AI services: choosing a developer or consultancy
AI consultancies and developers build chatbots, automate routine work and connect language or machine-learning models to existing business systems. Here is what a sound engagement looks like, which rules apply in each market, and how we will assess these firms.
- Markets
- US · UK · UAE & GCC · International
- Criteria
- 6 (v1.0)
- Official sources
- 14
- Reviewed
- October 2026
What AI services providers do
This category covers firms that design, build, integrate or deploy artificial intelligence (AI) and machine-learning systems for organisations. Typical work includes customer and staff chatbots, document extraction, forecasting, and automation that mixes AI steps with conventional software. Not every project involves training a model. Often the firm configures a model licensed from a third-party provider, connects it to the client's data, writes the surrounding software and tests the result. The buyers are organisations such as businesses, charities and public bodies, so the contract, the data protection terms and the test plan carry most of the buyer's protection.
Sales claims in this field often run ahead of delivery. The US Federal Trade Commission (FTC) has said there is no AI exemption from existing law, while UK data protection guidance and the Dubai International Financial Centre's Regulation 10 apply privacy rules directly to AI processing. A credible firm shows a working system on a sample of the buyer's own data, reports accuracy against an agreed test set, names the model providers it relies on and explains where data goes. For that reason our weighting gives delivery evidence, data handling and honest disclosure the largest shares.
Assessing where AI could help, which processes have usable data, and where a simpler rules-based tool would do the job at lower risk.
Customer or staff assistants built on licensed language models, grounded in the organisation's own documents, with hand-off to a person when questions fall outside scope.
Combining AI steps such as classification or extraction with conventional automation to route emails, process invoices or triage support tickets.
Connecting third-party models to existing software through application programming interfaces (APIs), with logging, usage limits and a fallback for when a provider changes or fails.
Training or fine-tuning models on the client's data for forecasting, fraud detection or ranking, with documented test sets and stated performance limits.
Pulling structured fields from contracts, forms or scanned records, with confidence scores and human review of low-certainty results.
Impact assessments, bias and accuracy testing, monitoring plans and records that support data protection duties and European Union AI Act obligations.
What to check in your market
Rules differ by country. Choose a market to see the licences, registers and complaint routes that apply there.
United States
In the United States, misleading AI claims are judged under the same consumer protection law as any other advertising. The Federal Trade Commission (FTC) launched Operation AI Comply in September 2024, stating that there is no AI exemption from the laws on the books. For managing risk, the National Institute of Standards and Technology (NIST) publishes a voluntary AI Risk Management Framework, released in January 2023, and added a Generative AI Profile in July 2024. NIST says the framework is being revised as part of the White House AI Action Plan, so ask which version a firm works to.
Ask the firm to show, in documents rather than slides, how its testing, monitoring and incident handling follow the NIST AI Risk Management Framework.
nist.govFor a chatbot or other generative project, ask which risks from the NIST Generative AI Profile the firm tested for, and what the results showed.
nist.govSet each accuracy, savings or earnings claim in the proposal against the conduct the FTC targeted in Operation AI Comply, and ask for the evidence behind it.
ftc.gov
If a firm's AI claims prove false or its sales methods look deceptive, report it to the FTC through ReportFraud.ftc.gov. Disputes over payment, delivery or ownership are contract matters, so check before signing which state's courts or which arbitration body the agreement names, and keep written records of every promised result.
United Kingdom
Rather than create one AI regulator, the government's February 2024 response to its AI regulation white paper set five cross-sectoral principles, including fairness, transparency, accountability and contestability, for existing regulators to apply within their remits. Personal data is overseen by the Information Commission, which took over from the Information Commissioner's Office on 30 September 2026 and publishes guidance on AI and data protection. The Data (Use and Access) Act 2025, whose data protection provisions were all in force by June 2026, widened the lawful bases for significant automated decisions about people, provided suitable safeguards apply.
Search the Information Commission's register of fee payers by name or registration number before sharing personal data with the firm.
ico.org.ukAsk for a draft data protection impact assessment before build starts; the regulator's AI guidance includes impact assessment points specific to AI systems.
ico.org.ukIf the system will make significant decisions about people without human involvement, ask which safeguards it provides under the rules amended by the Data (Use and Access) Act 2025.
ico.org.ukAsk how the design reflects the government's principles on fairness, transparency and contestability, and who will handle a challenge to an AI-assisted decision.
gov.uk
Since the Data (Use and Access) Act 2025, organisations must help people make data protection complaints and acknowledge them within 30 days. If a complaint about AI processing is not resolved, it can be taken to the Information Commission. Disputes about delivery, fees or ownership of code and models are contract matters for the courts or the forum the agreement names.
