Last reviewed:
How do you choose an independent AI advisor for an SME or mid-market company?
An AI advisor is independent when it takes no vendor commission, sells no tool or deployment, cross-checks several models and has a person sign every deliverable. For an SME or a mid-market company, that is what keeps the advice in service of the business and not of a catalog.
Choose an AI advisor on five criteria: independence (no vendor commission, no tool or deployment to sell), confidentiality, a fixed scope, written and signed deliverables, and senior people doing the work. Independence comes first.
01The answer in plain terms
A leader of an SME or mid-market company looking for AI advice quickly runs into fog. Software vendors, integrators, generalist firms, freelancers, agencies. They all say "advice". Few say what else they sell.
The answer comes down to five criteria: independence, confidentiality, scope, deliverables, and who actually does the work. Independence comes first because it conditions the others. An advisor that takes a vendor commission, sells the tool it recommends or bills for the deployment it advises has no interest in telling you "buy nothing".
Independence can be checked on concrete points. The firm takes no commission, no reseller discount, no benefit from a supplier. It sells no tool, no license, no development. It cross-checks several AI models instead of relying on a single one. A person reviews and signs every deliverable. The engagement is short and run by senior people.
A word on vocabulary. On this page, "AI advice" means supporting a leadership team that has to decide: which uses to allow, which rules to write, which tool to choose, which priorities to set. It is not development, not integration, not mass training. Those trades exist and are useful. But they are not bought in the same place as the decision. Technical terms are defined in the AI glossary.
02Why this is a leadership team issue
AI is already inside the company, with or without a decision from leadership. According to the France Num Barometer 2026, 40% of French very small businesses and SMEs say they use at least one artificial intelligence solution. France Num is the public program that supports very small businesses and SMEs with digital adoption. For many companies, choosing an advisor therefore comes after the first uses. It then serves to take back control.
On the risk side, the studies converge. In the 11th barometer from CESIN and OpinionWay (397 cybersecurity managers and CISOs, online survey from December 2025 to January 2026), employees' use of unapproved AI tools has become the first risky behavior identified by French CISOs. The 2nd AI Barometer: Business and Sustainability from ESSCA and Forvis Mazars (826 respondents, published 1 October 2026) shows that two thirds of organizations see unmanaged AI use. Only 44% have formalized ethical rules on AI. And 28% of respondents think their company knows the AI Act well.
The cost of an incident can be measured too. According to IBM (Cost of a Data Breach 2025, Ponemon Institute, 600 organizations, 30 July 2025), 1 in 5 organizations that suffered a data breach did so because of shadow AI. High shadow AI use is associated with an average extra cost of $670,000. And 63% of breached organizations have no AI governance policy or are still writing one.
These figures do not prove that you need an advisor. They show that you need a decision, and that the decision belongs to leadership. The advisor is there to inform it. A firm that decides in your place, or steers the decision toward what it sells, has taken a seat that is not its own.
03The five criteria for choosing
Here is the grid. Each criterion turns into questions you can ask in a meeting, and for which you can ask for written answers.
Independence
Ask whether the firm receives a commission, a discount or a benefit from a software vendor, a hosting provider or a reseller. Ask whether it sells a tool or a deployment, or has an interest in you buying one. An independent advisor answers plainly and agrees to put it in its engagement letter. The test is simple: can the firm conclude "you do not need this tool" or "keep what you have"? Also check the method. A firm that relies on a single model inherits its blind spots. Cross-checking several models, comparing their answers and looking for their contradictions reduces that risk.
Confidentiality
An AI advisor handles your documents: organization, figures, customers, contracts. Ask which AI tools it uses on your data, under which plan (business or consumer), with what hosting and what retention period. Ask whether your data can be used to train a model. Ask for a signed confidentiality commitment and the list of subcontractors. If your documents contain personal data, the firm must be able to explain how it complies with the GDPR. A firm that helps you govern AI must set the example in its own practices.
Scope
A scope fixed before starting protects both parties. Ask what is included, what is excluded and what triggers an extra charge. A good scope answers a precise leadership question. Which uses to allow? Which rules to write? Which tool to choose, or not to choose? Which risks to handle first? Prefer a fixed-scope package to billing by time spent. The package forces the firm to define what it delivers and to stick to it.
Deliverables
Ask what you will receive. A good deliverable is written, dated, signed and usable without its author. For a first engagement, it includes an inventory of actual uses, an AI policy that employees can read, a reasoned tool recommendation with the alternatives ruled out, and a presentation to the leadership team. Be wary of deliverables that only make sense in the presence of their author, such as scoping slides with no decision. Ask for an anonymized example or the table of contents of a typical deliverable.
Who does the work
Ask for the names and profiles of the people who will do the engagement, not only of the person who sells it. In some structures, the person who signs the proposal is not the one who does the work. In a short, senior engagement, the person you meet is the one who analyzes, reviews and signs. Also ask how much of the work is done with AI tools and who checks it. AI output that no human has reviewed does not need a firm to be obtained.
The grid looks for neither a brand nor a price. It looks for a firm whose interests lie nowhere other than in your decision. The five criteria hold together: an independent advisor accepts a fixed scope, signed deliverables and named people on the engagement.
04Questions to ask in the meeting
Take the grid back as a list of questions. Ask the same ones to every firm you consult, write down the answers and compare.
- Do you receive a commission, a discount or a benefit from a software vendor or a reseller?
- Do you sell or resell a tool, a license or a development?
- Which AI models do you use to work on our documents, and under which plan?
