Before an Irish SME signs with an AI vendor, get written answers on five things: whose model it runs on, whether it trains on your data, where data goes, who carries the error, and how you exit.
Most Irish SMEs buy AI the way they buy any other software. A demo, a trial, a monthly price, a click on the terms. Then it gets used on client files.
That process was fine for accounting software. It does not hold up for AI tools, because the questions that matter are not on the pricing page and the sales rep usually cannot answer them. You have to ask in writing, and you have to ask before you sign. Once the tool is embedded in how a team works, you have lost the leverage to get a straight answer.
Five questions cover most of the exposure. None of them need a lawyer to ask.
Whose model is actually running underneath
A large share of the AI products pitched to Irish businesses are a layer on top of a model from OpenAI, Anthropic, Google or Microsoft. There is nothing wrong with that. It does mean your data passes through at least two companies, and the terms you signed with the first one may say nothing about the second.
Ask the vendor to name the underlying model provider, the contract they hold with that provider, and whether it is an enterprise agreement with zero data retention or a standard API account. If they will not tell you, you have your answer about how the rest of the relationship will go.
Whether it trains on your data
This is the question every vendor has a rehearsed answer to, and the rehearsed answer is usually "we don't train on customer data". Get the clause, not the sentence. Look for three things in it: whether your inputs and outputs are used to improve the product, whether "anonymised" or "aggregated" data is carved out of the promise, and whether the default changes on a free or cheaper tier.
We regularly find the carve-out doing the work. The headline commitment is real, and a paragraph later the vendor reserves the right to use de-identified usage data for "service improvement". For a firm handling client financials or HR files, that paragraph is the contract.
Where the data goes and who else touches it
Under GDPR the vendor is your processor, which means you need an Article 28 data processing agreement, a list of sub-processors, and a clear statement of where data is stored and processed. Transfers outside the EEA are allowed, but they need a legal basis you can point to.
Ask for the sub-processor list and read it. A tool that looks like a single product can involve a hosting provider, a model provider, a transcription service and an analytics platform. Each one is a place your client's data now sits. The Data Protection Commission will not accept "the vendor handled that" as an answer if something goes wrong. You are the controller.
Who carries the cost when it is wrong
AI output is sometimes wrong, and the standard terms put all of that on you. Most vendor agreements cap liability at the fees paid in the previous twelve months and exclude anything consequential. For a €40-a-month tool used to draft client advice, that cap is €480.
You probably will not negotiate that away as a small customer, and that is fine. The point is to know it before deployment, so the review step in your own process is designed around the fact that the vendor has accepted no responsibility for the output. The accountable person is inside your firm. Write down who it is.
Where you sit under the EU AI Act
Most SME use of AI makes you a deployer under the EU AI Act. The vendor is the provider. For general productivity tools the deployer obligations are light, but two already apply. Article 4 requires staff using AI systems to have sufficient AI literacy, and Article 50 has required anything that converses with the public to disclose that it is AI since 2 August 2026. If the vendor is supplying a customer-facing chatbot, ask how their product handles that disclosure and whether you can configure it.
The picture changes if the tool touches hiring, credit decisions or access to essential services. Those are high-risk uses under Annex III. Ask the vendor directly whether they consider their product high-risk, and what their plan is for the provider obligations that come with it. A vendor selling CV screening into Ireland who has not thought about this is a vendor you will be explaining to a regulator.
How you get out
Ask what happens to your data when you cancel, how long it is retained, and in what format you can take it with you. Prompts, templates, configured workflows and outputs all have value once a team has built them up over a year. If they only exist inside the vendor's platform, switching costs you that year.
Also ask whether AI features can be switched off independently of the wider product. Some platforms are now enabling AI functions by default inside tools you already pay for, which means the due diligence moment has passed before anyone noticed it arrived.
Put the answers on one page
None of this needs a procurement department. It needs one person to send five questions by email, file the replies, and check them against the firm's AI policy before anyone signs. Most vendors worth using will answer within a week. The ones that will not are telling you something useful.
Acuity AI Advisory helps Irish SMEs work out which AI tools are already in use, which ones are carrying exposure the firm has not seen, and what questions to put to vendors before the next contract. Our AI readiness diagnostic for SMEs is where that usually starts. If you want that conversation, get in touch.