Strategy / AI
Where AI Does Not Belong Inside Your Organization
Why responsible adoption starts with deciding where not to use the technology
Lior Romanowsky Reading time: 14 min read
TL;DR
The first question about AI in an organization isn't where to start. It's where using it would do more damage than good. A simple traffic-light model sorts every use into green (AI executes), yellow (AI assists, a human decides), and red (AI does not decide), and five boundaries define the red zone: hard-to-reverse actions, human accountability, data the organization doesn't control, judging people on partial information, and domains with nobody able to check the output. Mature adoption is measured by the quality of judgment before deployment, not by the number of systems deployed.
Not every problem needs an AI solution
For the past few years I've been hearing almost the same request, over and over, in different wordings:
We want to bring AI into the company. Where should we start?
It's a fair question. Sometimes it even leads to an excellent project. But it usually isn't the first question to ask.
The first question should be:
Where can AI create value, and where would using it do more damage than good?
Small difference in wording. Large difference in thinking.
Once a new technology gets good enough, everyone runs the same cycle. First they dismiss it. Then they get excited about it. Then, in phase three, they try to put it everywhere.
AI is deep in phase three right now.
Every process needs an agent. Every department needs a smart assistant. Every product needs an AI layer. And every board deck needs at least one slide with the word "transformation" on it, or apparently we haven't made progress.
I'm a strong believer in AI. I build products, processes, and solutions around it for organizations. That's exactly why I don't think it belongs everywhere.
Mature AI adoption isn't measured by how many systems you deployed. It's measured by the quality of judgment you applied before deploying them.
"We can" is not a good enough reason
You can use AI to write copy.
- You can analyze calls.
- You can rank candidates.
- You can predict which employees are likely to leave.
- You can recommend a price.
- You can answer customers.
- You can approve or reject requests.
- You can let a system act autonomously.
But "we can" is a technology question.
"We should" is a business, human, legal, and sometimes moral question.
They are not the same question.
In every AI project I review, I try to understand not only what the system can do, but what happens on the day it gets something wrong.
Because it will.
Not every time. Maybe rarely. But it will get things wrong, exactly the way employees, managers, and other systems do. The question is whether the organization is built to absorb that error.
The traffic-light model: classify before you start
Before putting AI into a process, sort the use case into one of three zones.
Green — AI can execute
- Low cost of error
- The action is reversible
- The data isn't especially sensitive
- The output is relatively easy to check
- There's a clear definition of a good result
For example: summarizing documents, drafting copy, classifying inbound requests, searching a knowledge base, producing first versions, extracting action items from a meeting.
Here you can let AI work and leave people with spot-checking and correction when needed.
Yellow — AI assists, a person decides
There's meaningful business or human impact.
For example: candidate evaluation, pricing, quality checks, employee performance analysis, messages to sensitive customers, financial recommendations, risk detection.
AI can organize information, surface patterns, and recommend. It shouldn't make the call alone.
Red — AI does not make the decision
- High cost of error
- The action is hard or impossible to reverse
- The decision affects rights, health, money, or a career
- You can't explain how the decision was reached
- Nobody is qualified to genuinely supervise the system
For example: automated terminations, a medical decision without professional sign-off, cutting off an essential service, a legal determination, approving or denying credit with no appeal path, a material financial action without approval.
Once a process is classified red, the question is no longer how to improve the model. It's what part of the process should reach it at all.
This model is deliberately simple.
Organizations don't always need another complex framework. Sometimes they just need to stop and say out loud: this use is green, this one is yellow, and this is a zone where we don't let the system decide.
Boundary one: decisions that are hard to reverse
You can delete a draft email. You can fix an inaccurate summary.
You can even revisit a business recommendation before anyone acts on it.
But there are other decisions.
- Rejecting a candidate.
- Blocking a customer.
- A financial transfer.
- Ending a service.
- Changing employment terms.
- A medical determination.
- A legal action.
In these places, saving time is only a small part of the equation.
What is the maximum damage the system can do before someone notices?
The more significant the action and the harder it is to reverse, the smaller AI's role should be. It can prepare, consolidate information, flag anomalies, raise questions, and suggest options. But a person needs to make the decision.
And not just a "human in the loop", because that phrase has become a magic fix in spec documents. You need someone who understands the subject, holds the authority, knows how to push back, and is willing to carry the responsibility.
