Skip to main content
CTO Insights

Choosing an LLM API: How to Evaluate Providers Properly

September 5, 2026

Provider choice gets made on benchmark tables and reputation, and then regretted for reasons that were never on the table: rate limits during a traffic spike, latency that ruins a voice interface, or a data processing term that legal will not accept.

The benchmarks are the least useful input, because they measure general capability and you have a specific job.

Build an evaluation set from your own cases

Take thirty to fifty real examples from the work the system will actually do, with the correct answer written down by someone who knows. That set will tell you more in an afternoon than a month of reading comparisons, and it keeps telling you things every time a new model appears.

Include the awkward cases deliberately. A provider that handles the clean eighty percent well and falls apart on the exceptions is a provider that will look excellent in testing and cause incidents in production.

Latency matters more than most teams plan for

A response that takes four seconds is fine in a batch job, tolerable in a chat interface and unusable on a phone call. Measure it under realistic conditions with realistic prompt sizes, because latency scales with input length and your test prompts are usually shorter than production ones.

Check the variance, not just the average. A model with a good median and an occasional very slow response will produce a support queue.

Rate limits and what happens when you hit them

Ask what the limits are at your tier, how they are enforced, and how quickly they can be raised. The failure mode that hurts is a traffic spike coinciding with a throttle, so the system needs a defined behaviour when the provider says no: queue, degrade to a smaller model, or fail visibly.

Designing that path is a half day of work and it is the difference between a busy period and an incident.

Nobody switches provider because of a benchmark. They switch because of a rate limit at the worst possible moment, or a legal review that stopped the project.

Sam Ortiz, Director of Engineering, Engineered With AI

Data handling is a gating question, not a detail

Establish early whether your inputs are used for training, how long they are retained, where processing happens geographically, and what the terms say about your obligations to your own customers. In regulated sectors this determines the shortlist before any capability question is asked.

Get the answer in writing from the provider terms rather than from documentation summaries, and have whoever owns those obligations in your organisation read it.

Cost at your actual volume

Per-token pricing is easy to compare and misleading in isolation. What matters is cost per completed task at your prompt sizes, which depends on how much context you pass and how verbose the output is. A cheaper model that needs more retries or longer prompts can cost more per useful result.

Model it on the evaluation set rather than on list prices, and include the failures, since a retry costs the same as a success.

Plan the switching cost down

Keep provider-specific code behind a thin interface so a change is a configuration decision rather than a rewrite. This is cheap to do at the start and expensive to retrofit, and the field moves quickly enough that you will exercise it.

Multiple providers is a reasonable answer

Routing simple work to a cheap model and hard work to a capable one is common and sensible, and it doubles as a fallback when one provider is degraded. It costs a little more engineering and removes a single point of failure. Our automation index covers where these decisions land by sector.

Deprecation is the schedule nobody plans for

Model versions are retired, and the notice period is often shorter than an enterprise release cycle. A system pinned to a specific version will eventually be forced onto a newer one, and newer does not mean identical: prompts tuned against the old version can behave differently enough to matter.

Pin the version deliberately rather than tracking latest, keep the evaluation set so a forced migration can be assessed in an afternoon, and treat provider deprecation notices as scheduled work rather than as interruptions.

Regional processing and residency

Where inference physically happens is a contractual question with real consequences for regulated work, and the answer differs between providers and sometimes between models from the same provider. Establish it before building, because retrofitting a residency requirement usually means changing provider entirely.

Not sure which provider fits?

We will build an evaluation set from your own cases and test the shortlist against it, so the choice rests on your data rather than a leaderboard.

Book a call

Talk to us about your own process

Book a call and we will look at your leads or your repeat work together.

Book a Call