An anonymous real example
A colleague asked an internal AI assistant to review material and produce an outline. It drew on older drafts and ideas, presenting some of them as if they described what the organisation had decided to do. The colleague knew the difference: those ideas had never become decisions. Someone without that history could have received the same confident answer without recognising the problem.
The assumption worth revisiting.
Access control answers who may see information. It does not, on its own, establish whether that information is current, approved or superseded. Connecting an assistant to more of the estate can expose unresolved information-management problems. The assumption to unlearn is that making internal knowledge searchable makes it dependable. A discarded idea and an approved policy may use almost the same language. People could follow an abandoned process, repeat an obsolete promise or spend time reconciling conflicting answers. The risk comes from the status of the information as well as the model’s handling of it.
What makes this source authoritative, beyond the fact that it exists?
Give the capacity a purpose.
Give business owners time to curate the material their teams rely on. Agree what counts as authoritative, who maintains it and how old versions are retired or clearly labelled.
How this fits the capacity allocation →
Use AI to challenge your first interpretation
Explore this question without assuming our first interpretation is right: What makes this source authoritative, beyond the fact that it exists? Offer competing explanations, identify assumptions and suggest evidence we could obtain from the people doing the work.
Treat the answers as possibilities to test with people and evidence.
Go deeper into the evidence.
UK National Cyber Security Centre · Threat assessment
NCSC assesses how AI may increase the efficiency and frequency of cyber activity and affect vulnerability exploitation and connected systems.
A threat assessment and forecast, not a measured loss probability for your business. Test your own workflows and exposure.
video
Introduction to the NIST AI Risk Management Framework (AI RMF 1.0): An Explainer Video
NIST
Gives leaders a shared starting point for deciding who owns AI risks and what needs checking throughout a system’s use.
Listen or watch for: Who owns the risk after a tool moves from pilot to everyday use?
About this resource
An introduction to a voluntary US framework, not UK legal advice or a certification. NIST says the framework is being revised.