Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Evaluate an AI startup as both a business and a risk-bearing technical system. Start with its registration statement and amendments in SEC EDGAR, then verify what customers buy, how revenue and cash use support the story, what rights the company has to its data, how the model performs in its intended setting, and how exposed the service is to outside model, cloud, data and talent providers.
This framework uses the U.S. IPO process as its main example. It helps organize questions; it cannot resolve issuer-specific legal, financial or investment decisions without a current filing, the offering terms and your own circumstances.
Define the company before judging its AI
An AI label can describe very different businesses: a customer-facing application, an AI feature embedded in a broader product, an internal automation tool, or a company selling model access to other developers. Those categories have different buyers, costs, failure modes and evidence requirements. Your first task is to translate the pitch into a concrete commercial and technical description.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIdentify the customer task and buyer
Write down the job the product performs, who uses it, who approves the purchase and which budget pays for it. A claim such as “automates claims review” is incomplete until you know whether the buyer is an insurer, a broker or an internal operations team; whether the system makes a recommendation or an autonomous decision; and whether the customer pays per seat, per transaction, by usage or under a contracted subscription.
#1 Best Overall
Determine whether AI is the product itself or one component of a workflow. If customers could substitute a conventional rules engine, human service or another vendor without changing their process, the company must show why its implementation earns durable adoption. Model size, a benchmark score or a demonstration does not by itself establish product quality in the operating environment where customers use the system.
Separate a market claim from a demand claim
A large addressable market describes potential spending, not the company’s actual demand. Look for evidence that identified customers have bought, renewed, expanded or repeatedly used the product. Ask how many paying customers exist, how concentrated revenue is, how contracts are priced and when revenue is recognized. Treat testimonials, pilot announcements and pipeline language as leads to verify against reported financials and contractual details.
Find and read the registration statement as one connected account
For a U.S. IPO, begin with the issuer’s registration statement and every amendment in the SEC’s EDGAR system. An accessible example of the record format is the Spectral AI S-1/A filing index at SEC EDGAR. That filing is an example of a public record, not a recommendation, a current offering or evidence that its facts apply to another startup.
Read the sections together
Do not read only the business description or the risk-factor summary. Read these sections as a linked explanation:
- Business: what the company sells, who uses it, how it goes to market and where AI fits in the product.
- Risk factors: dependencies, legal exposure, privacy issues, competition, security incidents, model limitations and risks that could prevent the plan from working.
- Management’s discussion and analysis: revenue drivers, margins, cash use, research and development spending, changes in demand and explanations for material movements.
- Financial statements and notes: revenue recognition, customer concentration, costs, commitments, debt, stock-based compensation and losses.
- Use of proceeds: what the offering is intended to fund, such as infrastructure, product development, acquisitions or working capital.
- Ownership and governance: voting control, related-party transactions, board composition, executive incentives and who can make decisions after listing.
Cross-check the AI narrative across those sections. A statement that the company has a proprietary system should be consistent with disclosures about licensed data, third-party models, cloud contracts, employee costs and intellectual-property disputes. A claim of rapid customer growth should fit the revenue trend, receivables, contract terms and cash requirements. Contradictions are not automatically proof of wrongdoing, but they identify questions that require an explanation.
Check amendments and timing
An S-1 is not static. Amendments can change risk language, financial periods, share counts, use of proceeds and the description of material contracts. Confirm which version is current, the date of the latest amendment and whether the proposed offering has actually become effective. A registration statement is not an invitation to assume that an IPO will occur on the terms described in an earlier filing.
Test whether the business has real, repeatable demand
Map customers to revenue
Ask what customers buy and what keeps them buying. Useful evidence includes executed contracts, renewal or expansion patterns, usage records, implementation timelines and the proportion of revenue coming from a small number of accounts. Compare customer counts with reported revenue and investigate whether growth comes from new customers, price increases, acquisitions, one-time projects or usage spikes.
For a usage-priced AI service, examine how billable activity relates to customer value. High usage can increase revenue while also increasing inference and support costs. For a subscription product, check whether customers can cancel easily, whether contracts include minimum commitments and whether implementation services are masking weak recurring demand.
Reconcile growth with financial quality
Read revenue, gross margin, operating expenses, cash flow and the cash balance together. Determine whether the company must spend heavily on inference, data licensing, security, support or specialized engineers to deliver each unit of revenue. A growing top line can coexist with deteriorating economics if every additional customer requires disproportionate compute or human review.
Use management’s explanations in the filing to distinguish planned investment from an unresolved cost problem. Look for commitments to cloud providers, model vendors, data suppliers and infrastructure leases; minimum purchase obligations can remain payable even if demand slows. Examine whether the company has enough liquidity for the development and compliance work its strategy requires, without assuming that the offering will close or raise a particular amount.
Challenge the competitive and differentiation story
Ask what prevents a customer or competitor from reproducing the workflow with another model, open-source software or an internal team. Potential defensibility may involve proprietary data rights, distribution, workflow integration, domain-specific evaluation, switching costs or operational know-how, but the filing should explain the mechanism rather than rely on the word “proprietary.”
