AI is in a “mania” phase. As Simon Willison notes, the market is flooded with tools and bold claims. Here’s a pragmatic way to separate durable value from noise.
Use this 7‑point due‑diligence checklist before you green‑light any AI project. It keeps teams honest on risk, ROI, and real‑world impact.
Your 7‑point checklist
- Problem‑first, not model‑first: Define the user, task, and failure cost. Write the success metric before you pick a model.
- ROI and unit economics: Baseline today’s workflow and estimate impact (accuracy, latency, cost). Include total cost of ownership: tokens/infra, evals, red‑teaming, monitoring, and support.
- Data readiness and governance: Map sources, consent/PII, retention, lineage, and access controls. No shadow datasets. Document allowed and disallowed data.
- Safety and security by design: Threat‑model prompt injection, data exfiltration, and model abuse. Follow the OWASP Top 10 for LLM Applications.
- Evals and monitoring: Build a small golden set for offline tests; track online quality, guardrails (e.g., PII leakage), and drift. For context on benchmarks, see Stanford HELM.
- Human‑in‑the‑loop workflow: Define review thresholds, escalation paths, audit logs, and feedback capture. Automate the mundane; escalate the risky.
- Pilots, controls, and rollback: Ship a narrow pilot with pre‑registered success and kill criteria. Use feature flags, rate limits, and incident response plans.
Quick hype smell test
- Vendor‑first deck with no clear problem statement or metric.
- “We need an agent” but no SOPs, permissions, or audit trail.
- No named data owner or governance plan.
- No red‑teaming or security review scheduled.
- Demos ignore edge cases, latency budgets, or privacy constraints.
What to build now (low‑regret bets)
- RAG over curated internal docs for support/sales. Start narrow; eval exact‑match retrieval and factuality before scaling.
- Human‑approved copilots for repetitive ops (intake triage, QA drafting) with clear approval gates.
- AI search on logs and knowledge bases to speed incident triage and onboarding.
- Small‑model fine‑tuning/adapters when domain data and compliance allow—optimize for latency, cost, and privacy.
Further reading
- Context on the current moment: AI mania — Simon Willison
- Market reality checks: Stanford AI Index
- Risk management guidance: NIST AI Risk Management Framework
- Security best practices: OWASP Top 10 for LLM Applications
- Evaluation landscape: Stanford HELM
Bottom line
If you can’t write the evals and ROI math, don’t ship. In a hype cycle, disciplined checklists are your unfair advantage.
Get smarter weekly
Enjoy insights like this? Subscribe to our newsletter for bite‑size, practical AI briefings: theainuggets.com/newsletter.
