AI Strategy & Roadmapping · Cornerstone
The questions to put in an AI consulting RFP that filter the firms with engagement-shipping depth from the firms that are reselling someone else's platform.
Quantum Associates — Quantum Associates
· 8 min read
The AU AI consulting market in 2026 contains a wide spread of firms, broadly clustering into four categories: the Big 4 / global SI builds-and-strategy practices, the in-house AI teams of tier-1 cloud and software vendors, specialist AI-only firms (a small but growing category), and a long tail of generalist firms with AI badging on existing services. They’re not interchangeable. The RFP questions below are designed to surface the differences — to filter the firms that actually ship engagements from the firms that are primarily reselling someone else’s platform with consultancy framing on top.
This piece is what we’d put in a procurement guide if we were on the buyer side. The questions assume an AU mid-market or large-enterprise engagement (anything above ~$100K) — for smaller engagements, the procurement effort isn’t worth this depth.
The questions cluster into five categories. A firm that can answer 80%+ of them substantively is doing real consulting work. A firm that can answer fewer than 60% is probably reselling.
Q1. Describe your methodology for a generative AI pilot. Walk us through the phases, the duration of each, the deliverables, and the decision gates.
What a real answer looks like: a named methodology with phases that follow a recognisable arc (discovery → design → build → evaluate → deploy → operate), with specific durations, named deliverables per phase, and explicit decision gates between phases. The firm should be able to provide a sample methodology document.
What a reseller answer looks like: a single-slide “approach” that’s mostly platform marketing, with phase names like “transform” and “accelerate” and no specific durations or deliverables.
Q2. For a typical pilot engagement in our segment, what’s the price band, what’s included, and what’s out of scope?
What a real answer looks like: a specific band (typically $40K–$80K for a 6–8 week pilot in the AU mid-market — see our Generative AI Pilot for the published version). Specific in-scope deliverables. Specific out-of-scope items the buyer can rationally exclude.
What a reseller answer looks like: “It depends on the scope” with no concrete numbers, or a number that’s suspiciously round and large. Firms that publish pricing have nothing to hide; firms that don’t are usually pricing on what they think the buyer will pay.
Q3. How do you handle scope creep during an engagement?
What a real answer looks like: a fixed-scope, fixed-price contract with a documented change-control process. Net-new requests trigger a formal change order with a re-priced statement of work. The firm should be willing to share their standard change-control template.
What a reseller answer looks like: “We’re flexible” (translation: scope creep is the business model), or a time-and-materials default (translation: cost overrun is the business model).
Q4. What happens at the end of the engagement?
What a real answer looks like: a defined handover, including documentation, runbooks, knowledge transfer, and a defined warranty period (typically 30–90 days of defect support). The firm should explain how they avoid creating dependency on themselves for ongoing operation.
What a reseller answer looks like: a default expectation of a multi-year managed-service contract that’s where the real margin is. Be wary of firms whose pilot pricing is suspiciously low — the model is to win the pilot and lock in operate.
Q5. Walk us through your approach to retrieval-augmented generation. When would you recommend RAG, when would you recommend fine-tuning, when would you recommend prompting alone?
What a real answer looks like: a clear decision framework along the lines of our build-vs-buy-vs-finetune piece, with specific examples of past engagements where each pattern was the right call.
What a reseller answer looks like: an answer that defaults to whatever pattern the firm has the most existing tooling for, regardless of the use case.
Q6. How do you evaluate the quality of an AI system you’ve built — before and after deployment?
What a real answer looks like: a structured evaluation framework that includes (a) offline evaluation against test sets with rubrics, (b) online evaluation through sampling production outputs, (c) tooling for evaluation (often building on frameworks like Ragas, Promptfoo, or proprietary evaluators), and (d) a process for closing the loop when evaluation surfaces drift.
What a reseller answer looks like: a wave at “we’ll set up monitoring.” Evaluation of non-deterministic systems is fundamentally different from monitoring of deterministic systems; firms that can’t articulate that difference probably can’t do it well.
Q7. What’s your position on foundation model selection — would you default to a single vendor or stay model-agnostic?
What a real answer looks like: model-agnostic with a clear framework for selecting per use case (cost-and-latency profile, capability requirements, sovereignty constraints, vendor relationship). The firm should be able to discuss the trade-offs between Claude, GPT, Gemini, open-source alternatives, etc, without obvious vendor bias.
What a reseller answer looks like: a heavy lean toward whatever model their existing partnership is with, presented as a technical recommendation rather than a commercial one.
Q8. How do you handle the operational complexity of AI in production — observability, evaluation, incident response, model upgrades?
What a real answer looks like: a documented operating model with tooling (logging, tracing, evaluation pipelines), incident-response playbooks specific to AI failure modes (hallucination spike, latency degradation, output-quality drift), and a clear approach to managing model upgrades without re-engineering the system.
What a reseller answer looks like: “We’ll set up dashboards.” Production AI operations is the work that distinguishes pilots-that-ship from pilots-that-stall — firms that don’t take it seriously are firms whose pilots will stall.
Q9. Walk us through how your methodology aligns to the Voluntary AI Safety Standard.
What a real answer looks like: an explicit mapping of the firm’s methodology phases to the 10 guardrails — our Voluntary AI Safety Standard guide is the framework. The firm should be able to discuss which guardrails are addressed in which phases, what artefacts are produced as evidence, and how the engagement supports a defensible governance posture.
What a reseller answer looks like: “Yes, we follow it” with no specifics, or a wave at “responsible AI principles” without referencing the actual standard. The standard is the published AU framework; firms that don’t reference it specifically aren’t paying attention.
Q10. For our sector specifically (e.g., financial services, healthcare, government), what regulatory requirements would shape the engagement?