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsDo not treat a market-size estimate or a model benchmark as evidence of pricing power. The relevant question is whether customers pay for a reliable outcome at a price that leaves room for the company’s data, compute, personnel, sales and support costs.
Trace data, intellectual property and confidentiality commitments
Build a data inventory
For each important data source, ask what it contains, who supplied it, what rights the company obtained, how long those rights last and whether the rights cover training, fine-tuning, evaluation, product improvement and commercial output. Separate public, licensed, customer-provided, employee-generated and synthetic data. A company may have permission to use data for one service while lacking permission to reuse it to train a general model.
Request the practical flow, not just a policy statement: where inputs are stored, which vendors can process them, how long logs are retained, who can access them, how deletion requests propagate and whether backups or derived datasets persist. Identify whether prompts, uploaded files, outputs, telemetry or human-review records contain personal, confidential or regulated information.
Compare promises with actual use
Compare customer contracts, privacy notices, security documentation and product behavior. Check whether “no training on your data” applies to all plans, subprocessors, debugging logs and human review, or only to a particular configuration. Ask how the company handles data from customers that prohibit secondary use and how it prevents one customer’s information from appearing in another customer’s output.
The Federal Trade Commission says AI companies should honor privacy and confidentiality commitments, including when consumer information is used for additional purposes. Its guidance warns against using data for a new purpose without clear notice and affirmative express consent where that is required. Read the FTC guidance at AI Companies: Uphold Your Privacy and Confidentiality Commitments. For diligence, ask the issuer to identify the notice, consent, contractual clause or other authorization supporting each material data use.
Investigate ownership and infringement exposure
Determine who owns training datasets, model weights, prompts, generated outputs and improvements made for a customer. Review licenses, attribution requirements, geographic limits, termination rights and indemnities. Ask whether the company has received claims concerning copyrighted material, confidential information, publicity rights, patents or trade secrets, and how those claims could affect the product or its economics.
Employee and contractor agreements matter as well. Confirm assignment of inventions, confidentiality obligations and rights to code or data contributed by third parties. A startup can describe a model as proprietary while relying on components whose licenses impose disclosure, attribution or usage restrictions.
Evaluate performance in the intended use, not in a demo
Define the evaluation target
Ask which decisions or tasks the system supports, what an acceptable error looks like and who bears the consequence of a wrong answer. A general accuracy percentage is not enough when errors are unevenly distributed across languages, customer segments, edge cases or high-impact decisions. Request evaluation design, test-set provenance, recency, sample selection and results for the deployment context.
The available material establishes no universal benchmark or pass threshold for AI startups. Treat a benchmark as one piece of evidence and ask whether it predicts the outcome customers actually pay for. For generative systems, examine factuality, refusal behavior, data leakage, latency, cost and consistency; for predictive systems, examine calibration, false-positive and false-negative trade-offs, drift and subgroup performance.
Review failure handling and monitoring
Ask for documented error taxonomies, incident records, escalation paths and post-deployment monitoring. Find out how the company detects drift, abuse, prompt injection, data poisoning, outages and unsafe outputs; who can pause a model or revert a release; and how customers are notified when behavior changes.
Change control is especially important when a product depends on an external model. Determine whether a model version, system prompt, retrieval index, safety filter or data pipeline can change without customer approval. Establish which changes trigger a new evaluation and whether historical results remain reproducible.
Use NIST AI RMF as a question structure
NIST AI RMF 1.0 is voluntary guidance, not a certification and not proof that an issuer follows it. Its four functions can organize an interview across the AI lifecycle:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Function | Questions it helps organize |
|---|---|
| Govern | Who is accountable? Which policies, roles, incentives and escalation routes govern AI use? |
| Map | What is the intended context, who may be affected, what harms are plausible and which dependencies shape the risk? |
| Measure | How are performance, limitations, security, privacy, fairness and incident rates evaluated? |
| Manage | How are risks prioritized, mitigated, accepted, transferred and revisited after deployment? |
NIST Director Laurie E. Locascio said, “The AI Risk Management Framework can help companies and other organizations in any sector and any size to jump-start or enhance their AI risk management approaches.” The statement appears in NIST’s January 26, 2023 release, AI Risk Management Framework Aims to Improve Trustworthiness of Artificial Intelligence. A company’s reference to the framework should lead you to evidence of these activities, not be treated as an assurance that the system is safe.
Map model, infrastructure and supplier dependence
Identify every external dependency
List the foundation-model providers, application programming interfaces, cloud platforms, chip or hosting suppliers, data licensors, security services and specialized contractors required to operate the product. For each dependency, ask whether the company has a substitute, a committed service level, a price cap, portability rights and enough technical knowledge to migrate.
Read material contracts for termination rights, usage limits, audit rights, data retention, indemnities, geographic restrictions and unilateral changes to terms. A startup may appear to own the customer relationship while an outside provider controls the model, capacity or data-processing conditions that make the service possible.
