In plain English
Suitable AI automation tasks are repetitive, low-consequence, easy to verify and safe to reverse. Examples can include classification, draft preparation, information extraction and internal summaries with human review. Avoid unsupervised pricing, eligibility, legal or sensitive customer decisions. Define approved data, success tests, escalation, logging, access, rollback and a named owner before release.
What makes an AI automation task a sensible first candidate?
Choose a task with clear inputs, an observable output and a person who can judge whether the result is acceptable. Repetitive classification, draft preparation, extraction and summarisation may be candidates when errors are easy to detect and correct. Measure the current manual process first so the business can compare quality, time, exceptions and rework rather than assuming automation created value.
Avoid selecting a process simply because it is unpopular or time-consuming. A messy process can become a faster messy process. Map the trigger, data sources, rules, judgment points, downstream actions and failure effects. The NIST AI Risk Management Framework encourages organisations to govern, map, measure and manage AI risk; that sequence is useful even for a small internal workflow.
Sources for this section: NIST AI Resource Center.
Which decisions should remain under human control?
Keep consequential decisions with an authorised person when they affect eligibility, pricing, employment, finance, legal position, safety, sensitive advice or a customer's rights. AI can prepare context or a draft, but the reviewer needs enough source information and time to make an independent decision. The interface should show uncertainty and make rejection or correction easier than passive approval.
Define the review threshold by risk rather than convenience. A low-risk internal label may be sampled, while customer-facing or consequential output may require review every time. Name the reviewer and backup, state what evidence they inspect and record the version of the prompt, model or rules used. Human review is a control only when responsibility and procedure are real.
Sources for this section: NIST AI Resource Center, Artificial Intelligence Risk Management Framework: Generative AI Profile.
How should data and permissions be bounded?
List the data the workflow may receive, where it comes from, the approved purpose, who can access it and which providers process it. Exclude unnecessary personal, confidential or privileged information. Use test or synthetic records during early development where practical, but keep them clearly labelled. Confirm retention, deletion, region and training-use settings for each external service.
A customer enquiry does not automatically authorise every later AI or marketing use. South African businesses should assess processing against POPIA, the privacy notice and qualified advice for the specific workflow. Apply the same permissions to logs, evaluation datasets and fallback tools. A secure primary path can still leak information through copied prompts, screenshots or unrestricted error reports.
Sources for this section: Guidance notes.
What should be tested before an AI workflow is released?
Build a representative evaluation set with normal, incomplete, ambiguous and adversarial inputs. Define acceptance criteria for accuracy, source fidelity, harmful output, privacy, latency and recoverability. Test what happens when the model, provider, network or downstream system fails. The workflow should stop safely, alert an owner and preserve enough context for a person to recover without guessing.
Release to a small scope, monitor exceptions and keep a manual takeover path. Record model and prompt changes because behaviour can shift even when the business process has not. NIST's generative AI profile describes risk actions across the lifecycle rather than treating evaluation as a one-off launch gate. Continue sampling results and retire automation that cannot remain controlled or useful.
Sources for this section: NIST AI Resource Center, Artificial Intelligence Risk Management Framework: Generative AI Profile.
Official references
- NIST AI Resource Center (National Institute of Standards and Technology)
- Artificial Intelligence Risk Management Framework: Generative AI Profile (National Institute of Standards and Technology)
- Guidance notes (Information Regulator South Africa)