Buy AI is a lot like buying a used truck

Picture three 2024 Ford F-150s, each with about 50,000 miles.

You find the first one on Facebook Marketplace. You meet the seller in a grocery store parking lot, hand over cash and drive off. If the transmission lets go before you hit the interstate, that’s your problem now.

The second one is on a small used lot. The salesman says it passed a 50-point inspection, and you sign paperwork saying it’s sold “as is.” Maybe that inspection was thorough. Maybe it was a guy kicking the tires.

The third one is at a Ford dealership, certified pre-owned, with a warranty and a company on the hook if something goes wrong.

Same truck. Three very different levels of protection. Nobody in Montana needs that explained.

I bring up trucks because of the question I hear most: “Which AI should we use?”

My answer surprises people: “That’s the wrong question.”

The major AI tools are close in capability. Ask Copilot, Gemini, Claude or ChatGPT the same question and you’ll usually get similar answers, whether you’re on the free version, a personal paid account or the enterprise account the business pays for.

The difference is the contract. The free version is the pickup from the parking lot. You have no protections. The personal paid version trips people up the most. It’s the used lot with the “as is” paperwork. There are signatures on paper, but only slightly more protection than the cash buy. Enterprise contracts can protect you, but they vary. Some protections are automatic; others you negotiate.

Next comes, “What protections do I need? I’m not an AI expert, a lawyer or a software engineer.”

Your vendor should answer four questions: Do you train on my data? Where does my data live, and who can access it? Will you commit in the contract to Montana’s privacy and records laws? And when this relationship ends, how do we get our data back, and will you delete it?

Those answers belong in the contract, not in a salesman’s word salad.

Many businesses say, “We don’t use AI, so we don’t need a policy.”

That’s often wrong. A survey of 2,000 U.S. and U.K. workers last November found that 86% used AI for work at least weekly, and 60% said unapproved AI tools were worth the security risk if they helped them work faster or meet deadlines. That’s not malice. It’s people doing their best without guardrails.

Here are four things every Montana employer can do.

First, find out what’s already being used. Not to catch anybody, just to know. You can’t manage what you haven’t found.

Second, decide which tools you’ll allow and how much protection each kind of work needs. A newsletter isn’t the same as medical records.

Third, make the rules plain and teach them. A good AI policy doesn’t scare people off. It guides them. If you haven’t chosen a tool, be clear about what can’t go into personal AI accounts. Once you have one, train people on it. Either way, require human review of anything AI produces before anyone relies on it.

Fourth, have a plan for the day something goes wrong, because sooner or later something will. We plan for equipment breakdowns, hailstorms and data breaches. This belongs on the same list.

Why does this matter?

Ask Air Canada.

Its website chatbot told a grieving customer he could apply for a bereavement discount after he traveled. The airline’s own policy said otherwise, and it refused. Before a British Columbia tribunal in 2024, Air Canada argued, in effect, that the chatbot was responsible for its own actions. The tribunal called that “a remarkable submission” and wrote: “It makes no difference whether the information comes from a static page or a chatbot.” The damages were small. The lesson isn’t: The tool doesn’t take the blame. You do.

With the right contract, a policy, trained people and a plan, you’re the buyer at the dealership. Without them, you handed over cash in a parking lot. Every Montanan with a cabin knows a weekend clearing dead timber beats months rebuilding after a fire.

We’re not talking about perfection. The goal is to show that you saw the risk, made reasonable rules, trained your people, and acted when something went wrong. That’s what defensible looks like.

So when someone asks which AI to use, have that conversation. Ask one question back first: What happens if it breaks down on the way home?

Jacob Rebo is a Montana attorney and the founder of Cullis AI, LLC, a Billings firm that helps businesses, law firms and public agencies build practical AI governance programs. He is a former U.S. Army captain who served 14 years on active duty.