The short answer
Choose the partner that asks about your work before mentioning a product, and can connect AI to your systems, secure it, test it on your own examples and support it. It says plainly where your data goes, who owns what it builds, what it costs to run, and when AI is not the answer. No testing plan, or "AI transformation" without a named, measured use case? Keep looking.
What to look for
Ten criteria separate partners; the worksheet below tests most of them.
- Starts with your problems
- Vendor-neutral
- Works with your real systems
- Security competence
- Evaluation and testing
- Governance and data protection
- Support after launch
- Honesty about fit
- Clear scope and costs, in naira
- You own what is built
Security competence means designing against prompt injection, sensitive data disclosure and excessive agency, risks named in OWASP's Top 10 for LLM applications.
What good looks like for each criterion
| Criterion | What good looks like |
|---|---|
| Starts with your problems | Asks about tasks, volumes, errors and owners before naming any tool |
| Vendor-neutral | Compares Microsoft 365 Copilot, cloud AI services and self-hostable open-weight models; explains trade-offs; discloses commercial interests |
| Works with your real systems | Has connected AI to ERPs, Microsoft 365 and CRMs through supported APIs, respecting each user's permissions |
| Security competence | Designs against prompt injection, sensitive data disclosure and excessive agency |
| Evaluation and testing | A test set from your real examples; accuracy thresholds agreed before building |
| Governance and data protection | Knows how the NDPA and the NDPC's GAID 2025 apply to AI, including transfers abroad; works alongside your legal advisers |
| Support after launch | Monitors accuracy and cost, re-tests after model changes, works under a service agreement |
| Honesty about fit | Recommends a simple rule, a report or no change when that works better |
| Clear scope and costs | Written, phased scope; one-time and ongoing costs separated, in naira (or US dollars where a licence or service is priced in dollars) |
| Ownership | Code, prompts, configuration, test sets and data are yours, in accounts you control |
On governance, ask for specifics. The Nigeria Data Protection Act 2023 (NDPA), for example, gives people the right not to be subject to a decision based solely on automated processing that significantly affects them, and the NDPC's General Application and Implementation Directive (GAID) 2025 makes a data protection impact assessment (DPIA) mandatory for automated decisions with significant effects and for transfers outside Nigeria, among other things; see AI and the NDPA. Voluntary frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 structure AI risk management; a good partner explains how it uses them without claiming to certify you. General information, not legal advice. For what a complete proposal should separate, see what an AI project costs.
Red flags
- Promised results with no testing behind them
- Vague "AI transformation"
- No testing plan
- Demo-only
- Proprietary lock-in
- One answer for every problem
- No answer to "where does our data go?"
Nobody can promise accuracy or savings before testing on your data.
Why each is a red flag
- Promised results: accuracy and savings are unknown until tested on your data.
- Vague "AI transformation": a programme with no named use case, owner or measure is a cost, not a plan.
- No testing plan: if they cannot say how accuracy is measured and what it must pass, you find out in production.
- Demo-only: an impressive demo on sample data says little about your documents, permissions or systems.
- Lock-in: your prompts, configuration and data live in their platform, with no export and no handover.
- One answer for everything: if every use case leads to the same product, ask why.
Questions to ask a prospective partner
- Which problem would you solve first, and how would we measure success?
- Which platforms would you consider, and do you earn from recommending one?
- How will it reach our ERP, Microsoft 365 and CRM, with whose permissions?
- Where is our data processed and stored? Is any used for training?
- If our data cannot leave our environment, can you run an open-weight model on servers we control?
- How will you test accuracy, and what must it pass before launch?
- How do you test for prompt injection and data leakage?
- What happens if the proof of concept misses its thresholds?
- Which costs are one-time, ongoing, or metered by usage?
- Who owns the code, prompts, configuration and test sets?
- Who supports it after launch, and on what terms?
- When did you last advise against using AI, and why?
Three objections, answered honestly
| Objection | Honest answer |
|---|---|
| "We are too small." | Scale the project, not the discipline: one contained use case, a short policy, the right licences. A focused assessment or single proof of concept stops you paying for unused tools. |
| "Can't we just use ChatGPT?" | A business-grade assistant under a clear policy is a sensible start for drafting and learning; we often recommend one. It does not know your systems, apply your permissions or update your ERP, and consumer accounts can have different data terms. |
| "AI moves too fast to plan." | Models change; your problems, data, permissions and controls do not. Plan around the use case and its test set, keep the model swappable, and work in short phases with decision points. |
For the general-assistant route, see our comparison of Copilot, ChatGPT and Gemini and AI acceptable use policy guide.
Rather talk it through? If you are comparing AI partners, bring your use case and the questions above, and we will show you exactly how we would scope, test and support it. Talk to a Promatics specialist
What working with Promatics on AI looks like
- AssessmentWork, data, systems, permissions and current AI use reviewed; you own the roadmap.
- Proof of conceptYour data, handled safely, against agreed thresholds; go or no-go with production estimate.
- BuildIntegrated, permissions and logging applied, approval points designed, security tested.
- LaunchTraining, staged rollout, accuracy, adoption and running costs monitored.
- Managed supportMonitoring, re-testing and improvements, with response targets in a service agreement.
We score use cases on value, readiness, risk and cost, integrate with Microsoft 365, Prometheus and ERPNext or your CRM, and run each proof of concept against agreed thresholds. Managed-service clients get 24/7 monitoring and support.
Why it matters: AI projects rarely fail on the model, but on permissions, messy data, missing integrations, weak security and nobody owning the system. We handle those daily as a managed IT, cybersecurity and business systems partner, so there is no gap between who built the assistant and who runs the systems it depends on.
When to bring in help
Trying Copilot Chat or built-in AI features on non-sensitive work, under a policy? You may not need a partner yet. Bring one in when AI touches personal data, money or decisions about people, connects to core systems, must show a board, funder or regulator evidence of control, or needs evaluation and security skills you lack. Our AI strategy and readiness service is the usual start, and AI governance and security covers policy, risk assessment and testing.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- AI Risk Management Framework, National Institute of Standards and Technology (NIST)
- Top 10 risks and mitigations for LLMs and generative AI apps, OWASP Gen AI Security Project
- Data, privacy, and security for Foundry Models sold by Azure in Microsoft Foundry, Microsoft Learn
- Nigeria Data Protection Act 2023, Nigeria Data Protection Commission
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.