A direct statement of what they have and do not have. Some partners hold SOC 2. Some are in progress. Some rely on the client's own cloud controls because the system runs in the client's accounts. Each can be acceptable if stated plainly and matched to your risk.
A red flag. A security page with no specifics, or a sales rep who has to check.
5Is the deployment single tenant?
Single tenant means your data, prompts and models run in an environment used only by you, usually your own cloud. Multi-tenant means you share infrastructure with the partner’s other clients.
A good answer
Single tenant, in your accounts, with your own model API keys. This also makes question 1 and question 6 simpler.
A red flag. A shared platform where your knowledge base sits next to other companies’ data.
6What are the exit terms?
Every engagement ends. Ask what happens on that day. Who holds the credentials. Whether the code and data transfer are complete and documented. Whether there is a transition period and what it costs. Whether any component is licensed and stops working after exit.
A good answer
Exit is a handover of documentation, because everything already sits in your accounts. Transition support is priced in the contract.
A red flag. Exit fees, licensed components that expire, or a system that has to be rebuilt to leave.
7Is pricing per function or per seat?
Price shape tells you what the partner is paid to do. Per-function pricing ties the fee to a business outcome. Per-seat pricing ties it to your headcount and usually signals a platform rental.
A good answer
A paid diagnostic, then a monthly retainer per function, with the diagnostic fee credited if you proceed. ShooflyAI's version is an Operating Blueprint at $6,000 through December 31, 2026, and $10,000 after that, credited to the retainer. The retainer starts at $7,500 a month per function. Ask every bidder for the equivalent.
A red flag. Per-seat fees, usage fees you cannot forecast, or a price that changes when your team grows.
8What proof exists, with named clients?
Ask for named clients, what is in production, what it does, and a reference call. Concrete facts beat percentages.
A good answer
Something like Strickland CPA: five AI agents in production, tax season run on a Shoofly dashboard, automated document routing, a DocuSign integration, and weekly EBITDA reporting. The client's own words: "Five agents we own now do the admin work that used to eat our weeks. We got our time back, and the system is ours." The client will take your call.
A red flag. Anonymized case studies with round-number ROI and no one to phone.
9What happens in the first 90 days?
Ask for the plan in writing with dates. The first 90 days should produce a decision, a working system, and a measurement.
A good answer
A diagnostic that names the function and the KPI. A first system in production. A baseline measured against the KPI. A plan for the next function. Go-live pace varies with the tools and with how fast you grant access. A single function on systems with APIs can be live in days; a department on systems without them takes weeks.
A red flag. A discovery phase with no end date, or a first deliverable that is a deck.
10Who does the work?
Ask for the names and roles of the people on your engagement. Ask whether any of it is subcontracted or offshored without your knowledge. Ask who answers when the system breaks at 7 a.m. on close day. Meet the engineer before you sign.
A good answer
Named builders and operators, a direct line to them, and a stated response window.
A red flag. A sales team you will never see again after signature, and a delivery team you have not met.
How to score the answers
Put all ten in a table with one column per bidder. Score each answer as clear, partial, or absent. Weight ownership, operations and exit terms highest, because those three decide what you are left with in year two.
Build the table
All ten questions, one column per bidder.
Score each answer
Clear, partial, or absent.
Weight three highest
Ownership, operations and exit terms decide what you are left with in year two.
Include the alternatives
An internal hire, a platform, a consultancy and a freelancer go in the same table.
Include the alternatives in the same table. An internal hire, a platform, a consultancy and a freelancer each answer these ten questions differently. Alternatives to hiring an AI implementation partner lays out when each one wins. ShooflyAI belongs in the table as one bidder among several, scored on the same ten.
Start with the diagnostic
Most partners, including ShooflyAI, start with a paid diagnostic. It names the function and the KPI, and it gives you a costed plan to put in front of every bidder. If you want that plan, book a Blueprint. You keep it whichever partner you choose, and the checklist above works on all of them.
Frequently asked questions
What should be in an RFP for an AI implementation partner?
Ten questions: ownership of code, data and infrastructure; who operates the system after launch; which KPI the partner is accountable for; security posture stated plainly, including SOC 2 status; whether the deployment is single tenant; exit terms; pricing per function; proof with named clients; a plan for the first 90 days; and who does the work.
Should the client own the code an AI implementation partner builds?
Yes, for core business functions. Ask whether the code, prompts, data and infrastructure sit in your accounts from day one and whether the system keeps running if the partner leaves. A partner that keeps the system on its platform is renting you a function. ShooflyAI's model gives the client all of it.
Does an AI implementation partner need SOC 2?
Ask, and expect a plain answer. Some partners hold SOC 2, some are in progress, and some rely on the client's cloud controls because the system runs in the client's accounts. ShooflyAI does not hold SOC 2 today and says so on the first call; its deployments run single tenant in the client's own accounts, with a documented threat model and a 72-hour breach notice in the agreement. Any of those can be acceptable. A vague answer is the red flag. Regulated industries should also ask about BAAs and data residency.
What does single tenant mean for AI systems?
Single tenant means your data, prompts and models run in an environment used only by you, usually your own cloud accounts. Multi-tenant means your data shares infrastructure with other clients on the partner's platform. For core business data, single tenant in your accounts is the safer default and makes exit simpler.
How should an AI implementation partner be priced?
Per function, on a monthly retainer, with a paid diagnostic up front. Per-seat pricing charges you for headcount as you grow and signals a platform rental. ShooflyAI charges an Operating Blueprint at $6,000 through December 31, 2026, and $10,000 after, credited to the retainer, which starts at $7,500 a month per function.
What proof should I ask for?
Named clients with concrete facts, and a reference call. Ask what is in production, what it does, and what changed. Strickland CPA is one example of named proof: five AI agents in production, tax season run on a Shoofly dashboard, automated document routing, DocuSign integration, and weekly EBITDA reporting. Reject anonymized case studies with round numbers.
What should the first 90 days look like?
A diagnostic that names the function and the KPI, a first working system in production, a measured baseline against that KPI, and a plan for the next function. Ask for the plan in writing with dates. A partner that cannot describe the first 90 days will not deliver them.
How do I find out who will actually do the work?
Ask for the names and roles of the people on your engagement and whether any of the work is subcontracted. Ask who answers the phone when the system breaks. Meet the engineer before you sign. Sales teams pitch and delivery teams build, and the gap between them is where engagements fail.