How to tell if an AI tool is legit (a 2026 buyer's checklist)

Figuring out whether an AI tool is legit got harder in 2026, not easier. The barrier to launching an "AI-powered" product is now a weekend and an API key, regulators are fining companies for inventing AI capabilities they never had, and the tool you sign up for today has a real chance of quietly disappearing within a year. So "is this AI tool legit?" has become a question worth answering deliberately — before you hand over your data or your budget. This is our checklist for doing exactly that.

We review AI tools for a living, and we also maintain the AI graveyard — the record of the ones that didn't make it. That gives us an unusually clear view of how AI tools go wrong: the scams, the vaporware, the thin wrappers, and the ones that simply ran out of money. Here is how to separate a real, durable AI tool from a dud, in about fifteen minutes.

Update, September 13, 2026: a summer of enforcement, two new checks, and a correction to our own number

This checklist was written in June 2026 and the checks below still hold. What has changed is the record behind them, two things a buyer can now demand that they could not in June, and one statistic of ours that no longer reproduces. The correction first.

Our graveyard number moved, and the headline behind it flipped. The June text says the single most common way an AI tool dies is a silently expired domain, and that 40% of the graveyard simply went dark. That was true of the 170-entry snapshot we had then. The registry now holds 343 endings, most of the additions being older shutdowns and acquisitions verified in over the summer, and the shape is different: acquisition is the most common ending at 192, an announced shutdown comes next at 86, a lapsed domain is third at 57, and outright abandonment accounts for 8. A silent domain lapse is now 16.6% of all endings and 38% of the ones that were not acquisitions. The practical advice in check three is unchanged — a dormant changelog and an expiring domain are still the tells — but the sentence "most tools die silently" is no longer what our data says, and we have corrected it below.

The regulators kept going. Since June the FTC finalised orders against Cox Media Group and two smaller firms (August 27) over a fictional "Active Listening" AI ad-targeting product, and against Publishing.com (July 2, $1.5 million) for unsubstantiated earnings claims around an "AI Publishing Academy", with an order to honour refunds and disclose paid reviews. It also proposed, on July 1, a policy statement that an AI system marketed as accurate or neutral while tuned to undisclosed objectives is deceptive; that is still a proposal, not a rule. The SEC settled with GenesisAI on August 26 over inflated revenue, valuation and partnership claims that raised $5.3 million from more than 4,000 crowdfunding investors, after a June judgment against a fake "AI Financial Education Foundation" and a May case against a $12.3 million "AI trading bot" Ponzi scheme. Every one of those maps to a red flag in section six.

The numbers on AI-branded fraud are now official. The FBI's 2025 internet-crime report, published in April, was the first to break out AI: 22,364 complaints tagged to AI and $893 million in losses, $632 million of it investment fraud. The FTC's 2025 fraud total was about $16 billion, a record. "An AI that trades for you" remains the single most expensive phrase in the category.

Two checks we would add today. First, disclosure. Since August 2, 2026 the EU AI Act's Article 50 requires a chatbot serving EU users to tell them they are talking to an AI, and requires deepfakes to be labelled; machine-readable marking of generated content follows on December 2 for systems already on the market. A tool that hides the fact that it is AI is now non-compliant in Europe, not merely evasive. Second, age and consent. Apple's guidelines now require age gating for chatbot apps and explicit consent before an app shares your data with a third-party AI provider; Google Play extended its user-data rules to third-party AI integrations on July 15 and is rolling out an age-signals interface worldwide; California signed a package of companion-chatbot laws on September 10, including crisis protocols, parental controls and audits, on top of fourteen state chatbot laws enacted this year. A consumer AI tool with no age policy and no statement about which model provider sees your data is behind the platforms it ships on.

And one law with teeth for the worst category. The Take It Down Act's removal duty has been in force since May 19, 2026: platforms must remove non-consensual intimate imagery, including AI forgeries, within 48 hours of a valid request, at $53,088 per violation. The FTC's first move was warning letters to twelve "nudify" operators on May 20; there is no litigated case yet. If a tool in that category has no removal process, it is already on the wrong side of the statute.

