Why does it take so long for a cheap tool?

Because the review follows what the tool receives rather than what it costs. A small subscription that takes in customer material raises questions a larger purchase of something inert would not, and those questions pass through several people. The duration reflects the material and the sequence, not the invoice.

What should we prepare before starting?

A plain description of what material goes in and where it goes, the vendor's written answers on handling and retention, a note on what happens if the service stops, the alternatives considered, and the name of whoever will own it. Those five cover most of what every reviewer will ask.

How do we make it faster?

Overlap the reviews and answer specifically. Security can start while pricing is open, legal can read a standard agreement early, and precise answers avoid the extra rounds that vague ones generate. Both are within a buying team's control, unlike the number of approvers.

Glossary

Procurement

Procurement is the formal path a purchase takes to approval, and for AI tools it frequently takes longer than deciding which tool to buy did.

In plain terms

You have chosen the tool and now you have to get it bought. That means somebody in finance approving the spend, somebody in security satisfied about the data, somebody in legal reading the contract, and often a check that alternatives were considered. Each of these is reasonable on its own and they are usually done one after another, which is why the total is measured in months.

Why it matters

Because it is where AI purchases stall most reliably, and because the delay is usually treated as friction rather than as work that can be prepared for. A team that arrives with a chosen tool and nothing else waits while each reviewer starts from the beginning. The same team arriving with the security answers, a data description and a considered alternative moves through in a fraction of the time, and the difference is preparation rather than influence.

How it works

The process is asking a small number of questions repeatedly through different people. What material goes into this, who else can see it, what happens if it stops working, what were the alternatives, and who is accountable. Recognising that they are the same five questions in different vocabularies is what lets a buyer answer them once and properly rather than improvising four times.

AI purchases attract more scrutiny than their price suggests, which surprises teams used to buying software. The reason is the material rather than the money: a modest subscription that receives customer records or internal documents raises the questions a much larger purchase of something else would not. Expecting the scrutiny to scale with the invoice is what makes the process feel disproportionate.

Reviews run in sequence by default and rarely need to. Security can begin while pricing is still being discussed, and legal can read a standard agreement before anybody has agreed to sign it. The sequence is usually habit rather than requirement, and asking whether two steps can overlap is often all it takes.

What reviewers want is a specific answer rather than a reassuring one. Naming exactly what material the tool receives, where it goes and what the vendor commits to gets further than a general statement that it is secure, because the reviewer's job is to record something defensible rather than to be convinced. Vagueness reads as an unanswered question and comes back as another round.

Arriving prepared

The reason the left-hand approach fails is not that reviewers are obstructive but that they cannot record it. A reviewer's output is a defensible note saying what was checked, and a general assurance that a tool is secure gives them nothing to write down, so they ask a more specific question and the clock restarts. Multiply that by four reviewers each discovering the same gaps independently and the months appear. The right-hand column short-circuits it by supplying exactly what each of them needs to write, in the buyer's own words, before being asked. It also has a quieter benefit: assembling those answers occasionally reveals that nobody actually knows what material the tool would receive, which is much better to find out at this point than after approval.

Seen in the wild

An assistant that already spread through individual subscriptions, now facing the review it never had when it was on cards.
ChatGPT
A search tool reaching across internal systems, where the access model is what review concentrates on rather than the price.
Glean
An automation platform where the question is which systems it connects to and what moves between them.
n8n

Common misconceptions

People assume

Procurement is an obstacle to route around.

In fact

Routing around it is what produces unapproved tools on personal accounts, which is the same purchase with none of the protections and no record. The process has a logic, and treating it as a set of answerable questions rather than as resistance is both faster and produces a tool the organisation can actually keep.

People assume

A small purchase gets a light review.

In fact

For AI tools the review tracks the material rather than the amount. A modest subscription receiving customer records will be examined more closely than a larger purchase of something that touches nothing sensitive, which is proportionate once you see what is being assessed.

Questions

Why does it take so long for a cheap tool?: Because the review follows what the tool receives rather than what it costs. A small subscription that takes in customer material raises questions a larger purchase of something inert would not, and those questions pass through several people. The duration reflects the material and the sequence, not the invoice.
What should we prepare before starting?: A plain description of what material goes in and where it goes, the vendor's written answers on handling and retention, a note on what happens if the service stops, the alternatives considered, and the name of whoever will own it. Those five cover most of what every reviewer will ask.
How do we make it faster?: Overlap the reviews and answer specifically. Security can start while pricing is open, legal can read a standard agreement early, and precise answers avoid the extra rounds that vague ones generate. Both are within a buying team's control, unlike the number of approvers.