The pitch sounds great. Here's what to check before you say yes
Every small business owner in India is getting the same pitch right now: an AI tool that will answer your calls, write your social posts, or chase your leads while you sleep. Some of these tools are genuinely useful. But signing up for one is a business decision, not just a software download, and a few quiet questions upfront can save you a messy exit later.
Here are three things worth checking before you commit - cost beyond the subscription, what India's new data rules mean for you, and how hard it is to leave if the tool doesn't work out.
It's rarely just the monthly fee
Most AI tools are sold on a low monthly price. The real cost shows up later, when you try to change vendors. A 2026 survey of 542 U.S. executives at companies with active AI vendor contracts, commissioned by Zapier, found that 74% said losing their primary AI vendor would disrupt day-to-day operations or leave their organisation unable to function - and only 6% said they could walk away without disruption.
The gap between expectation and reality was just as striking: 89% believed they could switch vendors within a month, but among those who actually tried, 58% said it failed outright or took far more effort than expected.
That survey covered larger U.S. companies, so treat the numbers as directional rather than a forecast for an Indian salon or exporter. But the pattern - "switching looks easy until you try it" - is worth planning around at any size. Before signing up, ask two plain questions: can I export my data if I leave, and is there a lock-in period or cancellation penalty?
India's new privacy rules apply to you too
If your business collects phone numbers, email addresses, or customer chat history - which covers almost every business using a CRM, a WhatsApp tool, or an AI voice agent - India's Digital Personal Data Protection (DPDP) Rules, 2025 apply to you. The rules were notified by the Ministry of Electronics and IT (MeitY) via Gazette Notification G.S.R. 846(E) on 13 November 2025.
The timeline is phased. The provisions covering the Data Protection Board took effect immediately. Consent Manager registration requirements kick in 12 months later, by 13 November 2026. The bulk of the obligations that apply to ordinary businesses - notice and consent requirements, data principal rights, security safeguards, and rules on children's data - come into force 18 months after notification, on 13 May 2027.
There's no small-business exemption in the rules: a business of any size that collects digital personal data is covered. One piece of good news for smaller firms is that Rule 6 sets out "reasonable security safeguards" in general terms rather than mandating a specific certification like ISO 27001, which is more achievable for a small team.
Practically: when you give an AI tool access to your customer list, ask where that data is stored, who can see it, and whether the vendor will help you meet consent and notice requirements once the rules fully apply. You have until mid-2027, but the systems you set up today are the ones you'll need to bring into compliance later.
Most businesses using AI are still figuring it out - that's normal
If you feel like everyone else has already "figured out" AI and you're behind, the data says otherwise. NASSCOM and EY's AI Adoption Index, based on a survey of 500 Indian enterprises, found the index score moved only slightly - from 2.45 in 2022 to 2.47 in 2024. 87% of companies sit in the middle "Enthusiast" or "Expert" maturity stages, with 45% specifically at the Expert stage. That survey covered large enterprises rather than small businesses specifically, so it likely overstates where most SMEs stand. But the barriers it identifies - AI outcomes not lining up with business goals, inconsistent or poor-quality data, and a shortage of in-house expertise - are exactly what trips up smaller businesses too, often worse, since they have less room to experiment.
The practical takeaway: start with one clear, narrow problem (missed calls, slow follow-up, an inbox nobody checks) rather than a broad "add AI to everything" plan. A tool that solves one specific problem well is easier to evaluate, easier to exit, and easier to bring into line with the privacy rules than five half-used tools bolted together.
A short checklist before you sign up
- Can you export your data and conversation history if you cancel?
- Is there a minimum contract term or cancellation fee?
- Where is your customer data stored, and who at the vendor can access it?
- Does the vendor have a plan for India's DPDP consent and notice requirements?
- Does this tool solve one specific problem, or is it a general promise?
If you'd rather talk through whether a specific tool or automation makes sense for your business before you commit to it, message us on WhatsApp or ask for a free 15-minute review - we're happy to look at it with you, no obligation.
Sources
Every figure in this article comes from the sources below. We link to the originals so you can check them yourself.
- MeitY Notifies Final Digital Personal Data Protection Rules, 2025 - SSRana & Co., published 14 November 2025 - supports the DPDP Rules notification date, phased compliance timeline (immediate, 12-month, and 18-month deadlines), and the Rule 6 security-standard point.
- Zapier survey warns of AI vendor lock-in in enterprises - IT Brief US, published 2 April 2026 - supports the 74% disruption figure, 6% no-disruption figure, 89% expected-switch figure, 58% failed/harder-than-expected migration figure, and the 542-executive sample size.
- Marginal improvement in India's AI adoption maturity: NASSCOM-EY Report - w.media, 2025 - supports the NASSCOM-EY AI Adoption Index scores (2.45 to 2.47), the 87% and 45% maturity-stage figures, the 500-company sample size, and the listed adoption barriers.