How to evaluate an AI development company in Canada.

Three concrete checks. First, ask for named engineers on the proposal and confirm their LinkedIn profiles match the seniority claimed — eight-plus years of production AI or ML work, not eight years of general software with six months of LangChain. Second, ask for direct access to those engineers on the discovery call and again at kickoff — the same names, not a swap. Third, ask for public artifacts: GitHub commits, conference talks, or shipped products you can find. Vendors who refuse all three are running a senior-figurehead-plus-junior-pool model, which is the most common failure pattern across the Bay Street consultancy market.

Six non-negotiables. (1) IP assignment — your code, your prompts, your evals, your data, assigned to you on payment under Ontario, Quebec, or BC law as applicable. (2) Source in your GitHub organization from day one, not a vendor repo. (3) Acceptance criteria written into the SOW with a defined test plan. (4) A 30-day production warranty — bugs introduced by the vendor are fixed at no charge for 30 days post-launch. (5) A clean exit clause — runbooks, on-call docs, and credentials handed over on termination for any reason. (6) Data protection terms (PIPEDA-aligned DPA, Law 25 obligations spelled out for Quebec-resident data, breach notification timeline) signed before any personal information is processed. Anyone resisting any of these is protecting a lock-in.

It looks like the vendor losing zero leverage if you decide to leave. Concretely: code lives in your GitHub organization from commit one. Deployment runs in your AWS ca-central-1, Azure Canada Central, or GCP northamerica-northeast1 account under your IAM. Secrets live in your secret manager. Runbooks, on-call docs, and architectural decision records are checked into the repo, not parked in a vendor wiki. IP assigns to you on payment, not on contract end. If your vendor cannot describe a clean handover to a different team on a single page, the architecture itself is the lock-in. We see this most often with 'managed AI platforms' that wrap an open-source stack — the moment you try to leave, the wrapper goes with them.

Four asks on the first call. (1) Show me your DPA template — vendors who 'work with Canadian data all the time' but cannot produce one have not done the work. (2) Walk me through how you would scope a Privacy Impact Assessment (PIA) for an engagement processing personal information at scale, in plain English. (3) For any product touching Quebec residents, walk me through your Law 25 obligations approach — consent transparency, automated-decision disclosure, data portability, the right to de-indexation, and the French-language consent flow. (4) Tell me which Canadian region your inference endpoints run in and how that is enforced. Anyone who cannot do all four on the first call is selling compliance, not practicing it.

Honest answer: Eastern Canadian hours (Toronto, Montreal, Ottawa) get a two-to-three-hour late-afternoon overlap with our Mohali IST day, which is workable but not full coverage. For Canadian clients that need same-zone synchronous time, we route a dedicated overlap pod through our Frisco, TX office — Frisco runs Central Time, which is one hour behind Toronto and covers the same workday. Western Canadian hours (Vancouver, Calgary) are thinner; we cover them async-first with twice-weekly demos scheduled in your morning. If your engagement cannot survive without all-day synchronous coverage, we will tell you on the first call and recommend a Canadian or US onshore alternative. Vendors who claim full Eastern coverage from India without naming a US/Canadian pod are bending the truth — ask them to name the pod.

Assigned, with one narrow exception. Custom code, prompts, evals, fine-tuned weights trained on your data, and integration glue should all assign to you on payment — that is the default in Canadian AI MSAs and what your legal team will expect. The narrow exception is pre-existing vendor frameworks or internal libraries that pre-date the engagement; those are usually licensed to you under a perpetual, royalty-free, transferable license rather than assigned. That is fair, provided the license is genuinely perpetual and transferable. Watch for 'licensed for internal use' language without 'perpetual and transferable' — that is a renewal trap.

A focused v1 — single AI agent, single RAG system, or single voice pipeline — with Canadian compliance scope (PIPEDA, Law 25, BC PIPA) lands at CAD $35,000-$160,000 fixed-price for a six-week build with offshore senior-only delivery, CAD $90,000-$280,000 with Canadian mid-market consultancies, and CAD $250,000-$600,000+ with Bay Street boutiques. Anything quoted under CAD $35k is either a pilot, a corner-cutter, or a junior-pool play. Anything quoted over CAD $300k without fine-tuning, multi-system scope, or a multi-quarter timeline is paying for a sales narrative, not engineering. The most expensive vendor is rarely the best one; the cheapest one almost never is.

A 30-day production warranty as default — the vendor fixes their own bugs at no charge for 30 days after the system is live. After that, an optional retainer for tuning, eval refresh, drift monitoring, and on-call response inside Eastern or Pacific business hours, priced separately and renewable monthly. The retainer should be optional, not bundled into a 'managed service' that you cannot cancel without losing access to your own code. If the vendor's post-launch model requires you to keep paying them to keep your system running, you have bought a service, not a build — and you should know that before signing the MSA.