Data: the first question
- Is our data used to train models? (it should be “no” by default)
- Where is data stored and processed — EU or elsewhere?
- How long are prompts and files kept, and can we delete them?
- Is there a data processing agreement (DPA) under the GDPR?
Security and administration
- Single sign-on (SSO) and central user management
- Audit logs: who used what and when
- Admin control over features (web search, plug-ins, sharing)
- Certifications such as ISO 27001 or SOC 2
Consumer vs business plans
The same brand can have very different terms. A personal Plus or Pro plan is a consumer product; Business, Team or Enterprise plans typically exclude training on your data and come with a DPA. Company data belongs only in the latter.
Cost and lock-in
Price per user is only part of the cost: add training, review time and integrations. Prefer tools that let you export your data and prompts. For API use, estimate tokens — Slovenian text uses more tokens than English, so it costs more.
AI Act questions for vendors
For HR, credit or education tools, ask whether the system is high risk, what documentation and instructions for use they provide, how human oversight works and how you will be informed of changes. For chatbots, ask how users are told they are talking to AI.