AI tools all look alike in demos: they answer confidently, summarise texts and write drafts. The real differences lie elsewhere: in how they handle data, how well they adapt to business processes and what they really cost over time.
Here are 12 criteria for assessing business AI, with a table to use in vendor meetings. If you are still working out which activities you would use it for, start with the 10 AI use cases for SMEs.
1. Where the data is
Ask in which country the data is stored and processed and on what infrastructure. Location affects security and privacy obligations.
2. Use for training
Check whether the data you enter can be used to train or improve models. For company information this is a decisive point.
3. DPA and GDPR
You need a data processing agreement that clarifies roles and responsibilities. Also ask whether a data protection impact assessment (DPIA) is available.
4. Certifications
Verifiable security certifications are a concrete sign of the provider's attention to information protection.
5. Customisation on your processes
Useful AI knows the company's workflows: documents, rules, terminology. Ask who handles the configuration and how much work is required from you.
6. Policies and filters
You must be able to decide what the AI can do, which sources it uses and which content it blocks.
7. Integrations
The AI must work with the systems you already use. Check the integration options with your business software.
8. Roles and permissions
Not everyone should be able to do everything. You need separate roles for those who consult, edit and administer.
9. Cost and consumption control
The cost of AI can depend on usage. Check how consumption is measured and whether you can set limits.
10. Transparency
People who interact with an AI system must be informed. Ask how the provider supports this obligation.
11. Support in your language
Onboarding and support in your language reduce configuration time and errors.
12. Leaving the service
Before you start, ask how to retrieve your data and what happens to it if the contract ends.
Some criteria weigh more than others depending on the use. If the AI will handle personal data or confidential documents, location, use for training, DPA and certifications become priorities. If the goal is to automate processes, customisation, integrations and consumption control matter most. For the privacy aspects, also read our guide on AI at work, privacy and the GDPR.
The checklist as a table
Print the table and note each vendor's answer.
| # | Criterion | Question to ask | Answer |
|---|---|---|---|
| 1 | Where the data is | In which country is the data stored and processed? | |
| 2 | Use for training | Is my data used for training? | |
| 3 | DPA and GDPR | Is there a DPA? Is a DPIA available? | |
| 4 | Certifications | Which security certifications does the provider hold? | |
| 5 | Customisation on your processes | Who configures the AI on my processes? | |
| 6 | Policies and filters | Can I define company policies and filters? | |
| 7 | Integrations | Are APIs and integrations available? | |
| 8 | Roles and permissions | Which roles and permissions are available? | |
| 9 | Cost and consumption control | Can I control budget and consumption? | |
| 10 | Transparency | How are users informed that they are using AI? | |
| 11 | Support in your language | Is support available in your language? | |
| 12 | Leaving the service | How do I retrieve my data if I leave the service? |
How ThorIA meets the criteria
In the interest of transparency, here is how ThorIA, Thorsoft's business AI, measures up against the 12 criteria, based on the product page.
| Criterion | ThorIA |
|---|---|
| Where the data is | Data stored on AWS servers in Milan, Italy, delivered through the CloudFront network with edge locations also in Rome and Palermo. |
| Use for training | No, data is never used to train models. |
| DPA and GDPR | GDPR compliance; solution with a certified DPIA. |
| Certifications | ISO 27001, ISO 27017, ISO 27018. |
| Customisation on your processes | The Thorsoft team configures policies, sources and behaviour on the company's workflows. |
| Policies and filters | Company policies and filters, with content controls. |
| Integrations | Custom integrations (IntraThor does not expose public APIs); ThorIA is built into IntraThor. |
| Roles and permissions | Viewer, editor and owner roles and permissions. |
| Cost and consumption control | Customisable AI budget, consumption and users; consumption and billing per account; unlimited users. |
| Transparency | Thorsoft classifies ThorIA as limited risk under the AI Act and states that users always know they are interacting with an AI system. |
| Support in your language | Support in Italian and English, by email and phone. |
| Leaving the service | To be agreed with Thorsoft at contract stage. |
Thorsoft classifies ThorIA in the limited-risk category of the AI Act. The final assessment is up to each company, based on how it intends to use the tool.
How to use the checklist in practice
- Write down the concrete use cases you want to address before looking at offers.
- Send the same checklist questions to every vendor you assess.
- Ask for written answers and documentation, not just a sales presentation.
- Test the tool with a small group of users and real documents.
- Compare the results and involve IT and privacy in the final decision.
F.A.Q. - Frequently asked questions
What is the most important criterion when choosing business AI?
It depends on the use, but for company data the decisive factors are where the data is located and the guarantee that it is not used for training.
Why do I need a DPA?
The DPA defines roles and responsibilities for processing personal data between the company and the provider, as required by the GDPR.
How can I control the costs of business AI?
Check how consumption is measured, whether you can set a budget and whether the price depends on the number of users.
What should I ask about leaving the service?
How to retrieve your data and what happens to it when the contract ends: this should be clarified before you start.
Does ThorIA have security certifications?
Yes, ThorIA holds ISO 27001, ISO 27017 and ISO 27018 certifications.
Is it worth running a trial before choosing?
Yes, a trial with a small group of users and real documents shows how the tool behaves in everyday work.
Who should take part in the choice?
Besides those who will use the tool, it is useful to involve IT and whoever handles privacy, so that security and data processing are assessed from the start.
Request a demo
Check with us how ThorIA meets the criteria that matter most to your company.
General information only, not legal advice: always check the current legislation.