POS Integration Checklist: 12 Things to Verify Before Signing in 2026

Technical checks (points 1-6)

Point 1 — integration direction: read-only or two-way. AI that just reads the menu from the POS covers 80% of cases. Two-way (AI sends orders directly into the POS) cuts manual entry to 0% and reduces errors below 2%. Point 2 — stock sync: webhook (instant) or polling (every 30 seconds). Webhook prevents orders for out-of-stock items. Point 3 — item mapping: who does it and is it in the package. POS has Margherita Pizza 32cm, web says Margherita large, AI must know they are the same.

Point 4 — modifiers: can the AI offer no cheese, extra thin, half veggie. Every POS stores them differently, must be mapped. Point 5 — fiscalization: who handles fiscal POS or AI. Correct answer: POS. AI only enters items, POS fiscalizes per the legal process. No extra complexity for you. Point 6 — offline fallback: what happens if the POS crashes mid-call. AI must have a local queue that waits and syncs once connectivity returns.

Commercial checks (points 7-12)

Point 7 — setup fee: is there a one-time charge. Standard integration with a ready connector is usually included in monthly pricing. A hidden setup fee of 1500-3000 EUR is a red flag. Point 8 — lock-in: how long are you bound. Monthly cancellation is the 2026 standard. Annual lock-in without an exit clause is a negotiation flag. Point 9 — data ownership: who owns reservation and transaction data. You, not the vendor. Verify this is explicitly in the contract, not implied.

Point 10 — volume-based billing: what happens if you exceed the limit. Per-call billing can escalate fast. Flat subscription with a defined buffer zone (e.g. 200 calls +10% buffer) is safer. Point 11 — uptime SLA: guaranteed uptime must be 99.5%+. What happens during a weekend outage in peak season? Compensation (credit-week or refund) explicitly in the contract. Point 12 — GDPR DPA: Data Processing Agreement. EU server, ISO 27001 or SOC 2 certification, max 24 months data retention. Without a DPA, both parties are liable under GDPR Article 28.

Five contract traps often hidden in the fine print

First trap: vague language on data ownership — clauses granting the vendor a perpetual irrevocable license to your data. If you cannot edit that clause, do not sign. Second trap: high egress cost — how much it costs to export your data if you cancel. Industry standard is free in JSON/CSV/SQL format. PDF-only export is a red flag (vendor hostage situation).

Third trap: subprocessor clause — the vendor sends data to third parties (analytics, monitoring, cloud hosting). If the list is not exhaustive and fixed, you can have a GDPR problem without knowing. Fourth trap: automatic renewal with price increase — the contract auto-renews for 12 months and the price can rise 10-15%. The correct clause should cap at 5% annual increase with 60 days advance notice. Fifth trap: data deletion on cancellation — how long your data is retained after termination. Industry standard is 30-90 days, not 12+ months.

Quick assessment before signing

If 9 or more of 12 technical and commercial points are answered satisfactorily — the contract is likely OK. If 6-8 — negotiate on the rest before signing. Under 6 — that is not a serious partner and you should look elsewhere. One additional check: ask for references from similar restaurants that have already implemented. A serious vendor has 5+ comparable clients they can name. Without references, that is a red light.

A practical example: for restaurants with local POS systems not on the ready-connector list, custom middleware typically costs 500-1500 EUR one-time and takes 2-4 weeks. A vendor who refuses middleware development or asks more than 3000 EUR for an average-complexity POS is worth walking away from. There is also the question: who does the item mapping in the POS? You (bad, time loss), the vendor one-off (OK), or the vendor continuously (best for growth).

What to verify in the contract: practical checklist

Five concrete clauses you must read before signing: (1) Service Level Agreement — minimum 99.5% uptime with compensation, (2) Data Processing Agreement — GDPR Article 28 compliant, EU server, list of subprocessors, (3) Data portability — export in JSON or CSV for free, not PDF-only, (4) Termination — monthly cancellation without penalty, data retention max 90 days after, (5) Pricing escalation — max 5% annual increase with 60 days advance notice.

Plus one practical check: ask to see their DPA text BEFORE signing the main contract. A serious vendor has a standard DPA on their website or sends it within 24 hours. A vendor that drags or delays the DPA — probably has no compliant document, which means your company carries the GDPR risk. Without a DPA, the penalty is up to 4% of global revenue or 20 million EUR (whichever is higher).

Frequently asked questions