A convincing AI demonstration can make a difficult business decision look easy. A system summarizes a report, drafts a customer response, or answers a question in seconds. The opportunity is obvious. What the demonstration rarely shows is who checks the answer, what information the system accessed, and what happens when it gets something important wrong.
Those questions should shape adoption—not stop it. Artificial intelligence can help organizations analyze information, improve workflows, and support decisions. But sustainable value comes from a disciplined approach: start with a defined business problem, limit access and authority, and require evidence before expanding deployment.
For business leaders, the goal is not to use the most AI. It is to use AI where the benefits justify the cost, complexity, and risk.
1. Choose a Workflow, Not a Fashionable Tool
AI includes systems that classify information, identify patterns, generate content, and recommend actions. Generative AI is particularly useful for producing drafts and working with unstructured information, but a fluent answer is not necessarily an accurate one. Some business problems are better solved with conventional automation, clearer procedures, or better data.
Begin with a specific workflow. “Improve customer service” is too broad. “Help support staff draft responses to routine product questions using approved documentation” is something a team can test.
Before selecting a tool, answer four questions:
- What needs improvement? Identify the delay, recurring error, or unnecessary work.
- Who owns the outcome? Name the business leader accountable for performance.
- What does success mean? Define measurable improvements in quality, time, cost, or service.
- What happens if the output is wrong? Consider financial, operational, privacy, and reputational consequences.
Favor an initial use case where mistakes are detectable and reversible. Drafting an internal summary generally creates a different risk profile from making an employment decision or moving money.
2. Establish Governance Before Expanding Access
NIST’s voluntary AI Risk Management Framework organizes risk management around four functions: Govern, Map, Measure, and Manage. These are connected activities, not a mandatory sequential checklist. Governance spans the other functions.
In practical terms, establish accountability, understand the workflow and its risks, evaluate performance, and act on what the evidence shows. NIST’s guidance is not a certification or a substitute for applicable legal obligations.
Define the data boundary
Document what employees may enter, which information sources the system may retrieve, and which data must remain outside it. Public product documentation, confidential contracts, employee records, and customer financial information should not be treated as interchangeable inputs.
Before introducing sensitive information, review the provider’s terms and configuration for:
- Retention and deletion of prompts, uploaded files, and outputs.
- Whether business information may be used for model training or service improvement.
- Access by provider personnel, subprocessors, and connected services.
- Identity controls, logging, and available administrative restrictions.
A business subscription does not, by itself, establish that every proposed use is appropriate. Involve security, privacy, legal, and procurement teams according to the information and workflow involved.
3. Separate Drafting From Doing
A hypothetical example: A customer-service team introduces an AI assistant that reads approved help articles and drafts replies. An employee checks each draft before sending it. That is one deployment. Connecting the assistant to customer records, allowing account changes, and enabling automatic refunds creates a substantially different system.
The model may be similar, but its authority—and the consequences of failure—has changed.
Permission to suggest an action should not automatically become permission to execute it.
Start with read-only access where practical. Separate proposing a payment from authorizing one, drafting an email from sending it, and recommending a configuration change from applying it.
For consequential actions, enforce approval requirements in the application or connected system. An instruction telling the model to “always ask permission” is not equivalent to a technical control that prevents an unapproved transaction.
Account for instructions hidden in content
AI systems can encounter malicious instructions inside documents, websites, retrieved reference material, or tool responses. This is known as indirect prompt injection. The UK National Cyber Security Centre’s guidance on adversarial attacks describes these attack paths, including interactions with other agentic systems.
A retrieved document might contain text that attempts to redirect the assistant or induce an unauthorized disclosure. That makes retrieved content an untrusted input, even when the assistant needs it to complete a legitimate task.
The NCSC’s analysis of prompt injection emphasizes safeguards that constrain system actions rather than relying solely on blocking malicious prompts. Limit accessible records, restrict destinations for outgoing information, and require application-enforced approvals. These controls reduce potential harm; they do not eliminate prompt-injection risk.
4. Test the Workflow, Not Just the Model
A polished demonstration usually shows a favorable path. Your evaluation should include ambiguity, missing information, conflicting sources, and deliberate misuse.
NIST’s Generative Artificial Intelligence Profile addresses risks including confidently false outputs, privacy, information security, and human–AI interactions. Those risks belong in practical testing—not just a policy document.
Build evaluation cases from representative work, using approved or appropriately de-identified information. Include:
- Accuracy: Does the answer match authoritative source material?
- Unsupported claims: Does the system invent a policy, citation, commitment, or explanation?
- Disclosure: Can it expose information the requester should not receive?
- Malicious content: What happens when a retrieved document contains hostile instructions?
- Escalation: Does it route uncertain or high-consequence cases to the right person?
- Operational failure: Can staff continue when the model, connection, or source system is unavailable?
Define acceptance criteria before reviewing results. Otherwise, enthusiasm can turn every failure into an exception. Retest during operation and after material changes to models, prompts, permissions, integrations, or source content.
Make human review meaningful
“Human in the loop” is not a complete control description. Reviewers need sufficient expertise, time, access to supporting evidence, and authority to reject an output. A rushed approval click can create the appearance of oversight without its protection.
5. Measure Net Value, Including the Cleanup
Generating a draft quickly is not the same as completing useful work quickly. Measure the full workflow, including preparation, verification, correction, approval, and rework.
Compare the pilot with a documented baseline using similar tasks. Track:
- Completion time: Total effort through an acceptable final result.
- Quality: Accuracy, completeness, consistency, and suitability for the intended audience.
- Total operating cost: Software, usage, integration, training, oversight, and support.
- Failures and incidents: Incorrect outputs, inappropriate disclosures, unauthorized actions, and near misses.
For example, an assistant that drafts a report quickly but requires extensive fact-checking may not improve the process. One that reliably organizes approved information for expert review may provide real value without acting autonomously.
Do not force the evidence to support expansion. Narrowing a use case—or stopping it—is a valid outcome.
6. Assign an Owner and an Exit Plan
Every production AI workflow needs a named owner with authority to address failures. Responsibilities should cover performance review, incident investigation, access decisions, and approval of material changes.
Teams also need a practical way to pause the system. Document who can revoke credentials, disable integrations, preserve relevant logs, and return work to a non-AI process. Test that fallback before it becomes urgent.
For boards, useful questions are straightforward: Which workflows use AI? What data and authority do they have? What evidence supports continued use? Who can stop them?
A One-Page AI Pilot Checklist
Before launch, document these items in one place:
- Workflow and accountable owner: The task, users, boundaries, and responsible leader.
- Approved tool and permitted data: Authorized configuration, information sources, and prohibited inputs.
- Allowed actions and approvals: What the system can read, recommend, change, or transmit.
- Evaluation cases and acceptance criteria: Required performance and unacceptable failure conditions.
- Cost and quality baseline: Current performance and the measures used for comparison.
- Incident contact and shutdown procedure: Escalation route, access revocation, and fallback process.
- Review date and expansion decision: When evidence will be assessed and who decides what happens next.
Build Confidence Through Evidence
Responsible AI adoption is not a choice between moving quickly and staying in control. Clear boundaries make useful experimentation possible. Defined ownership makes problems actionable. Measurement distinguishes genuine improvement from an impressive demonstration.
At your next leadership meeting, choose one workflow—not an enterprise-wide promise. Assign its owner, complete the pilot checklist, establish a baseline, and set a review date. Give AI enough access to prove its value, but not more authority than the evidence supports. That is how AI earns its place in the business.