What to ask an AI automation agency before you sign
Before you sign with an AI automation agency, ask six things: how they'll map the work before building, who owns what they build, and which number should move. Then ask where your data goes, who handles the exceptions and what you keep if you leave. A good agency answers plainly. It'll also tell you when you don't need an agency at all.
Each question below comes with why it matters and what a good answer sounds like. If you're still working out what an agency does, start with what an AI automation agency does.
Serkan Honeine, Co-founder, CoSauce
Published · Last updated
About the process
Will you map how the work is done today before you build anything?
If nobody has timed the steps, nobody knows which to remove, and an agency that starts building on day one is automating guesses.
A good answer: They want to sit with the people who do the work, time each step and come back with a list of what to keep, fix, automate or stop. The quote for the build comes after that.
What will you refuse to automate?
An agency that says "anything" either hasn't done much of this or doesn't plan to be around when it breaks.
A good answer: Specific categories: decisions that need judgement, work that changes every week, anything where a wrong answer reaches a customer unchecked, and tasks a tool you already pay for can do.
About the build
Which models and platforms will you use, and why those?
The choice sets your running cost, where your data travels and how hard it is to change later.
A good answer: Named models and platforms, a plain reason for each, and a sentence on where your data goes when the thing runs. If they can't say where the model is hosted, they haven't checked.
Who owns the prompts, the workflows and the data?
If the build lives in the agency's accounts, you're renting it. If they leave, so does your automation.
A good answer: Everything runs in accounts you control, under logins you issue, and the prompts, workflow definitions and documentation are yours, handed over in writing before the final invoice.
What happens when the model vendor changes its pricing or retires a model?
Prices move and models get retired, and a build welded to one model has to be redone.
A good answer: They've swapped a model out before. They can say what a swap costs, how they retest afterwards, and which parts of the build don't depend on any one vendor.
About measurement
What is the baseline, and which number should move?
An agency that won't measure before building can't show you what changed after it, and a before-and-after taken two different ways proves nothing.
A good answer: They measure first: hours a week on the task, cases a day, turnaround, error rate. Then they name one number the build is meant to move, and they count it the same way afterwards, from your systems, so your people can check it.
What does a failed pilot look like, and what happens then?
If failure is never defined, the pilot drifts on and the invoices keep coming.
A good answer: A stop condition agreed in writing before the pilot starts, and a clear answer on what you keep if you stop: the process map, the baseline and whatever was built.
About risk and privacy
Where does our data go, and does any of it leave Australia?
If personal information goes to a model hosted overseas, Australian Privacy Principle 8 applies. You must take reasonable steps so the overseas recipient doesn't breach the principles, and in most cases you stay accountable for what they do with it.
A good answer: They can name the hosting region, point to the vendor's terms on data retention and training, and say what personal information is stripped out before anything is sent.
Which personal information goes into the model, and does it need to?
The OAIC's guidance on commercially available AI products says to take a privacy by design approach, including a privacy impact assessment. It recommends against entering personal information, especially sensitive information, into public generative AI tools. Personal information an AI system generates or infers counts as collection too.
A good answer: They've done a privacy impact assessment before and will do one with you. They send the minimum, and they treat accuracy as a design requirement because AI systems are known to produce false results.
Where does a person check the output, and who is accountable for the system?
The Australian Government's Guidance for AI Adoption, first published on 21 October 2025, updated and replaced the Voluntary AI Safety Standard and its 10 guardrails. The foundations document we cite is dated 5 May 2026. It has six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control.
A good answer: They can walk you through those six for your build without looking them up. Someone on your side is accountable. Customers are told when they're dealing with AI. The system is tested before go-live, monitored after it, and a person can step in.
Sources: OAIC, APP 8; OAIC, AI products; National AI Centre, Guidance for AI Adoption; and the department's Voluntary AI Safety Standard page for the date. If you also operate in the UK, ask the same data questions under UK GDPR. None of this is legal advice.
About people
Who handles the exceptions once it's live?
If nobody owns the cases the automation can't do, they pile up quietly until a customer notices.
A good answer: A named person or team, a queue they work from, and a rule for what gets escalated and how fast. If the agency hasn't thought about exceptions, the build isn't finished.
What happens to the team that does this work today?
They know the process best, and they're the reviewers you'll need afterwards.
A good answer: A plan for the people as well as the software: who moves to review, who moves to harder work, and a count of the hours removed. Be wary of anyone who promises to replace the team before mapping the work.
About commercials
How do you price, and what changes the price?
An open-ended retainer with no scope rewards the agency for taking longer.
A good answer: The mapping is priced on its own so you can stop after it. The build is a fixed price per phase, or a day rate with a cap, and they tell you in advance what would change it.
What do we keep if we leave?
Exit terms are the clearest test of whether the agency expects to earn your business each month or lock it in.
A good answer: Everything already runs in your accounts, the documentation is current, there's a handover period in the contract, and there's no fee for taking your own workflows with you.
When the right answer is no agency
Most routine automation doesn't need an agency, and some work still needs people. An agency that can't name the work it would send back to you, or to a tool, isn't one to sign with. The cases where you can skip the agency are in the earlier post.
How we answer these ourselves
At CoSauce we fix the process first, then automate the routine with AI assistants, integrations and internal tools. People take the exceptions. We map where the time goes, every step, every handoff, every workaround, and sort each step into keep, fix, automate or stop. Automation is a fixed-price build, quoted per phase, and a co-founder joins your weekly review: what broke, what changed, what can move to automation next. If a tool you already have does the job, we say so. More on how we work.
Questions
Do we need an AI policy before we hire an agency?
It helps, and it doesn't have to be long. The first practice in the National AI Centre's foundations guidance is to decide who is accountable. To start, it says, assign a senior leader as the AI governance owner and write an AI policy on how the organisation uses AI and handles the risks. The centre publishes a template.
Does the Guidance for AI Adoption apply to a small business?
The foundations version is written for teams starting out or using AI in low-risk ways. It says to adapt each practice to your size, use cases and risk profile, and that you don't need to do everything at once.
Next step
If you're comparing agencies, book a call with me and bring the process you want automated. We'll go through these questions against it and tell you what's worth building, what a tool you already have can do, and what still needs a person. If we're not the right fit, I'll say so.