The Checklist to Run Before You Add an AI Tool to Your Stack

The cost of adopting a tool is small and immediate. The cost of removing one is large and deferred, which is exactly the shape of decision people make badly. An hour of checks up front is the cheapest insurance available.

Data

• What goes in? Write down the most sensitive category of data that will realistically pass through it — not the category you intend, the one that will happen.
• Is your input used for training? Find the setting, find the default, and find out whether the default differs by plan.
• Where is it processed and retained, and for how long? Retention windows matter more than storage location for most teams.
• Who at the vendor can see it? Support access is normal; undisclosed support access is not.

Output

• Who owns what comes out? Check the terms rather than assuming.
• What happens when it is wrong? Establish who reviews output before it reaches a customer, and make that a person rather than a policy.
• Is generated content labelled? Decide your own rule before someone asks you what it is.

Cost

• Model the real volume. Pilot usage is not production usage; multiply by the number of people who will eventually have access.
• Find the overage behaviour. A tool that throttles is a support ticket. A tool that silently bills is a finance conversation.
• Count the seats you will actually need, including the occasional user who still needs a login.

Integration

• Does it reach the systems where the work lives? A tool that cannot see your data becomes a copy-paste job, and copy-paste jobs get abandoned.
• Is there an API and does it match the interface? A capable UI over a thin API means automation later is a rewrite.
• How does authentication work? Shared logins are a security finding waiting to be written up.

Exit

• Export everything on day one. Not as a test of the feature — as a check that the format is one another tool can read.
• Confirm deletion is real and find out how long it takes.
• Name the replacement. If you cannot name a plausible alternative, you have already accepted lock-in; decide that deliberately rather than by default.

The one-hour version

If you only do three things: read the data-training clause, export your data on the first day, and model the cost at ten times pilot volume. Those three catch most of what the other nine would have caught, and they take about twenty minutes each.