What a real answer looks like: a specific discussion of the applicable framework. For APRA-regulated entities, that means CPS 234, CPS 230, CPG 235. For healthcare, that means the Privacy Act, the My Health Records Act, sector-specific TGA guidance. For government, that means the DTA AI Assurance Framework, the PSPF, sometimes IRAP.
What a reseller answer looks like: “We work in your sector regularly” with no specifics. Firms that don’t know your regulatory framework will produce work that doesn’t hold up to your regulator’s scrutiny.
Q11. How would your work address Australian Privacy Act obligations specifically?
What a real answer looks like: a specific discussion of the Australian Privacy Principles as they apply to LLM-using systems — our Privacy Act piece covers the framework. Includes data flow documentation, consent design where applicable, OAIC-facing transparency, and the operational controls around data sent to third-party models.
What a reseller answer looks like: “We’re GDPR-compliant.” Different regime, different obligations.
Q12. Who specifically will be working on our engagement? Provide CVs.
What a real answer looks like: named individuals with relevant CVs, including the senior engagement lead (who should be present in significant proportions of the engagement, not just kickoff and closeout), and the technical practitioners doing the actual build work.
What a reseller answer looks like: a senior partner on the proposal who’s never seen again after sign-off, with the real work done by junior consultants whose CVs are mostly generic. The bait-and-switch pattern is one of the most common AU AI consulting complaints — names on the proposal aren’t on the engagement.
Q13. What proportion of the engagement will be delivered by AU-based personnel, and what proportion by offshore teams?
What a real answer looks like: a clear breakdown, with a strong AU-based lead and a discussion of how offshore capacity is integrated (where applicable). For regulated sectors, offshore delivery may carry specific compliance considerations the firm should be ready to discuss.
What a reseller answer looks like: vague answers about “global capability” that mask a 90/10 offshore/onshore split, which often produces engagements where the timezone friction, the cultural-fit friction, and the data-sovereignty friction add up to significant operational cost.
Q14. What’s your knowledge-transfer approach? At the end of the engagement, how do we operate the system without depending on you?
What a real answer looks like: an explicit knowledge-transfer plan with documentation, training, runbooks, and (often) embedded delivery where one or more of the firm’s practitioners work alongside the buyer’s team specifically to transfer knowledge. The firm should be willing to discuss what success looks like for the buyer being self-sufficient post-engagement.
What a reseller answer looks like: knowledge transfer as an afterthought, with the implicit expectation that the buyer will continue to depend on the firm for ongoing work. This is one of the cleanest tests for genuine consulting versus reselling — real consulting firms try to work themselves out of a job; resellers try to embed themselves.
Q15. What’s your IP position — who owns what at the end of the engagement?
What a real answer looks like: the buyer owns all custom code, prompts, evaluation rubrics, configurations, and documentation produced for the engagement. The firm may retain a non-exclusive licence to use the methodology and tools (templates, evaluation frameworks) it brought to the engagement.
What a reseller answer looks like: vague IP terms that leave the firm owning the substance of what was built, or terms that grant the buyer “use rights” without genuine ownership. Vendor lock-in by another name.
Q16. What’s your reference-customer policy? Can we speak to 3 customers in our sector at our scale, with engagements that have been in production for 6+ months?
What a real answer looks like: the firm provides genuine references — typically with a brief intro call to the customer first to confirm willingness. The references should be specific (not “we’ve worked across the financial services sector” — “here are three banks of comparable size, each with a production AI system we built, you can speak to the CDO at each”). The 6+ months in production filter is important — pilots in flight don’t tell you whether the firm produces durable work.
What a reseller answer looks like: vague references, references that turn out to be advisory engagements not build engagements, or references where the firm “isn’t able to disclose for confidentiality reasons” — which is sometimes true but is also a common dodge.
Q17. What’s the conflict-of-interest position with the platforms you recommend?
What a real answer looks like: a clear disclosure of any partner relationships with platforms the firm recommends, and a clear statement of how recommendations are made without bias from those relationships. The firm shouldn’t be embarrassed by the question — partnerships are normal; what matters is the firm’s independence in recommending.
What a reseller answer looks like: an answer that mostly sidesteps the question. If the firm makes 70% of its revenue from a single platform’s marketplace and 100% of its engagements end up on that platform, the buyer should know that going in.
We’d suggest a simple scoring approach:
The questions don’t guarantee the firm will deliver well — execution is execution — but they filter out the firms that are very unlikely to. That filter is worth a lot when the engagement spend is $100K+ and the consequences of an underperforming partner show up months later, in production.
Most AI consulting engagements in the AU market in 2026 are bought on the strength of relationships, brand, and partnership status with major platforms — not on the strength of methodology or technical depth. Both buyers and sellers participate in that dynamic. The result is a market where price and outcomes are loosely coupled, and where buyers regularly pay six-figure sums for engagements that produce strategy decks but not shipping systems.
The RFP discipline this piece argues for is more work than the current default. It’s also the work that most reliably separates the buyers who get genuine value from the buyers who pay for consulting theatre. If your engagement is at the scale where the difference matters, the few extra days in procurement pay back many times over in delivery.
For the buy-side view of what AI consulting actually costs in the AU market — and where the bands are moving in 2026 — see The honest cost of AI consulting in Australia.
Related insights
AI Strategy & Roadmapping
What AU buyers actually pay for AI consulting in 2026 — who's pricing what, where the bands are moving, and how to read a proposal.
AI Strategy & Roadmapping
The pattern is consistent enough to be useful. What separates AI pilots that ship into production from the ones that quietly die six months in.
Next step
30 minutes, no pitch, no deck — just a working conversation about how this applies to your situation.