McElveenSOLUTIONS GROUPLet’s talk
← All practical perspectives

AI & data governance

Before an AI pilot: five decisions to document

Scope an AI pilot with clear data permissions, human review, evaluation criteria, and stop conditions.

A persuasive AI demonstration is a starting point. A useful pilot must answer whether a defined workflow can improve under real operating constraints. Before selecting a model or connecting business data, capture five decisions in a short pilot brief that both the business owner and technical team can review.

1. What workflow are we improving?

Choose a bounded task with a named user and decision owner. Record the current process, expected improvement, and baseline measurement. A draft-document assistant, for example, should have a defined document type and review process rather than an open-ended instruction to automate knowledge work.

2. Which data may the pilot use?

List approved sources, owners, sensitivity, access restrictions, and retention expectations. Check vendor terms and actual account settings before sharing information. Use representative test data approved for the purpose. Keep credentials and restricted information outside an experimental workflow unless the authorized environment and handling rules expressly support them.

3. Who reviews the output?

Identify where a qualified person checks accuracy, context, and appropriateness. Define when the system must stop or escalate. For a document assistant, require the reviewer to compare important claims against authorized sources before release. Record the reviewer’s decision when an output affects a customer or business commitment.

4. What evidence will count as success?

Create a small, representative evaluation set before testing. Include ordinary tasks, ambiguous inputs, missing information, and cases the tool should decline or escalate. Track quality, review effort, operational cost, and failure patterns. Set acceptance thresholds with the owner rather than choosing them after seeing favorable results.

5. When do we stop, revise, or expand?

Document stop conditions, incident contacts, rollback steps, and the authority required to expand access or scope. Preserve the evaluation results and unresolved limitations. A pilot can reasonably conclude with a smaller use case or a decision to wait.

Connect the pilot to risk management

The voluntary NIST AI RMF provides four functions: Govern, Map, Measure, and Manage. These functions provide a broader risk-management reference; the five decisions here are MSG’s practical scoping suggestions. NIST is revising AI RMF 1.0, so check the current framework and applicable customer requirements when setting the final scope.

Source: NIST AI Risk Management Framework

Turn the questions into a scope.

Bring your requirements, constraints, and decision deadline. MSG can help define an accountable starting engagement.