Read the AI before you approve it.

Why does every AI vendor review take six weeks?

You should not have to reverse-engineer a product from its marketing page. But that is most of the job: vendor AI review is archaeology — reconstructing what a system actually does from copy written to avoid saying, then chasing the rest through three calls and a questionnaire the vendor filled in optimistically.

Meanwhile the business is waiting on you, and the risk is not symmetrical. Approve the wrong tool and employee profiling is now running inside your own company: a works council question you cannot answer, a control gap that surfaces in your next audit, and a data subject request nobody can service. Say no to everything and you become the reason nothing ships, which is how review gets routed around you next time.

How do I close this review in a week instead of six?

Three steps, and the first one needs nothing from us.

1. 1

   Read the disclosure

   One public web address, no login and no NDA. It is the document your file needs, and it is versioned, so at renewal you diff it instead of repeating the review.

2. 2

   Run the checklist — at us and at everyone else

   Ten questions, answered in writing before the first call. Compare which vendors answer with a document and which answer with a meeting invitation. That comparison is most of your decision.

3. 3

   Map the refusals onto your controls

   Each boundary below is enforced in a specific place in the product, not in a policy paragraph, so you can close the rows in your own control framework without waiting for a follow-up call.

The outcome you want is a review that closes with an artifact in the file rather than a meeting summary: legal signs off on a document, the control rows are mapped to something specific, and renewal next year is a diff instead of a repeat. And if we fall short of your bar, you find that out on day one — which is worth more to you than a good first call.

What can I read before anyone books a call?

The AI disclosure itself. It sits at a public web address that needs no login — /ai-disclosure — and it sets out what the AI is used for, where the line sits between the code that decides and the AI that explains, which inferences are refused outright, and how consent is recorded. Fetch it, diff it against the next version, attach it to your file. No NDA, no portal, no sales conversation in between.

What should I ask an AI sales-software vendor before approving it?

These ten questions, in writing, before the first call. The list is deliberately vendor-neutral: run it at us and at everyone else you are evaluating, and notice which answers arrive as a document and which arrive as a calendar invitation.

What is actually enforced, and what is only promised?

Four boundaries you can check rather than take on trust. The distinction matters more to you than it does to us: a policy commitment lasts until someone reorganises the roadmap, while a constraint in the database lasts until someone writes a migration and has to defend it in a code review.

• Emotion and personality inference: refused

  Inference about a person’s emotion, sentiment or personality cannot be stored. The database rejects it, so a future feature cannot quietly reintroduce it without someone having to explain why.

• No scoring of named individuals

  There is no individual scorecard in the product and no setting that creates one. Aggregate reporting suppresses groups below five by default and can be configured no lower than two; that bounded setting cannot enable a named-person score.

• An audit record you can add to but never edit

  Once a consequential change is written it cannot be altered. Each customer’s records are chained together, so a removal shows up as a break rather than as a gap nobody notices.

• AI off until you switch it on, one workflow at a time

  No AI workflow runs until you consent to that specific workflow. Not one global toggle — each lane separately, with the decision recorded and revocable.

What data leaves our systems, and where does it go?

Pipeline data, read-only, and by default nothing goes back. SalesSynq does not change your CRM records. Sending a task into a work tool is the one exception, and it is a separate permission you grant one tool at a time — refused until you grant it, and refused again the moment you withdraw it. Every other source is a file somebody uploads deliberately, with the field mapping confirmed on screen before anything is accepted. Retention, personal data handling and sub-processors are set out in the Trust Center rather than paraphrased here, because a paraphrase is what your DPO would have to re-verify anyway.

What are you not claiming?

The section most vendor pages leave out. Your real question is not what a product does — it is what the vendor will put in writing that it does not do, so you can rely on the absence as well as the presence.

• No certifications. SOC 2 and ISO 27001 run here as evidence programmes in progress; we hold neither today and will not imply otherwise.
• No enterprise identity federation today. Treat it as a roadmap conversation, clearly labelled as one.
• No changes to your CRM records. Read-only by default; sending a task into a work tool is a separate permission you grant one tool at a time, and it is refused until you grant it.
• No published availability or capacity numbers. We will publish those when they are measured, not before.
• No SalesSynq performance or comparative-superiority claim. Generated certification fixtures are not predictive evidence; vendor figures are qualified market context only.