Skip to main content

​
Does every automation opportunity need AI?

No. Eliminate, simplify, standardise, integrate or use deterministic automation before adding probabilistic AI where those approaches solve the problem better.

​
When is an LLM justified?

When the task materially involves language interpretation, drafting, summarisation, extraction or reasoning over unstructured information and the failure mode can be controlled.

​
When is an agent justified?

When the system genuinely needs to perform a sequence of tool-based actions and the value exceeds the additional permission, security and monitoring complexity.

​
What does human oversight actually mean?

Specify who reviews which output, at what stage, using what information, and what happens when they disagree.

​
Can I say an AI system is accurate?

Only against a defined task and evaluation. Broad claims such as “95% accurate” are meaningless without explaining the test set, metric and consequence of error.

​
What is hallucination risk?

The model may generate unsupported or incorrect content. Controls may include approved sources, validation rules, human review and restricted use cases.

​
What is prompt injection?

Untrusted content can contain instructions intended to manipulate an AI system. This matters especially when models read email, web pages, uploaded files or other external content while having access to tools.

​
Should an agent have write access to production systems?

Only where the use case requires it and permissions are tightly scoped. Prefer read-only or approval-gated actions where possible.

​
What data should I collect in a diagnostic?

Only the data needed for the agreed business question. Data minimisation reduces security, privacy and analysis burden.

​
Is vendor security enough?

No. The risk depends on your actual architecture, permissions, data, integration design and operating controls.

​
What about sensitive or regulated decisions?

Escalate for appropriate specialist legal, compliance, risk or security review. Do not use a generic consulting checklist as a substitute for regulated advice.

​
How do I explain AI risk without frightening the client?

Be concrete. Describe the actual failure mode, consequence and control rather than speaking vaguely about “AI risk.”

​
Do I need a governance framework for a small pilot?

Use governance proportionate to risk. Even a small pilot should have an owner, scope, approved data, success criteria and a rule for what happens when outputs are wrong.

​
Should we log AI outputs?

Where auditability matters, retain enough information to reconstruct important decisions or actions while respecting privacy and retention requirements. No. The Resource Hub provides practical consulting guidance. Regulatory applicability depends on jurisdiction, sector and use case and may require qualified advice.