UAE & GCC
In the UAE, the federal government aims to make the country a world leader in AI by 2031, and the National Programme for Artificial Intelligence gathers official AI resources. Personal data falls under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022, which bars processing without consent except in defined cases and sets rules for cross-border transfers. The Dubai International Financial Centre (DIFC) has its own data protection law, and its Regulation 10, enacted in September 2023, deals with personal data processed through autonomous and semi-autonomous systems such as AI.
Ask where the system will store and process personal data, and which cross-border transfer route under Federal Decree-Law No. 45 of 2021 the firm relies on.
u.aeConfirm how consent will be collected, or which legal exception applies, before customer records are used to build or test the system.
u.aeIf you or the firm operate in the DIFC, ask whether the system has been assessed under Regulation 10 and whether certification through an approved body applies.
difc.com
Concerns about how personal data is handled go to the UAE Data Office, which the federal law sets up as the data regulator responsible for complaint systems. Firms in the DIFC are also overseen by the DIFC Commissioner of Data Protection, whose office administers Regulation 10. Commercial disputes go to the court or arbitration forum named in the contract, so agree that forum before work begins.
International
When a firm abroad builds or runs a system for you, three questions decide most of the risk: which law governs the contract, where personal data travels, and whether the European Union (EU) AI Act reaches the system. The Act entered into force on 1 August 2024; bans on prohibited practices and AI literacy duties applied from 2 February 2025, and most remaining rules from 2 August 2026. The AI Omnibus, in force since 27 July 2026, moved the main high-risk obligations to 2 December 2027, and to 2 August 2028 for AI built into regulated products.
If you operate in the EU or serve EU users, ask the firm to classify the system under the AI Act and list the dates that apply to it.
digital-strategy.ec.europa.euAsk whether the firm holds ISO/IEC 42001:2023 certification for its AI management system, and check that the certificate's scope covers the service you are buying.
iso.orgWhere personal data will move from the EU or UK to the firm's country, ask which transfer mechanism applies, such as the European Commission's standard contractual clauses.
commission.europa.eu
Cross-border redress depends on what the contract says. Name the governing law, the court or arbitration seat and the language of proceedings, and keep data processing terms in their own schedule. Problems with personal data can also be raised with the data protection regulator in your own market, listed in the market sections above.
How we assess AI services providers
These are the editorial criteria behind every AI services provider we rank, with the weight each carries in the editorial score. The editorial score makes up 60% of a ranking and adjusted customer ratings the other 40%, as set out in how we rank.
| Criterion | Weight | What we look at | Evidence we accept |
|---|---|---|---|
| Delivery evidence | 25% | Whether the firm has put comparable systems into production and measured them. Weighted highest because demonstrations are easy to stage and hard to generalise from. | Live client systems, accuracy results on held-out test data, pilot reports, and references willing to discuss outcomes and problems. |
| Data protection and security | 20% | How client and personal data is stored, sent to model providers, retained and deleted, including transfers abroad and who can access it. | Data flow diagrams, processing agreements, impact assessments, named sub-processors, and security certificates that list the services in scope. |
| Honest claims and disclosure | 20% | Whether marketing and proposals state limits, error rates and the third-party models used, without unsupported accuracy or savings figures. | Proposal wording compared with test results, disclosure of model providers, and documented known limitations. |
| Monitoring and support | 15% | Support after launch: monitoring for errors and drift, handling changes by the model provider, and response times for faults. | Service level terms, monitoring reports, incident logs and a written plan for model version changes. |
| Registration and certification | 10% | Company and data protection registration, plus certifications such as ISO/IEC 42001. Weighted lower because certification here is voluntary and says little about any single system. | Register entries, certificates showing scope and expiry, and staff qualifications relevant to the project. |
| Cost clarity | 10% | Whether the total cost, including model usage and hosting that grow with volume, is explained before signing. | Itemised quotes, usage estimates at several volumes, and stated pricing for change requests. |
Before you hire
Questions to ask
- Which third-party models will the system use, and what happens to our data when it is sent to them?
- How will you measure accuracy before launch, and what result would lead you to advise against going live?
- Who will own the code, prompts, fine-tuned models and training data created during the project?
- How will users know they are dealing with AI, and when does the system hand over to a person?
- What will monthly running costs be at our expected volume, including model usage and hosting?
- How will you detect errors, drift or harmful outputs after launch, and who responds when they occur?
- What happens to our data, prompts and access if we end the contract or switch providers?
