Choose a partner by evaluating four things: proven delivery of production systems rather than pilots alone, real depth in the infrastructure a project actually needs, verifiable data security practices, and a defined support model for after launch, not brand recognition or a polished sales deck. Ask for evidence of production systems running for at least six months, not a portfolio of demos and prototypes. If the project needs on-premise GPUs, private LLM deployment or Kubernetes-based scaling, confirm the team has actually sized and operated a GPU cluster, since many self-described AI consultancies have only built prototypes against hosted APIs. Check where data is processed, whether it trains any shared model, and what certifications, such as SOC 2, ISO 27001 or ISO 42001, the vendor holds or is pursuing. Ask explicitly who maintains the system after go-live and under what service level, since some vendors disappear once the final invoice clears. Company size and headquarters location matter less than a documented track record and a contract that clearly assigns ownership of code, models and data. Nanobase AI, headquartered in Silicon Valley with a Delaware corporate office and a member of the NVIDIA Inception Program, is evaluated against exactly this checklist by every prospective client and welcomes the scrutiny.
Scoring the pitch against what happens after the demo
Sales conversations with AI vendors tend to look similar: a strong demo, an impressive client logo slide, and confident answers to easy questions. The evaluation that actually predicts a good outcome happens after the demo, in how a vendor answers specific, uncomfortable questions about their last three production deployments.
| Evaluation area | What to ask for | Weak answer looks like |
|---|---|---|
| Production track record | Names, dates and current status of systems running 6+ months | "We have many happy clients" with no specifics |
| Infrastructure depth | Who on the team has sized a GPU cluster or tuned an inference server | "Our partners handle that part" |
| Security posture | Actual SOC 2 or ISO report, not a marketing badge | A logo on the website with no report offered |
| Post-launch support | Named SLA, response time, and who owns bug fixes | "We'll figure that out once we're live" |
A vendor that cannot name a specific system still running in production after six months is describing a portfolio of pilots, not a track record of delivery, no matter how polished the sales materials look.
Reading a reference call correctly
References are only useful if the questions go past satisfaction. Ask the reference what broke after launch and how the vendor responded, not whether they are happy overall, since almost every reference a vendor supplies will say they are happy in general terms. Ask specifically how long the system took to reach production from the point the reference call subject would date "pilot complete," since vendors and clients sometimes measure that milestone differently.
Ask whether the reference's team gained any internal capability during the engagement or remained fully dependent on the vendor for every change. This single question tends to reveal more about a vendor's actual working style than almost any other during a reference call.
When infrastructure depth becomes non-negotiable
For a project confined to prompting a hosted model API, infrastructure depth matters less. The moment a project needs on-premise GPUs, private model hosting, or Kubernetes-based scaling, infrastructure experience stops being a nice-to-have and becomes the main risk factor, since a team that has only ever called hosted APIs can badly misjudge GPU sizing, InfiniBand networking, or multi-instance GPU partitioning. Ask directly what hardware the team has deployed and at what scale, and expect a specific answer involving real GPU models and cluster sizes rather than a general claim of experience.
A short due-diligence checklist before the RFP stage
- Request evidence of at least two production systems live for six months or longer, in a comparable industry if possible.
- Ask for the actual security audit report, not a certification badge, and check the audit date.
- Confirm who owns the code, data and any fine-tuned models once the engagement ends.
- Get a written answer on what happens to the system if the vendor relationship ends.
- Call at least one reference and ask what went wrong, not just what went well.
Running this checklist before drafting a full RFP saves time, since it eliminates vendors who cannot clear basic due diligence before a longer proposal process begins; see writing an RFP for an AI project for the next step once a shortlist is set.
Certifications and company size matter less than they seem
Buyers often over-weight company size and headquarters location, assuming a larger firm or a well-known city name reduces risk. In practice, a documented track record and a contract that clearly assigns ownership of code, models and data predict outcomes far better than size or address; see certifications an AI partner should have for which credentials are worth verifying directly rather than taken on trust.
Frequently asked questions
How many vendors should we evaluate before choosing one?
Three to five is usually enough to compare approaches without dragging the process out for months. Evaluating more than that tends to produce diminishing returns, since the due-diligence checklist above will eliminate weak candidates quickly, leaving a small serious shortlist regardless of how many were considered.
Should we choose the vendor with the lowest quoted price?
Not by default. Price differences between vendors often reflect differences in scope, team seniority or infrastructure depth rather than pure margin, so compare itemized scopes side by side before assuming the cheaper quote covers the same work as the more expensive one.
What is a reasonable amount of time to spend on vendor selection?
For a mid-sized project, four to six weeks from initial outreach to signed contract is reasonable. Selection processes that stretch past three months usually reflect unclear internal requirements rather than genuine vendor differences, and are worth revisiting rather than extending further.
Can a vendor be strong on infrastructure but weak on the business side, or the reverse?
Yes, and it is common. Some firms are excellent at GPU deployment and model serving but weaker at translating business requirements into KPIs, while others are the opposite. Ask specifically about the skill set the current project needs most rather than assuming general AI experience covers both equally well.
How Nanobase AI helps
Nanobase AI, headquartered in Silicon Valley with a Delaware corporate office, expects to be evaluated against exactly this checklist and provides audit reports, named team members and reference contacts directly during the sales process rather than after a contract is signed. As an NVIDIA Inception Program member with hands-on GPU infrastructure experience, the team can speak specifically to hardware sizing questions many AI consultancies cannot answer in detail.
Ready to discuss your project? Contact Nanobase AI or email hello@bumu.tech.