Before you put AI into your business, answer these questions

It has never been easier to add technology to a business. A new AI tool can be trialled in an afternoon. It can be connected to an inbox, given access to business documents or placed in front of customers before anyone has clearly decided what it's supposed to achieve. That speed is appealing. It can also allow important decisions to be skipped.

The starting question is often, "What could we do with AI?" A better question is, "What problem are we trying to solve?" That small change places the business need ahead of the technology.

Before introducing an AI tool or AI-enabled automation, we recommend answering the following questions.

1. What problem are we solving?

Be specific. "Improving customer service" is an ambition, not a defined problem. A useful problem statement sounds more like:

• New enquiries received after 4 pm regularly wait until the following morning.
• Staff spend six hours each week summarising site reports.
• Customer information is manually copied between two systems.
• Routine appointment questions occupy a large part of the reception team's day.

A specific problem gives you something to examine and, eventually, something to measure. It may also reveal that AI isn't required.

2. Does this task actually need AI?

Traditional automation is good at predictable rules: when a booking is made, send a confirmation. AI becomes useful when the system needs to interpret less structured information: read the customer's message, identify what they need and direct it to the appropriate person.

Many effective business automations contain no AI at all. Others use AI for one carefully defined step inside a larger process. Using an ordinary rule where a rule is sufficient is generally easier to test, explain and maintain. The presence of AI shouldn't be treated as an improvement by itself.

3. What happens now?

Before changing a process, follow the current version from beginning to end. Who starts it? What information do they need? Which systems are involved? Where does the work wait? What exceptions occur? Who fixes mistakes?

This often exposes a more basic issue. Perhaps the same information is collected twice. Perhaps a form asks the wrong questions. Perhaps nobody has clear responsibility for the handover. Automating that process without addressing the underlying problem may simply allow the confusion to happen faster.

4. What would a useful result look like?

Decide how you will recognise an improvement. That might be:

• Reducing response time from four hours to fifteen minutes.
• Recovering enquiries that currently receive no response.
• Removing three hours of weekly data entry.
• Reducing appointment no-shows.
• Producing a report by the first business day of each month.
• Giving staff one reliable place to find current information.

Record the starting point before implementation. Otherwise, it becomes very easy to remember that the old process was worse without being able to demonstrate how much changed. Not every benefit needs to be financial, but it should be observable.

5. What information will the system use?

List the information the AI will receive, not just the information you intend it to use. A tool connected to an inbox may see customer names, complaints, payment details and attachments. A meeting assistant may record commercially sensitive discussions. A system summarising case files may process health, financial or other sensitive information.

Ask:

• Is personal information involved?
• Is any of it sensitive?
• Where is the information stored?
• Who can access it?
• Does the provider use submitted information to train or improve its models?
• Is information sent to another provider or overseas?
• Can it be deleted?
• What happens to it when the service is cancelled?

For organisations covered by the Privacy Act, privacy obligations can apply to personal information entered into an AI system and to personal information generated in its outputs. The Office of the Australian Information Commissioner recommends conducting due diligence before selecting an AI product and taking a privacy-by-design approach. Read the OAIC guidance.

Privacy and security shouldn't be considered after a system has already been connected to business data.

6. Who could be affected if it gets something wrong?

The consequence of an incorrect internal summary is different from the consequence of an incorrect quote, appointment, employment decision or response to a distressed customer. Consider both likelihood and impact.

What could the system get wrong? Who would be affected? Would the error be obvious? Could it be corrected easily? Would someone know that it had occurred? The greater the potential consequence, the less appropriate it is to rely on an unchecked AI output.

7. Where does a person remain involved?

"Human oversight" shouldn't mean a person nominally supervises the system but rarely sees what it does. Define the actual control:

• A person approves every output before it is sent.
• Only outputs below a financial threshold can proceed automatically.
• Uncertain or unusual enquiries are escalated.
• Customers can request a person at any time.
• A sample of completed work is reviewed each week.
• Complaints and sensitive matters bypass the automation entirely.

Australia's AI Ethics Principles emphasise human oversight and identifiable accountability throughout an AI system's lifecycle. Read Australia's AI Ethics Principles.

The appropriate level of oversight depends on the task. Drafting an internal agenda and rejecting a customer's application do not carry the same risk.

8. Who owns the outcome?

Every system needs a named business owner. That person doesn't need to build or technically maintain it. They do need to know:

• What the system is intended to do.
• What information it uses.
• How its performance is checked.
• Where problems are reported.
• When it should be changed or stopped.

"The AI made the decision" is not accountability. Neither is assuming the software provider is responsible for how your business chose to use its product. Responsibility remains with the business and the people operating the process.

9. How will we test and monitor it?

A successful demonstration is not the same as a reliable business process. Test the system with ordinary cases, incomplete information, unusual requests and the kinds of mistakes real customers make. Test what happens when another system is unavailable. Test whether an enquiry can reach a person.

Monitoring should continue after launch because the process, underlying information and AI service can all change. Useful checks might include:

• Incorrect outputs.
• Cases requiring manual correction.
• Customer complaints.
• Escalation rates.
• Response times.
• Time saved.
• Missed or duplicated work.
• Unexpected use by staff.

A system that was appropriate six months ago isn't automatically appropriate now.

10. Can we stop it safely?

Before switching an automation on, know how to switch it off. If the tool becomes unavailable, produces unreliable results or changes its terms, can the business continue operating? Is there a manual fallback? Can access be removed quickly? Can information be recovered in a usable format?

This is especially important when a new tool becomes part of a customer-facing or operationally critical process.

Planning doesn't need to become bureaucracy

A small business does not need a committee and a 70-page AI strategy before testing a useful idea. For a modest, low-risk implementation, a one-page plan may be enough:

• The problem
• The current process
• The proposed use of AI
• The information involved
• The expected result
• The main risks
• Required human review
• The responsible person
• The trial period
• The decision to continue, change or stop

The point is not to slow implementation down. It is to avoid investing time and money in a tool before the business has worked out whether it belongs in the process.

AI can be useful. Planning establishes where, why and under whose control.