Stress-test a provider change
Ask management to model what happens if a provider raises prices, reduces rate limits, discontinues a model, changes training or privacy terms, suffers an outage or blocks a use case. The answer should identify migration time, engineering cost, customer communication, contract exposure and the expected effect on margins and service quality.
Compare those scenarios with the company’s cash resources and roadmap. Dependence is not automatically disqualifying; transparent contracts, tested fallbacks and realistic contingency costs are more informative than a generic statement that the company has “multiple providers.”
Assess talent and operational capacity
AI operations depend on people who can evaluate models, secure data, operate infrastructure and respond to incidents. Review concentration of expertise, key-person risk, hiring requirements and retention incentives. Ask whether the company can maintain evaluation and support as customer volume grows, rather than assuming that model automation eliminates operational work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Examine governance and the quality of AI disclosure
Find named owners and escalation routes
Identify the executive, board committee or control function responsible for AI risk, privacy, security and incident response. Ask who approves a high-impact deployment, who can stop a release, how unresolved issues reach the board and whether internal audit or independent testing has a defined role. Governance maturity is demonstrated by decisions, records and accountability, not by a policy title alone.
Distinguish rules from recommendations
The SEC Investor Advisory Committee approved an AI disclosure recommendation on December 4, 2025. It is a committee recommendation, not an SEC regulation. The document discusses disclosure of AI’s operational effects; it does not replace the Commission’s current rules or determine what a particular issuer must disclose. Review it at the SEC Investor Advisory Committee recommendation, then confirm the live offering’s requirements in current Commission materials and the issuer’s filing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When reading AI disclosures, look for concrete effects on revenue, costs, operations, competition, intellectual property, privacy, security and compliance. Broad statements that AI creates opportunity or risk are less useful than a description of the systems used, the dependency involved, the control in place and the consequence if that control fails.
Check for consistency across public statements
Compare the registration statement with earnings materials, customer documentation, privacy notices, security pages and executive statements. Differences may reflect a changed product or updated risk assessment, but unexplained changes in claims about training data, model ownership, customer counts or human oversight deserve clarification before you rely on them.
Turn the review into a repeatable decision process
Use the following sequence for an issuer you are actually considering. Keep an evidence log that records the filing version, date, question, answer, supporting document and unresolved issue.
- Establish the offering. Confirm the issuer, jurisdiction, security, proposed exchange, latest registration statement, amendments and whether the offering is effective or still proposed.
- Write a one-paragraph product map. State the customer task, buyer, pricing mechanism, AI role, human role and claimed differentiator in plain language.
- Reconcile commercial evidence. Tie customer and growth claims to revenue, contracts, renewals, concentration, margins, cash flow and the costs required to serve each customer.
- Inventory data and rights. Trace inputs, outputs, logs, retention, subprocessors, training use, deletion and the licenses or consents supporting each use.
- Request intended-use evaluations. Review test design, error analysis, subgroup results where relevant, security and privacy testing, monitoring, incident history and release controls.
- Map dependencies. Document external models, clouds, data suppliers, infrastructure, talent and contractual terms; then test pricing, outage and discontinuation scenarios.
- Inspect governance. Identify accountable owners, board oversight, escalation, customer notification and the process for accepting or remediating residual risk.
- Compare risk with opportunity. Decide which identified issues could materially change adoption, cost, ability to operate or customer trust. Record what evidence would change your assessment instead of assigning a false precision score.
Common warning signs and useful follow-up questions
- Market-size language without customer evidence: Which named customer groups pay today, and what portion of revenue is recurring or repeat?
- “Proprietary AI” with no system boundary: Which components, weights, data and evaluation assets does the company actually own or control?
- Privacy promises broader than contracts: Are customer inputs, logs or human-review records retained or reused, and where is each use disclosed and authorized?
- Benchmark results without deployment context: What was tested, against which population, with what error costs and how recently?
- Rapid model changes: Who approves updates, what is re-tested, and how are customers informed about changed behavior or pricing?
- Single-provider dependence: How long would migration take if the provider changed price, terms, availability or permitted use?
- Generic risk-factor language: What incident, contract, financial or operational evidence shows that management is actively controlling the stated risk?
- Unclear accountability: Who can stop deployment, investigate an incident and report the result to the board and affected customers?
What this framework can and cannot tell you
This process can expose missing evidence, contradictory disclosures, fragile economics, unclear data rights and unmanaged technical dependencies. It cannot verify a model by itself, replace legal review of licenses and privacy obligations, confirm customer references, or predict an offering’s price and future returns.
Free tools Windows power users keep installed
One-click scans. No signup required.
Regulatory requirements, filing status, contracts and product behavior change. Before acting on a live U.S. offering, check the current EDGAR record and the issuer’s latest disclosures, and obtain professional advice appropriate to your jurisdiction and circumstances. No specific issuer, offering price or investor profile is evaluated here, so the framework supports diligence rather than a buy, sell or hold conclusion.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