Why "is this AI tool legit?" is a 2026 problem

Three things changed at once, and together they make vetting essential rather than optional.

Regulators are now policing fake AI claims. In September 2024 the FTC launched Operation AI Comply, a sweep of enforcement actions against companies using "AI" to deceive. The headline case: DoNotPay, the self-described "robot lawyer," which settled for $193,000 after the FTC said it never tested whether its AI matched the work of a human attorney. The SEC has run a parallel crackdown on "AI washing" — it fined the investment advisers Delphia and Global Predictions a combined $400,000 in March 2024 for marketing AI they had not actually implemented, and in January 2025 sanctioned Presto Automation, whose drive-thru "AI" turned out to need human agents for more than 70% of orders.

Some of the most-hyped tools turned out to be people. Builder.ai, a Microsoft-backed startup once valued above $1 billion, collapsed into insolvency in 2025. The Wall Street Journal had reported as far back as 2019 that it leaned on human engineers for work it marketed as AI, and the Financial Times later reported its revenue had been overstated roughly fourfold — about $220 million claimed against some $55 million real. The gap between the AI story and the AI substance is not a fringe problem; it reached unicorn scale.

Durability is its own risk. Gartner expects more than 30% of generative-AI projects to be abandoned. And in our own data, a lapsed domain with no announcement is one of the three main ways an AI tool dies — 57 of the 343 endings in our registry as of September 2026, behind acquisition (192) and announced shutdown (86). A tool can be entirely real today and gone by next quarter.

The good news: the signals that separate a legit, durable AI tool from a risky one are mostly public. Here is what to check.

1. Confirm the company is real

Start with the basics, because the worst offenders fail here. Look for a team page with named, LinkedIn-verifiable people — not stock photos or invented "AI avatars." Confirm the company is an actual registered entity (a Secretary of State business search, or SEC EDGAR for a US public company). Check Crunchbase for funding history and named investors.

None of these is disqualifying on its own — plenty of legitimate tools are bootstrapped and absent from Crunchbase. But a product with no named founders, no traceable legal entity, and no public footprint, that is asking for your payment details, is a product with something to hide.

2. Read the security and data posture — especially "do they train on your data?"

This is where a fifteen-minute check earns its keep.

Ask for SOC 2 Type II, not just Type I. A Type I report says a vendor designed security controls as of one date; a Type II says those controls actually operated over a period of at least six months. For anything touching business data, Type II is the real bar — ask directly whether they can share one under NDA. For European or regulated data, ask for ISO 27001 as well.

Find out whether the tool trains on your inputs. Open the privacy policy and terms and search (Ctrl+F) for "train," "improve," and "model." Many consumer-grade AI tools reserve the right to train on whatever you put in unless you actively opt out. If you plan to feed it anything sensitive, that one clause matters more than any feature on the pricing page.

Expect a DPA and a trust center. A vendor built for business data can send you a Data Processing Agreement on request and usually publishes a trust or security page listing its certifications and subprocessors. If neither exists, the tool is not enterprise-ready yet — regardless of what the homepage says.

3. Check it's maintained — and likely to survive

A legit tool that gets abandoned six months from now is still a bad bet. Look for signs of an actively maintained, funded product: a changelog or release notes updated within the last ~90 days, a public status page that shows real incident history (not a permanent green light), and a domain that isn't freshly registered, which a quick WHOIS lookup will tell you.

Then run the abandonment test. Five warning signs: no product updates in 90+ days, social accounts dormant for a couple of months, a domain near expiry, no response to a pre-sales support question, and — for venture-backed tools — no new funding round in more than two years. Any one of these is noise. Three at once is a tool already drifting toward the graveyard, and you should plan an exit before you depend on it.

