To choose an AI consulting firm, judge three things above all else: independence (are they free to recommend the right tool, or tied to selling one?), a production track record (have they shipped AI that runs every day, or only built demos?), and how seriously they treat your data (in South Africa, that means real POPIA awareness, not a line in a proposal). Everything else on the checklist below hangs off those three. A firm that is genuinely independent, has shipped real systems, and understands your data obligations is worth more than a bigger name that fails any one of them.
That is the summary. Here is the checklist to run before you sign anything, and the reasoning behind each item.
The buyer's checklist
Work through these before committing. If a firm cannot give straight answers to most of them, that is your answer.
- Are they independent? Can they recommend the model, platform, or approach that is right for you, including the cheap or boring option, without a commission riding on it? A firm that only ever arrives at one vendor's product is a reseller wearing a consultant's badge.
- Have they shipped to production? Ask for specifics: something that runs daily, on real data, that people rely on. A demo proves someone can impress a room. Production proves they can make something survive contact with the real world. These are different skills, and only one of them helps you.
- Do they start from your business or from the technology? A good firm asks about your decisions, tasks, and where time and money leak before it mentions a single tool. If the first meeting is a capability tour, they are selling, not diagnosing.
- Will they tell you where AI does not fit? The willingness to say "this part is not an AI problem" is one of the strongest signals of honesty you will get. If every question is met with enthusiasm, be careful.
- How do they handle your data and POPIA? In South Africa this is not optional. Ask where data is processed, who can see it, how personal information is protected, and how they would support your obligations under the Protection of Personal Information Act (POPIA). Vague answers here are disqualifying, especially in finance, health, or anything customer-facing.
- What do they leave behind? Documentation, access, and enough understanding for your team to operate and adjust the work. If the arrangement quietly makes you dependent on them forever, that is a business model, not a service.
- Is the pricing legible? You should understand what you are paying for and why. Clear engagement models beat a single mysterious number.
- Can they start small? A firm confident in its work will happily prove itself on a fixed-scope pilot rather than demanding a large upfront commitment.
Why independence sits at the top
Most of the noise in the AI market comes from firms whose advice is downstream of what they are paid to sell. There is nothing wrong with a vendor selling a product, but you should know which conversation you are in. An independent firm can tell you that your problem needs no AI at all, or that the simplest tool is the right one, because nothing about their revenue depends on you buying more than you need. That freedom is precisely what you are paying a consultant for. If you want the fuller argument, we have written about what an AI consultant actually does and why the useful work starts from your problems, not the product.
Why production experience is the real test
The gap between a demo and a production system is where most AI projects quietly die. A demo runs once, on clean data, with someone watching. Production runs unattended, on messy input, when things are going wrong elsewhere. A firm that has only ever built the former will underestimate the second, and you will discover the difference at the worst possible time. Ask pointed questions about failure handling, monitoring, and what happens when the data is bad, and you will quickly learn who has actually done this.
The South African angle: POPIA and data governance
Wherever your firm is based, if it is handling South African personal information it needs to understand POPIA in practice, not just cite it. That means knowing where data is processed, keeping personal information properly protected, being able to justify data flows to a regulator, and designing systems so that POPIA obligations are considered from the start rather than bolted on later. A firm that treats this as an afterthought is exposing you to risk it will not be around to absorb. This is a genuine advantage of working with people who understand the local regulatory context rather than a generic global template.
Putting it together
The best-fit firm is rarely the one with the loudest marketing. It is the one that is independent enough to give you honest advice, experienced enough to ship something that survives, and serious enough about your data to reduce your compliance risk. Before you decide, it helps to know what AI consulting typically costs in South Africa so the commercial conversation is grounded, and to see how we approach the work on our AI consulting page.
FAQ
How do I choose an AI consulting firm? Judge independence, production track record, and data governance first. An independent firm can recommend the right tool without a sales incentive, a production track record shows they can ship systems that run every day, and strong data governance (POPIA awareness in South Africa) reduces your compliance risk. Then check that they start from your problems, are honest about where AI does not fit, and can prove themselves on a small first engagement.
What questions should I ask an AI consulting firm? Ask whether they are independent of any vendor, for specific examples of AI they have running in production, how they handle your data under POPIA, what they leave behind for your team, and whether they will start with a small fixed-scope pilot. Straight answers to these tell you most of what you need to know.
What are the warning signs of a bad AI consulting firm? Reliance on polished demos rather than production examples, advice that always arrives at one vendor's product, vague answers on data and POPIA, a large upfront commitment with no small first step, and an arrangement that leaves you permanently dependent on them.
Do AI consulting firms need to understand POPIA? Yes, if they are handling South African personal information. They should be able to explain where data is processed, how it is protected, and how the system is designed to support your obligations under the Protection of Personal Information Act. Vague answers here should rule a firm out for anything sensitive.
Should I pick a big-name firm or a boutique one? Neither reputation nor size guarantees fit. Judge on independence, proven production work, and data governance rather than the name. A smaller firm that ships and understands your local obligations often serves a mid-sized business better than a large one running a generic playbook.
Written by JP, Sixees Labs. Last reviewed July 2026.