Approach
How I evaluate AI use cases
Most AI use-case lists are wish lists. Before anything is built, I look at a use case from several sides at once, because a technically elegant solution that nobody may legally use, or that nobody trusts, isn't a solution.
1. Value and people
- Whose work changes?
- What problem does it solve?
- What happens if it's wrong?
- Would a process fix solve it without AI?
2. Data
- What data does it need?
- Where does that data live?
- What is its quality?
- How sensitive is it — personal data, special categories?
3. Approach
Which technical path fits the task, the data and the risk:
- No AI / rules — when the problem is process or information design
- Off-the-shelf tool — when a managed product is enough
- RAG over our own content — when answers must come from approved sources
- Fine-tuning — when style or domain language matters and data allows it
- Agentic automation — when multi-step work needs oversight, not only an answer
Sometimes the answer isn't AI
Before choosing a model, I ask why the problem exists. Unclear information, incomplete forms or missing status updates create many of the requests AI is asked to handle. Fixing those first is often cheaper and safer, and gives any AI that follows clean content to work from.
4. Hosting and security
Where it runs, and what that means for control, cost, quality and operating effort:
- Cloud with EU data residency
- Sovereign or German cloud
- On-premise with open-weight models
I also check alignment with information security and risk management at a high level — for example NIS-2 and ISO 27001 — without claiming certifications the organisation doesn't hold.
5. Risk and regulation
- EU AI Act risk class: prohibited, high-risk, limited-risk (transparency duties), or minimal
- GDPR: lawful basis, purpose, retention and data-subject rights
- Where human oversight sits — and who can stop or correct the system
Systems that influence access or admission to education fall into the AI Act's high-risk category. Application timelines should be checked against the current legal status — they change.
6. Evaluation
- How we'll know it's good enough before launch
- Test sets built from real past cases
- Which errors matter most — false negatives versus false positives. I wrote about that in When the AI Thinks the Burglar Is the Cat.
- Monitoring after launch
7. Adoption
- Who needs to learn what — see AI learning.
- What the gate out of the sandbox looks like — The AI Sandbox Needs a Gate.
Output
A one-page assessment per use case: a recommendation to build, buy, pilot or park, named owners, and clear next steps.