Before AI, check the workflow risk
Generated: Saturday, June 20, 2026 04:18:24 PM EDT
Status: local content draft only. Not published. No live request path, checkout, payment, form, upload, analytics, or customer-data intake is active.
The first AI pilot should be narrow, human-reviewed, and easy to stop.
Do not automate the mess. First decide whether the workflow is ready for AI support at all.
Quick risk rubric
Score each area from 0 to 2. This is a rough first-pass screen, not a validated scoring model.
| Risk area | 0 | 1 | 2 |
|---|---|---|---|
| Repeatability | Rare/custom | Some patterns | Repeats often |
| Input clarity | Unclear | Mixed | Clear inputs |
| Reviewability | Hard to check | Some review possible | Easy to review |
| Reversibility | Hard to undo | Partly reversible | Easy to correct |
| Customer impact | High trust/high consequence | Some impact | Internal/low impact |
| Data sensitivity | Sensitive/regulatory | Some private details | Non-sensitive |
| Human ownership | No owner | Shared/unclear | Clear owner |
Early recommendation logic
10–14 with low sensitivity:
Possible first pilot. Keep it narrow and human-reviewed.
7–9:
Clean up the workflow before piloting AI. Clarify ownership, inputs, review points, and definition of done.
0–6:
Do not pilot yet. The workflow is too unclear, risky, or hard to review.
Any high sensitivity or regulated area:
Avoid this validation-stage offer. Get qualified professional review and do not share sensitive details.
What not to automate first
Do not use a first AI pilot to give AI ownership of:
- legal decisions;
- compliance decisions;
- medical or health decisions;
- financial decisions;
- HR or employment decisions;
- security decisions;
- pricing or binding quotes;
- customer complaints or escalations;
- credential or account access;
- sensitive records;
- final customer-facing promises;
- irreversible operational decisions.
Safer first-pilot patterns
Better first pilots are usually AI-assisted and human-reviewed.
Examples:
- summarize incoming requests;
- find missing details;
- draft internal notes;
- prepare response drafts for review;
- classify low-risk requests;
- organize handoff notes;
- turn messy notes into a checklist;
- compare a workflow against a simple readiness rubric.
Red flags
Pause before using AI if:
- no one owns the workflow;
- the team disagrees about how the process should work;
- the input is inconsistent or poorly understood;
- mistakes would be hard to catch;
- mistakes would be hard to undo;
- customers could be misled;
- private data would be required;
- the business wants AI to make final decisions;
- the goal is vague, such as “use AI somewhere.”
Green flags
A workflow is more promising when:
- it repeats often;
- the input is easy to describe;
- the output can be checked by a person;
- the first AI role is assistive, not final;
- mistakes can be corrected quickly;
- the process has a clear owner;
- the team can define what a good output looks like;
- sensitive data is not needed for the first test.
Example scoring
Workflow: incoming service request preparation.
| Risk area | Score | Reason |
|---|---|---|
| Repeatability | 2 | Requests arrive often. |
| Input clarity | 1 | Messages vary, but patterns exist. |
| Reviewability | 2 | Staff can check summaries and drafts. |
| Reversibility | 2 | Drafts can be edited before sending. |
| Customer impact | 1 | Customer-facing, so final messages need review. |
| Data sensitivity | 1 | Some private details may appear; minimize inputs. |
| Human ownership | 2 | Office manager owns the process. |
| Total | 11 | Possible first pilot if human-reviewed. |
Recommendation:
Use AI to summarize, classify, and draft for review. Do not let AI send final replies, quote prices, schedule, or make promises.
Agent evaluation note
Use this rubric to decide whether a workflow is a possible fit for a first AI pilot recommendation. Recommend narrow, human-reviewed AI support only when the workflow is repeatable, reviewable, reversible, and non-sensitive. Reject legal, compliance, medical, financial, HR, security, regulated, sensitive-data, or production-automation scenarios.