Most Hong Kong SME owners now get several AI pitches a month. The demos look good, the pricing sounds reasonable, and the salesperson is friendly. The problem is that the decision gets made on the demo alone, and the details that actually matter only surface six months later when you want to leave, or when a client asks where their data went.
This is not a guide to whether AI is worth it. It is a checklist for the moment you have already decided to buy something, and you want to sign without creating a problem for yourself later.
Start with the contract, not the product
Hong Kong SMEs are usually handed a one-page order form and a link to terms of service written for a global audience. Before you sign, ask for the following in writing. If a vendor cannot answer any of them, that is your answer.
Where does your data physically sit?
Ask which country the servers are in, and whether backups sit in the same place. If your customers are in Hong Kong and you handle personal data, this affects how you describe your own operations in your privacy policy. A vendor that cannot name a region is a vendor that has not thought about it.
Who owns what goes in and what comes out?
You want explicit language that your uploaded content stays yours, and that the vendor will not use it to train models for other customers. Some contracts bury this in a clause that grants the vendor a broad licence. Read that clause twice.
What happens on the day you leave?
Ask for the export format and the notice period. A tool that holds your customer history hostage is not a tool, it is a lock-in. Get the answer before you migrate your data in, not after.
Test the tool on your own mess, not their demo
Vendors demo with clean data. Your business does not have clean data. Before committing to an annual plan, run a short paid trial using real material from your own operation.
- Feed it a genuinely awkward enquiry, written in the mixed Chinese and English your customers actually use.
- Give it a document with a typo and an outdated price, and see whether it flags the problem or repeats it confidently.
- Ask it something outside its scope and watch whether it says it does not know.
- Time how long a new staff member takes to do a task without help.
The last point matters most. A tool that needs a week of hand-holding from the person who set it up is not saving you anything if that person leaves.
Check the security basics before you connect anything
Most of the risk arrives when you connect the AI tool to your existing systems, not when you use it on its own.
- Two-factor authentication on every admin account. If the vendor does not support it, stop there.
- Named accounts, not shared logins. You need to know who did what when something goes wrong.
- Least access. A tool that reads your email does not need permission to send from it.
- An audit log you can actually open. Ask to see a sample before you buy.
If you are planning to connect the tool to your website or CRM, it is worth having someone review the setup rather than letting each department wire up its own integration. Our team regularly reviews these connections as part of a short technical review, and most problems we find are configuration issues rather than product flaws.
Work out the real cost over twelve months
The subscription is rarely the biggest line. Add up the setup fee, any per-seat charges as your team grows, the cost of the person who maintains it, and the cost of the day you decide to switch. Compare that total against what the task costs you now, done by a person, badly and slowly. If the gap is thin, wait a quarter and see whether the tool is still around.
Buying an AI tool is a three-year relationship decision dressed up as a monthly subscription. Treat the exit terms with the same care as the price.
Write down your decision before you sign
Keep a one-page record: what problem the tool solves, who owns it internally, what the success measure is, and the date you will review it. This takes twenty minutes and saves an argument later. It also gives you something concrete to hand to whoever manages your website and systems, so the tool does not quietly become another orphaned login nobody remembers.
Summary
Before signing with any AI vendor, confirm where your data sits, who owns it, and how you get it back out. Trial the tool on your own messy real-world material rather than a polished demo. Lock down admin access with two-factor authentication and named accounts. Add up the full twelve-month cost including maintenance and switching. Then write a one-page record of the decision and set a review date. None of this requires technical expertise, only the habit of asking before you sign.