AI Consulting: 20 Questions Before Signing a Contract

By Pedro Sonda, dooop

Before signing a contract with an AI consulting firm, confirm six topics: scope and acceptance criteria, team and substitutions, data and confidentiality, ownership of produced materials, use of AI by the provider, and price, changes, and exit conditions. The 20 questions in this article cover these topics and help turn what was promised in the proposal into clear obligations.

Updated October 2026.

Transparency note: dooop is an AI consulting firm and signs contracts as a provider. These questions apply to any provider, including dooop. This content does not replace legal advice.

Why AI Consulting Contracts Require Specific Questions

Traditional consulting contracts address scope, deadlines, and price. In AI, three topics gain importance:

Data: the consulting firm will access processes and often personal data. The LGPD defines the roles of controller and processor and their respective responsibilities (Law 13.709/2018).
Ownership: the work produces materials the company will continue to use, such as prioritization criteria, policies, and decision models.
Use of AI by the provider: consulting firms use AI tools to research, analyze, and draft. In 2025, Deloitte agreed to refund part of a contract with the Australian government after a delivered report contained references and citations with errors attributed to generative AI use; the revised version disclosed the use of the tool (The Register, 2025).

Implication: the case does not indicate that using AI in deliverables is a problem. It indicates that the contract should specify how this use occurs and who reviews the results.

dooop Framework: The 20 Questions in 6 Blocks

Block 1: Scope and Acceptance

Are the deliverables listed individually, with descriptions of the expected content?
What are the acceptance criteria for each deliverable, and who in the company approves them?
What is explicitly out of scope?
How many hours of internal team effort does the work require, and from whom?

Block 2: Team

Who are the people named in the contract, with roles and dedication?
Does substitution of key personnel require company approval?
Is there use of third parties or subcontractors? Who are they and under what rules?

Block 3: Data and Confidentiality

What data will the consulting firm access, where will it be stored, and for how long?
Who is the controller and who is the processor of personal data treated, under LGPD terms?
What happens to the company’s data and documents at the end of the contract (return or deletion)?
How will security incidents involving company data be communicated?

Block 4: Intellectual Property

Who owns the deliverables: reports, policies, criteria, and decision models produced for the company?
Which pre-existing methods and materials of the provider will be used, and will the company have a license to continue using them?
Can the provider reuse learnings or materials from the project with other clients? Under what conditions?

Block 5: Use of AI by the Provider

Does the provider use AI tools in the deliverables? Which ones and for what purpose?
Can company data be entered into these tools? Under what conditions and with what privacy settings?
How is human review conducted on content produced with AI, especially regarding data, sources, and citations?

Block 6: Price, Changes, and Exit

Is the price divided by phase and deliverable, with rules for scope changes?
Can the company terminate the contract at the end of each phase, and under what conditions?
How will the transition at the end be handled: what does the internal team receive and how do they take over the work?

How to Use the 20 Questions

Moment	What to Do
Before the proposal	Include blocks 3 to 5 in the briefing so providers answer them upfront
During comparison	Use the answers as criteria in the scorecard
During negotiation	Incorporate the answers into the contract text
Before signing	Review with legal, IT, and information security teams

Interpretation: a provider who answers all 20 questions clearly and without resistance demonstrates maturity. Vague answers in blocks 3 to 5 are a warning sign.

Regulatory Context

Bill PL 2338/2023, the proposed AI legal framework in Brazil, was approved by the Senate in December 2024 and is under review in the Chamber of Deputies, with voting expected after the October 2026 elections (Chamber; LCF Monitor). Meanwhile, the LGPD already applies to personal data processing in AI projects. Long contracts may provide for clause revisions if regulations change.

What to Do Now

Send the 20 questions to finalists before final negotiation.
Compare the answers in the same format; see How to Compare AI Consulting Proposals.
Review with legal and security teams before signing.

If you want to receive dooop’s answers to the 20 questions, contact is at dooop.com.br/contato.

Frequently Asked Questions

Do all 20 questions apply to small projects? For short projects without personal data, blocks 1, 4, and 5 tend to be the most important. Blocks 2, 3, and 6 gain importance as the project grows.

Is prohibiting the provider’s use of AI a good idea? Generally, no. It makes more sense to define under what conditions AI can be used, which data can be entered into the tools, and how the results are reviewed.

About dooop

dooop is a consulting firm based in Caxias do Sul (RS) that prepares leaders and organizations to transform artificial intelligence into business capability through strategy, governance, and training.