- Where is our data processed, how long is it kept, and is it used to train a model?
- What is included in the scope, and what triggers an extra charge?
- Who will do the work, by name, and who will review it?
- Who signs the deliverable, and can we see an anonymized example?
- How long is the engagement, and what happens at the end?
- In which case would you tell us to buy nothing?
Evasive answers to the first two questions tell you as much as the answers themselves. A firm that is comfortable with its independence documents it without being asked twice.
05Traps to avoid
Three configurations call for vigilance.
Large engagements billed by time spent
In this model, the firm bills days. The longer the engagement lasts, the more it earns. The incentive is upside down: the firm has no interest in concluding quickly. An SME or mid-market company has neither the time nor the team to absorb an engagement that drags on, junior profiles to brief and one more steering committee. The risk is a voluminous report and few decisions. Always ask what you will have in hand at the end, and by what date.
The vendor or integrator pushing its tool
A software vendor, a reseller or an integrator that offers a free or cheap "AI audit" has a product to sell afterwards. The audit is a door opener. The conclusion is known in advance: your need matches their catalog. The bias is structural, even without bad faith. It also exists in the firm that sells the deployment after advising: it has an interest in recommending a project it can carry out.
Single-model advice that nobody reviewed
A firm that delivers the raw output of a single AI model, without review, sells you what you could get alone in a few minutes. What has value is the cross-check between models, the judgment and the accountability of a person who signs. AI sharpens the decision, it does not make it.
An advisor that earns money only if you buy something cannot, structurally, advise you to buy nothing. Independence is not a moral stance. It is an operating condition of advice.
06What WYP does, and what it does not do
WYP.agency is a strategy advisory firm for executives, leadership teams and boards of directors. It is a brand of ABSPARITION SL, based in Barcelona. The founder is Xavier Fisselier.
What WYP does. Cross-check several AI models (Claude, ChatGPT, Gemini, Perplexity, Mistral, Grok), compare their answers, identify blind spots and contradictions. Then a person reviews and signs. The entry offer is Le Cadrage IA, a fixed-scope package at EUR 2,900 excl. VAT, delivered in 10 business days: audit of uses, written AI policy, validated tool, presentation to the leadership team.
What WYP does not do. WYP is not a marketing agency, a software vendor or a development company. It takes no vendor commission, sells no tool and bills no deployment. If your need is to develop or deploy, WYP tells you so and leaves the choice of provider to you.
Apply this grid to WYP as you would to any other firm. If the answers do not suit you, choose another firm. That is the purpose of the grid.
07Where to start
Before contacting a firm, clarify three points.
- The leadership question to settle, written in one sentence.
- The current situation: which AI tools your teams already use, including those you have not authorized.
- The budget and the timeframe you accept to devote to it.
The AI maturity diagnostic is free and short. It gives you a first benchmark of your situation before any meeting. The AI glossary defines the terms you will hear, from shadow AI to governance. If the scope suits you, Le Cadrage IA is WYP's entry engagement.
FAQ
What is an independent AI advisor?
It is a firm that takes no vendor commission, sells no tool or deployment, cross-checks several AI models and has a person review and sign every deliverable. Its engagement is short and run by senior people.
Why does independence matter so much for an SME or mid-market company?
Because an SME or a mid-market company rarely has an internal team to challenge a recommendation. According to the France Num Barometer 2026, 40% of French very small businesses and SMEs say they use at least one AI solution. The recommendation you receive therefore bears directly on uses already in place.
How long should an AI advisory engagement last?
It should be short, with a scope fixed in advance. Be wary of an engagement whose length stays open. As an example, WYP's Le Cadrage IA is a package at EUR 2,900 excl. VAT delivered in 10 business days.
Can an advisor use AI on my documents?
Yes, provided written rules are set. Ask for the AI plan used, the hosting, the retention period, the exclusion of your data from model training and a signed confidentiality commitment. CESIN notes that employees' use of unapproved AI tools is the first risky behavior identified by French CISOs.
Can a software vendor or an integrator run a reliable AI audit?
It can shed light on the use of its own product. It is not in a position to conclude that you do not need it. For a leadership decision, separate advice from selling.
Should we write an AI policy before choosing a tool?
Yes, the policy comes before the choice of tool. According to IBM (Cost of a Data Breach 2025), 63% of breached organizations have no AI governance policy or are still writing one. According to ESSCA, only 44% have formalized ethical rules on AI.
See also
Further reading
France Num Barometer 2026 (digital and AI adoption by French very small businesses and SMEs)
Sources
- France Num, France Num Barometer 2026 (digital and AI adoption by French very small businesses and SMEs). https://www.entreprises.gouv.fr/espace-presse/barometre-france-num-2026-quatre-tpe-pme-sur-dix-utilisent-desormais-lintelligence
- CESIN and OpinionWay, 11th annual barometer of the cybersecurity of French companies, 397 cybersecurity managers and CISOs, online survey from December 2025 to January 2026. https://www.opinion-way.com/fr/publications/barometre-de-la-cybersecurite-des-entreprises-francaises-2026-22229/
- ESSCA and Forvis Mazars, 2nd AI Barometer: Business and Sustainability, 826 respondents (IT and digital professionals in France, United Kingdom, Germany, Spain), published 1 October 2026. https://www.essca-knowledge.fr/en/all-posts/ai-sustainability/ai-barometer-2026-companies-sustainability-europe/
- IBM, Cost of a Data Breach 2025 (Ponemon Institute, 600 organizations), 30 July 2025. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls