AI BUYER'S GUIDE · USA
How to choose an AI solution provider in the USA
For a US company, a good AI solution provider has production references in your industry and can show a SOC 2 report or equivalent security controls. It will sign a BAA if you handle health data, track state AI laws such as Colorado's and NYC's hiring rules, and run a paid pilot on your data before a full build. Published US agency pricing puts a typical budget at $5k–$20k for an assessment, $10k–$50k for a pilot and $50k–$250k for production.
Key takeaways
- There is no single federal AI law. The rules come from the FTC, sector laws (HIPAA, GLBA, ECOA) and a growing set of state laws.
- Enterprise buyers increasingly require SOC 2 Type II evidence and a security questionnaire before signing.
- The NIST AI Risk Management Framework is the common reference point for AI governance in US procurement.
- Ask your CPA about the federal R&D credit and the treatment of domestic R&D expenses for custom AI work.
Types of AI solutions companies in the US market
The US market is the largest and noisiest in the world, so it helps to know which kind of provider you are talking to:
| Provider type | Typical buyer | Pricing model |
|---|---|---|
| Big-four and global consultancies | Fortune 1000, multi-year programs | Time & materials, $200–$450+/hr |
| Boutique AI development firms | Mid-market and growth-stage companies | Fixed-scope phases or retainers |
| Vertical AI SaaS vendors | Teams with a standard use case | Per-seat or usage-based subscriptions |
| Offshore/nearshore dev shops | Cost-sensitive builds with in-house AI leadership | Lower hourly rates, more oversight needed |
If you have no internal AI lead, a boutique firm that both advises and builds usually gets a first system live fastest. If you already have a data science team, you may only need extra engineering capacity.
What does it cost to hire an AI provider in the US?
| Phase | Typical US budget | Duration |
|---|---|---|
| AI readiness / opportunity assessment | $5,000 – $20,000 | 1–3 weeks |
| Pilot on real data | $10,000 – $50,000 | 3–6 weeks |
| Production deployment | $50,000 – $250,000 | 2–6 months |
| Managed service & model monitoring | $2,000 – $10,000 / month | Ongoing |
Hourly rates: senior AI engineers and architects at established US consultancies typically bill $200–$450 an hour, and mid-level staff $150–$300. Ongoing maintenance often runs 15–20% of the build cost a year.
How we built these ranges: in October 2026 we compared published US pricing guides, including DesignRush, Winder.AI, Groovy Web and AgixTech, and took the range where most sources agree. Enterprise programs with full MLOps and compliance can reach $250,000–$500,000. Most of these figures come from firms that sell AI services, so treat them as a guide rather than a quote. Flaterz scopes every project after a free audit.
Projects in regulated sectors cost more, mostly because of security review, audit logging and legal sign-off, not the AI itself. Budget for your own team's time too: someone has to supply data, review outputs and own the result.
US laws and standards your AI vendor should know
AI regulation in the US is a patchwork. A competent provider should be able to explain how each of these applies to your project:
- FTC Act, Section 5. The FTC has acted against deceptive AI claims and unfair use of algorithms, so marketing copy and chatbot answers need to be accurate.
- State AI laws. Colorado's AI Act was rewritten in May 2026 (SB 26-189), significantly narrowed and delayed to 1 January 2027. Check the final text if you make consequential decisions in lending, housing, employment or insurance. Other states have their own rules on chatbots, deepfakes and automated decisions.
- Hiring. NYC Local Law 144 requires bias audits and notices for automated employment decision tools. Illinois regulates AI in video interviews.
- Privacy. California's CCPA/CPRA (including rules on automated decision-making technology) and other comprehensive state privacy laws.
- Sector laws. HIPAA (health data, which requires a Business Associate Agreement), GLBA and ECOA/fair-lending rules (finance) and FERPA (education).
- The NIST AI Risk Management Framework. It is voluntary, but it is increasingly referenced in contracts and RFPs.
Security and procurement expectations
US procurement teams typically ask for a completed security questionnaire (SIG Lite, CAIQ or their own), a SOC 2 Type II report or a credible roadmap to one, cyber insurance and a clear subprocessor list. They also want to know whether customer data is used to train models. With the major model APIs on business terms, it is not used by default, but get that in writing.
Ask for data to be processed in US regions if your contracts require it, and confirm the provider can support single sign-on (SSO) and role-based access for internal tools.
Questions to ask before you sign an SOW
- Can you share two production case studies and a client reference?
- What exactly will the pilot prove, and what are the go/no-go criteria?
- Will you sign our MSA, DPA and, if relevant, a BAA?
- Can you provide SOC 2 evidence or complete our security questionnaire?
- How do you evaluate accuracy, bias and hallucinations before launch?
- Who owns the IP: code, prompts, fine-tuned models and data?
- What are the ongoing costs for hosting, model usage and support?
- Which hours do you overlap with our team, and who is our day-to-day contact?
What we've learned shipping 10 AI products
Flaterz has put ten AI-enabled products into production, including regulatory monitoring (WagrWatch), document and menu intelligence (Menulta), a predictive analytics platform running at a 68% hit rate (Football Intelligence) and realtime voice tutoring (ACCAly). Three lessons from that work apply to any provider you hire:
- The model is rarely the hard part. Most of the effort is data access, edge cases, permissions and the human review step. A provider who only talks about models has not shipped much.
- Prove it on live data before the big contract. Every system we run in production started as a two-to-three-week prototype against real inputs, which surfaced problems a demo never would.
- Measure it against a number you already track, such as hours per week, response time or error rate. If a provider cannot name the metric up front, the project will be hard to judge later.
Working with Flaterz from the US
Flaterz is a UK-based AI agency that works remotely with US teams. We overlap with East Coast mornings and run weekly demos, and US data can stay in US cloud regions. We build AI agents, document intelligence and voice AI, and you own the code and data. To see what an engagement looks like, read about our AI automation agency services.
Frequently asked questions
Is there a federal AI law in the United States?
Not a comprehensive one. AI use is governed by existing federal law (FTC Act, civil rights, sector laws like HIPAA), executive policy and a growing number of state laws. Colorado's AI Act, the broadest of these, was narrowed in 2026 and is due to take effect on 1 January 2027.
Do AI vendors need SOC 2?
It's not a legal requirement, but many US mid-market and enterprise buyers require SOC 2 Type II or an equivalent security review before a vendor can touch production data.
Can AI development costs qualify for the R&D tax credit?
Custom development that involves technical uncertainty and experimentation can qualify for the federal research credit, and the treatment of domestic R&D expenses changed in 2025. Confirm eligibility with your CPA.
How long does an AI pilot take?
A focused pilot on real data usually takes three to six weeks. Moving to production takes two to six months, depending on integrations and security review.