4. Make sure it's a real product, not a thin wrapper

A "wrapper" is a thin interface over someone else's model — no proprietary data, no real integrations, no defensibility of its own. Wrappers are not automatically scams, but they are fragile: when the underlying models improve, the gap they filled disappears. Jasper is the cautionary tale here — it reportedly fell from around $120 million in revenue toward $35–55 million once ChatGPT closed the writing-assistant gap it had been charging for.

Four questions expose a wrapper quickly:

• If OpenAI or Anthropic shipped this exact feature natively tomorrow, would the product still have a reason to exist?
• Does it get better the more you use it — accumulating your data, corrections, and workflows — or is every session a fresh prompt?
• What can it do that you couldn't get by pasting your own prompt straight into ChatGPT or Claude?
• Is there engineering in the changelog beyond interface tweaks?

If the only honest answer is "it has a nicer interface," that is not a moat, and the durability risk is high.

5. Pressure-test the reviews

Assume, going in, that a meaningful share of the reviews you read are fake or paid. The problem got large enough that the FTC banned fake and AI-generated reviews outright in a rule effective October 2024, carrying penalties of up to $51,744 per violation. Trustpilot alone removed 4.5 million fake reviews in 2024 — about 7% of everything posted to the platform that year.

You can screen for the obvious ones in two minutes:

• Sort by most recent and look for bursts — a cluster of glowing five-star reviews landing within a 24-to-48-hour window, after long stretches of quiet, is the signature of a paid campaign.
• Distrust generic praise that names no specific feature, outcome, or problem. Authentic reviews describe the thing that actually helped; fabricated ones reach for vague enthusiasm.
• Check the reviewer — a brand-new account with a single five-star review and no other activity is a tell.
• Read the rating distribution. A 4.9 average across hundreds of reviews with essentially no low scores usually means negative reviews are being filtered out — which, as of the 2024 rule, is itself illegal.

6. The red flags that should stop you

These are the patterns regulators actually went after in 2024–2025. They double as your stop signs:

• Vague "AI-powered" language with no description of what the model does or how it was tested. (Delphia was charged for advertising AI it had never put into its product.)
• Guaranteed or extreme returns tied to AI — "an AI that builds you a million-dollar business." Most of Operation AI Comply was exactly this.
• Autonomy claims with no human-in-the-loop disclosure. (Presto marketed "no human order-taking"; humans handled the majority.)
• "Replaces your lawyer / doctor / accountant" with no evidence the tool was ever measured against the professional it claims to replace. (This is what sank DoNotPay's claims.)
• Pressure to pay now, refunds refused, and negative reviews punished — old-fashioned fraud signals wearing an AI costume.

One of these warrants slowing down. Two warrants walking away.

The 15-minute legitimacy check

If you remember nothing else, run this list before you trust an AI tool in 2026:

1. Named founders you can verify on LinkedIn.
2. A real, registered company entity.
3. SOC 2 Type II (or ISO 27001) available on request.
4. A privacy policy you've actually searched for "train" and "model."
5. A Data Processing Agreement and a trust/security page.
6. A changelog updated in the last ~90 days.
7. A public status page with real incident history.
8. A domain that isn't brand-new (WHOIS).
9. Reviews that name specifics, with a believable rating spread.
10. No guaranteed-ROI, no undisclosed humans, no "replaces a professional" claims.

Clear most of these and you are probably dealing with a real, durable tool. Fail several and you have your answer.

How we do this

This is the reader's version of how we review AI tools. We run these checks on every product we list, we follow the ones that fail all the way to the AI graveyard — and we wrote up what actually kills them so the patterns are on the record. The tools that clear the bar consistently are the ones that end up in our Top 100. Vetting is not a one-time gate; in a market where roughly two in five non-acquisition failures are silent, it's a habit.

