Data handling
What data the tool may receive, where it may go, retention/training signals and what workflows become exposed.
AI PROCUREMENT · PRE-SIGN REVIEW · EU SMES
Know whether you can safely buy this AI tool before you sign.
For Spanish and EU SMEs evaluating AI-enabled tools that may touch customer, employee, operational or sensitive business data.
WHAT I LOOK AT
A buying decision review, not generic AI consulting
I review the tool, use case, data path, vendor claims and public evidence so you can decide whether to proceed, constrain the use case, ask for more information or walk away.
Vendor evidence
Public docs, security/compliance materials, subprocessors, terms and unresolved unknowns.
AI Act and GDPR notes
Practical notes oriented around likely AI Act roles, data protection concerns and obligations to discuss with counsel.
Operational fit
Access controls, logging, admin settings, human review points and failure modes in the intended workflow.
Sensitive use cases
Signals around HR, support, customer records, commercial decisions and confidential company information.
Pre-sign questions
The specific questions to send the vendor before signature, rollout or renewal.
WHAT YOU GET
Concrete deliverables
- Recommendation: proceed, proceed with constraints, pause or do not buy
- Risk and unknowns register with rationale
- Data handling review for the intended workflow
- Vendor questions to resolve before signature
- Source register covering the evidence used
- AI Act/GDPR-oriented notes for your legal or DPO discussion
HOW IT WORKS
A focused 48–72h review
The work is designed for a live buying decision: enough depth to reduce avoidable risk, without turning procurement into a multi-week audit.
-
Scope the intended use
You send the vendor, the buying context, the workflow and the categories of data the tool would touch.
-
Review the evidence
I review vendor materials, public documentation, data-handling claims, controls and gaps.
-
Report and readout
You get an evidence-backed report and a call to walk through the recommendation, risks and open questions.
WHO IT IS FOR
Spanish and EU SMEs buying AI-enabled tools
Useful when a vendor offering AI features will touch information that matters and the team needs a sober technical view before signing.
Customer dataEmployee dataOperational workflowsSensitive business information
SCOPE
Explicit non-goals
This is a technical and procurement review to support a better buying decision. It is deliberately limited in scope.
- Not legal advice
- Not certification
- Not hacking or penetration testing
- Not private investigation
- Not automated scoring
Review the AI vendor before you sign
Send the tool name, intended use case and the data or workflow it will touch. I will confirm whether this review fits before we start.