Red flags
- A promised accuracy rate or revenue gain before the firm has seen any of your data.
- Refusal to name the underlying model provider or the countries where your data will be processed.
- Demonstrations run only on hand-picked examples, never on a sample of your own records.
- No plan for human review where outputs affect customers, staff, money or legal rights.
- Contract terms that quietly give the developer ownership of your fine-tuned model, prompts or training data.
- Pressure to sign a long retainer before a paid pilot has shown measurable results.
How pricing works
Pricing usually separates building the system from running it. Build work is quoted as a fixed fee for a defined scope or billed on time and materials, often after a paid discovery phase that tests whether the data can support the idea. Running costs include model usage, which providers generally charge by the amount of text or number of requests processed, plus hosting, monitoring and support. Usage charges rise with traffic, so ask for estimates at low, expected and peak volumes, and find out whether the firm passes them on at cost or adds a margin.
- Paid discovery
- A short fixed-fee phase that reviews data, use cases and risks before any commitment to build.
- Fixed-price pilot
- A limited build tested on real data, with agreed success measures and a go or no-go decision.
- Time and materials
- Billing by hours or days worked; suits uncertain scope but needs a cap and regular progress reports.
- Monthly retainer
- A recurring fee for monitoring, fixes and model updates, with response times written into the agreement.
- Usage pass-through
- Model and hosting charges billed as consumed, either at cost or with a margin stated in advance.
Top 8 AI services providers
Rankings for this category are being researched market by market. Each one will publish when enough businesses pass the eligibility checks and an editor has approved the assessment. A list is never padded to reach eight.
Questions about AI services providers
When do the EU AI Act's obligations apply?
In stages. The Act entered into force on 1 August 2024. Prohibited practices and AI literacy duties applied from 2 February 2025, obligations for general-purpose AI models from 2 August 2025, and most other rules from 2 August 2026. Since the AI Omnibus took effect on 27 July 2026, obligations for high-risk uses such as employment and education start on 2 December 2027, and for AI built into regulated products on 2 August 2028.
Does ISO/IEC 42001 certification mean an AI system is accurate?
No. ISO/IEC 42001, published in December 2023, sets requirements for an AI management system: the policies, roles and processes an organisation uses to develop or use AI responsibly. Certification shows those processes passed an audit. It does not test the accuracy or fairness of a particular system, so we treat it as supporting evidence alongside test results and client references.
What changed for automated decisions about people in the UK?
The Data (Use and Access) Act 2025 widened the lawful bases an organisation can rely on for significant decisions made solely by automated means, potentially including legitimate interests, provided appropriate safeguards stay in place. Special category data, such as health information, remains more tightly protected. The regulator confirms that all of the Act's data protection provisions were in force by 19 June 2026, and its AI guidance is under review to reflect the changes.
Can an AI developer reuse our data to improve its own models?
Only where the contract allows it and data protection law permits it. Proposals do not always address the point, so ask directly whether your data, prompts or outputs will train any model, including the model provider's, and have the answer written into the agreement. Where personal data is involved, both sides also need a lawful basis and clear notice to the people concerned.
How does Top8Reviews assess AI services firms?
We score each firm against six weighted criteria. Delivery evidence carries 25%, data protection and security 20%, honest claims and disclosure 20%, monitoring and support 15%, and registration and certification and cost clarity 10% each. Customer reviews form a separate evidence stream and are not mixed into this editorial assessment. Rankings for each market follow once firms have been assessed against these criteria.
Sources
Official sources behind this page, checked in October 2026.
- AI Risk Management FrameworkNational Institute of Standards and TechnologyUS
- FTC Announces Crackdown on Deceptive AI Claims and SchemesFederal Trade CommissionUS
- ReportFraud.ftc.govFederal Trade CommissionUS
- A pro-innovation approach to AI regulation: government responseDepartment for Science, Innovation & TechnologyUK
- Guidance on AI and data protectionInformation Commission (ICO)UK
- The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations?Information Commission (ICO)UK
- Search the register (register of fee payers)Information Commission (ICO)UK
- Information Commission succeeds the ICO as UK's data protection regulatorDepartment for Digital, Culture, Media and SportUK
- Artificial intelligence in government policiesThe Official Portal of the UAE GovernmentUAE & GCC
- Data protection lawsThe Official Portal of the UAE GovernmentUAE & GCC
- Regulation 10DIFC Commissioner of Data ProtectionUAE & GCC
- AI ActEuropean CommissionInternational
- ISO/IEC 42001:2023 - AI management systemsInternational Organization for StandardizationInternational
- Standard Contractual Clauses (SCC)European CommissionInternational