Frequently asked questions

Does an AI chatbot have to tell me it's an AI? In the European Union, yes, since August 2, 2026: Article 50 of the AI Act requires providers to ensure people are told they are interacting with an AI at the point of contact, and deepfakes must be labelled. In the United States there is no federal equivalent, but fourteen states enacted chatbot laws in 2026 and California's September 10 package adds crisis protocols, parental controls and audits for companion chatbots. A tool that conceals that it is AI fails the legitimacy test regardless of jurisdiction.

Which AI companies did regulators act against in 2026? The FTC finalised orders against Cox Media Group, MindSift and 1010 Digital Works (August 2026) for a fictional "Active Listening" AI product and against Publishing.com (July 2026) for unsubstantiated AI-course earnings claims; the SEC settled with GenesisAI (August 2026) over inflated claims that raised $5.3 million from crowdfunding investors, and brought earlier 2026 cases against a fake "AI Financial Education Foundation" and an "AI trading bot" Ponzi scheme. The FBI counted $893 million in AI-tagged fraud losses for 2025.

How do I know if an AI tool is legit? Run a short, public-records check: verify the company is a real registered entity with named founders, confirm it has security credentials (SOC 2 Type II or ISO 27001) and a Data Processing Agreement, read the privacy policy for whether it trains on your data, and look for an actively updated changelog and status page. A tool that clears those is very likely legitimate; one that fails several is not worth your data.

Is it safe to put my data into an AI tool? Only after you've read how it handles that data. Open the privacy policy and terms and search for "train," "improve," and "model" — many consumer AI tools reserve the right to train on your inputs unless you opt out. For sensitive data, require a Data Processing Agreement, SOC 2 Type II, and an explicit statement that your data won't be used for model training.

What is "AI washing"? AI washing is overstating or fabricating a product's use of artificial intelligence to ride the hype. It's now an enforcement target: the SEC fined the advisers Delphia and Global Predictions a combined $400,000 in 2024 for it, and the FTC's Operation AI Comply brought several deceptive-AI cases the same year. The tell is vague "AI-powered" language with no specifics about what the model actually does.

How can I tell if AI tool reviews are fake? Look for review bursts (many five-star reviews in a short window), generic praise that names no specific feature or outcome, reviewer accounts with a single review and no history, and an implausibly perfect rating distribution with no low scores. Fake and AI-generated reviews are now illegal under a 2024 FTC rule, but they persist — Trustpilot removed 4.5 million of them in 2024 alone.

What is a "thin AI wrapper"? A thin wrapper is a product that's mostly an interface over someone else's model (like GPT or Claude) with no proprietary data, integrations, or defensibility. The risk is fragility: when the base models add the feature, the wrapper loses its reason to exist — as happened to a number of early writing and chat tools. Ask what the product does that you couldn't get by prompting the underlying model yourself.

Will this AI tool still exist next year? Maybe not — Gartner expects over 30% of generative-AI projects to be abandoned, and in our graveyard data roughly two in five non-acquisition endings are a silently expired domain with no announcement. Check for recent product updates, a live status page, a non-expiring domain, and (for funded startups) recent investment. If several of those are missing, build an exit plan before you commit.

Does an AI tool need SOC 2 to be trustworthy? For consumer use, not necessarily — but for any tool handling business or customer data, a SOC 2 Type II report (audited over at least six months) is the practical standard, and ISO 27001 matters for European and regulated contexts. A vendor that can't produce either, and has no trust or security page, hasn't invested in enterprise readiness yet.

Where to go next

For the evidence behind the durability warnings, our AI graveyard report breaks down what actually kills AI tools, and the graveyard itself is the running record of the ones that are gone. For how the survivors are being bought up, see our analysis of the 2026 AI consolidation. And for the standard we hold tools to before we list them, our review methodology and the Top 100 AI Tools are the place to start.

The honest version: in 2026, "is this AI tool legit?" has two halves — is it real, and will it last. The scams are getting policed, but slowly; the quiet failures aren't policed at all. Fifteen minutes of public-records checking is the cheapest insurance you can buy against both.

— The ToolDirectory.AI editorial team