Hiring an AI development company in India: a checklist

To hire an AI development company in India safely, check five things before you sign: that the firm is a registered entity you can look up, that you will work with the engineers who build the system, that the contract assigns the code to you in writing, that personal data has a lawful route (or never leaves your country), and that the first piece of work is a small paid pilot with an agreed pass mark. The rest of this checklist is for founders and operations heads in the UK, US, Gulf and Singapore weighing an Indian AI team.

Who are you actually contracting with?

Every Indian company and LLP is on the Ministry of Corporate Affairs register. Its public master data service lets you search by name, CIN or LLPIN and see the registration details and status. Check that the name on the proposal matches the name on the register, and that the entity is active.

Then ask two plain questions:

• Who will be on our calls? Some agencies sell the work and pass it to subcontractors. Ask to meet the engineer who will write the code.
• Which clients can we check? A named client with a public website is worth more than a logo wall.

For the record, here is our own answer. We are CyberFreezeDev LLP, registered in Chennai in November 2024 (LLPIN ACK-4469), a team of 6 to 15 people with no UK or US office. Our named UK client is PropID, and our other named clients are in India; see our case studies.

Questions to ask on the first call

1. Which part of our process would you automate first, and what would you leave alone?
2. What data do you need to see, and can you start with anonymised or synthetic samples?
3. How will we know it works? Look for an evaluation set of real cases and a pass mark, not "it looked good in the demo".
4. Which model would you use, and roughly what will it cost us each month to run?
5. Where will it be hosted, and in whose account?
6. What happens when the AI is unsure? There should be a route to a person.
7. What do we receive at handover? The answer should include the repository, admin access and a runbook.

Red flags

• An accuracy figure promised before anyone has looked at your data.
• A fixed quote for the whole system after one call, with no discovery step.
• A request for a full export of your production database before a contract and data terms are signed.
• Hosting and code kept in the developer's own accounts, with no plan to move them to yours.
• No written scope, or a scope with no "out of scope" list.

Who owns the code? Put it in writing

Under India's Copyright Act 1957, the author of a work is its first owner, and where an employee writes it under a contract of service, the employer is first owner unless they agree otherwise. In plain terms, code written by your developer's staff belongs first to the Indian firm, not to you. It becomes yours through an assignment.

Section 19 of the Act sets the form. An assignment is not valid unless it is in writing and signed by the assignor. If it does not state a period, it is deemed to last five years. If it does not state a territory, it is presumed to cover India only. A loose sentence such as "all IP passes to the client" can therefore leave you with less than you think. Ask for a clause that names the work, the rights, a worldwide territory and the full term of copyright.

US buyers often rely on the words "work made for hire". Under 17 U.S.C. s101 that label covers employees' work and commissioned work only in a short list of categories, and bespoke software is not one of them, so ask for an express assignment as well.

Two more points belong in the same clause. The developer may keep its own pre-existing tools and license them to you; ask for that list. Open-source libraries and open-weight models keep their own licences; ask for a list of those too. This is general information, not legal advice, so have your own lawyer read the contract.

Data handling and time zones

If personal data is sent to a developer in India, or the developer can access it on your systems, UK GDPR treats that as a restricted transfer. The ICO's own example is a UK business letting an Indian service provider log in to its customer records. Our United Kingdom page explains how we handle the transfer terms. Often the better design is that we build on anonymised or synthetic samples and deploy into your cloud account, so live data never reaches us. Buyers in the Gulf and Singapore should bring their own counsel's transfer requirements to the first call.

India is on UTC+5:30 all year: a London morning is the Chennai afternoon, Dubai is an hour and a half behind and Singapore two and a half hours ahead. US teams work on an overnight cycle: you brief at the end of your day and review the next morning, as our United States page sets out.

Start with a small paid pilot

A pilot answers the questions no proposal can: whether the team is good to work with, whether your data is in the shape everyone assumed, and whether the AI is accurate enough on your own cases.

1. Pick one process with a clear owner and real weekly volume.
2. Agree the evaluation set first: 50 to a few hundred real cases with the expected result for each, and the pass mark that would justify the next stage.
3. Fix the scope, length and fee of the pilot only.
4. Build on staging, in your accounts, using anonymised samples where you can.
5. Review together: did it pass, what will it cost to run, and do you go on, change course or stop?

Pay for the pilot. A paid pilot gets the same people and care as the full project, and either side can walk away cleanly. Our AI strategy consulting ends with a written first pilot spec of exactly this kind.

Ready to test the fit?

Bring one process and the data it touches, and we will tell you what a pilot would cover, what we would need from you, and what we would not build. Book a consultation.