Five questions before putting AI into an enterprise system

AI use inside organisations usually starts the same way: a team discovers a tool that makes their work easier, starts using it, and nobody asks anything. The questions only arrive after an audit, a customer query, or an incident.

There are five questions to answer before building an AI-assisted system. Not all of them are technical; some are contract and process questions.

1. Which data reaches the model?

This is the most basic question, and in most organisations it has no answer. Decide in writing which fields are sent to the model and which are not. "Employees should be careful" is not a control; a technical restriction is needed.

The second half: how long does the provider retain that data, and is it used for training? This should be written in the contract, not read off a blog post.

2. Is the output a decision or a suggestion?

Building a system that applies AI output directly is a serious risk wherever it has consequences for a person. Article 11 of the Law gives the data subject the right "to object to a result against them arising from analysis exclusively by automated systems".

In practice: a human approval has to remain at every consequential step, and that approval has to be recorded.

3. What are you recording?

For a call to be auditable you need at least: a summary of the input, the model used, the output, and a timestamp. Without this record, six months later there is no answer to "why did the system say that".

While recording, take care not to accumulate personal data — keeping a summary is often more appropriate than storing the full text.

4. What will the model not do?

The limits have to be written down. The system prompt should define what the model will not answer, which data it will not request, and where it hands over to a person. Those limits should also appear in the contract so no interpretation gap opens later.

5. Is there a measurable benefit?

At least as important as the rest. If doing a task with AI has no measurable payoff — no shorter cycle, no fewer errors, no added capacity — then not using AI for that task is the right call. The deployment itself carries a maintenance burden.

The standards side

ISO/IEC 42001 covers AI management systems and ISO/IEC 23894 covers AI risk management. Both put the questions above into an organisational frame: inventory, policy, risk assessment, monitoring.

We describe this approach and where it applies on the AI-assisted systems page. The assessment tool and the assistant on this site run on the same rules — we apply to ourselves what we describe to others.

---

This article is for information and does not constitute legal advice.