Any artificial intelligence can make a mistake, and no comparison will tell you which one will be wrong on the answer that matters. For companies, the question of choosing an AI therefore arises on a use-by-use basis, depending on what a mistake would commit them to. A method based on an impact analysis allows for a decision.
Take a security questionnaire sent by a major client, with a long list of questions and a tight deadline. A team fills it out with the help of an AI, quickly proofreads it, and then the security manager signs it. To the question ‘are the backups encrypted?’, the AI answers yes, based on a policy that has since changed. No one notices. The client, however, will see it during the first audit, and the question will no longer be whether the AI was wrong, but who signed, and on what basis.
An AI mistake can be corrected as long as it remains a draft. It costs as soon as a person has committed to it under the company’s letterhead. The same AI, with the same error rate, can be inconsequential in an internal memo and dangerous in a response addressed to a client. That is why the choice of tool must be made for each specific use.
Four levels, one single question
The method involves asking, for each use, what is committed to if the answer is false and no one notices. Four answers are possible. Nothing, in the case of an internal memo, a rephrasing, or a draft that will be reviewed anyway. Work, when a document needs to be redone and time is lost, without any commitment made. A commitment, with a contractual response, a declaration to a client, or a quote. Finally, exposure, with regulatory reporting, a compliance certificate, or a document produced under the control of an authority.
The executive committee does not have to quantify the cost of each mistake, because no source provides it in advance. It must decide, for each level, what the company accepts: signing without verification, requiring to see the source, or refusing to let a machine produce the content. This is a risk tolerance decision, made use by use and not once and for all for ‘AI’.
For each level, its tool
For the first two levels, a mainstream generative AI may be suitable, within the limits of what can be entrusted to it without risk. For the next two, speed is no longer enough and three requirements become essential: that each claim cites the document, page, and version from which it is drawn; that the system knows how to indicate that it cannot answer, because a false answer is paid for in front of an auditor; and that a named person validates the content, with a traceable signature.
The author adds a fourth requirement: verification must not be entrusted to the model that drafted the content. Researchers demonstrated this at the ICLR 2024 conference, and a more recent study points in the same direction: verification gains in effectiveness when the controller is less similar to the one that answered. The check can therefore be performed by another AI, specialized in the business and the company’s documents, which verifies each claim against its source and flags what it cannot establish. A disagreement between the two AIs does not provide the correct answer, but indicates where a human needs to look. This control runs within the company’s protected space, not with a third party.
What the committee decides
The order of the process matters. First, inventory the uses and determine, for each one, what a silent error would commit the company to. Then comes risk tolerance, level by level. The tool only comes in last, sized to this tolerance and not to the vendor’s demonstration.
Let’s return to the questionnaire. With this method, the answer about the backups would have mentioned the policy reference, its version, and its date. A second AI, or a proofreader attentive to that date, would have noticed that the cited version was no longer the latest, and the security manager would have signed with full knowledge. The machine would still have been wrong, but someone would have known before the client.