Auto-approving an automated recommendation isn't human oversight. It's automation with one extra click.
Boundary two: human accountability
Some processes managers want to automate because they repeat. Others they want to automate because they're unpleasant.
Those are two different things.
- Negative feedback.
- Rejecting a candidate.
- Handling an angry customer.
- A conversation about weak performance.
- Announcing a significant change.
- Letting someone go.
AI can help a lot with preparing for conversations like these. It can organize the facts, sharpen the wording, catch aggressive phrasing, and help a manager show up better prepared. It shouldn't replace the human presence itself.
When someone receives significant news about their work, money, health, or future, they need more than information. They need to be able to ask, respond, understand context, and feel that someone across from them is taking responsibility.
There are moments where the person isn't a bottleneck. They're part of the product. Part of the service. Part of the decision.
There are also moments where "efficiency" is just a polite word for avoidance.
A manager who won't hold a hard conversation doesn't need a better bot. They need to become a better manager.
Boundary three: systems the organization doesn't control
One of the most common requests is to connect AI to "all the company's data": email, documents, calls, the CRM, HR systems, financial data, and internal messages.
Technically, a lot of that is possible. Managerially, it can be a serious mistake.
Before connecting data to AI, you need to know:
- Who owns the data
- Who is allowed to see it
- Why it was collected
- Whether it's accurate
- What consent was given for it
- How long you're allowed to keep it
- Whether it may be used for this new purpose
- What happens if it leaks or is exposed
If the organization can't answer those questions, it doesn't have an AI problem yet. It has a data governance problem.
AI doesn't tidy messy data just by showing up. Sometimes it only makes it faster to reach, easier to surface, and more dangerous.
The same is true for processes.
Service complaints come in, so the company adds a chatbot — but there's no clear service policy. Sales misses targets, so someone wires up lead scoring — but the target audience was never defined. Leadership struggles to decide, so a smart dashboard appears — but nobody knows who owns which number.
A broken process with AI is still a broken process. It just runs faster.
Before putting AI into a process, check:
- Is the process clear?
- Does it have an owner?
- Do we know where it starts and where it ends?
- Is success measured?
- Is the problem really manual work, or weak management decisions?
Sometimes the most professional work in an AI project is stopping before you build. Not because the technology can't do it, but because the organization isn't ready to use it well.
Boundary four: judging a reality it can't actually see
One of the most tempting uses is AI that measures people.
- Who is more productive.
- Who is less engaged.
- Who is a flight risk.
- Who is ready for promotion.
- Who needs management intervention.
On paper it looks like a move from gut-feel management to data-driven management. But employee data is almost always partial.
Email volume doesn't measure contribution. Hours online don't measure impact. Ticket counts don't measure quality. Meeting attendance doesn't measure leadership. And Slack message volume, thankfully, is still not a measure of intelligence.
When a system receives partial data, it doesn't necessarily know the data is partial. It produces a complete conclusion from it, in confident, persuasive language. That's exactly what makes the output dangerous.
A weak data point in a table looks like a weak data point. A weak data point that passed through a model and came back as a well-written recommendation can look like the truth.
AI can help spot a change, flag an anomaly, and suggest a question a manager should look into. It shouldn't determine who's a good employee, who's loyal, or who deserves a promotion based on a partial picture.
Don't let a system judge a person on information you wouldn't have been willing to judge them on yourself.
Boundary five: places where nobody can check it
One of the more dangerous illusions is that AI can replace expertise the organization doesn't have.
It can certainly extend existing capability. It can help a doctor summarize information, a lawyer locate clauses, a finance lead spot anomalies, and a product manager weigh options. It doesn't turn an organization without expertise into an expert one.
If nobody in the company understands regulation, you can't let AI manage regulation. If nobody understands security, you can't assume a system will identify what's risky on its own. If nobody can evaluate a medical, legal, or financial recommendation, nobody will catch it when it's wrong.
AI can produce a wrong answer that sounds highly professional. That's sometimes more dangerous than a weak answer, because linguistic confidence makes people stop checking.
Don't use AI to do work nobody in the organization is able to evaluate.
You don't need to be able to perform every task by hand. But someone has to be able to recognize what a good result is, what a dangerous one is, and when to stop.
Without that, there's no oversight. There's faith.
And faith is a fairly poor management model for autonomous systems.
What responsible use looks like in practice
Say a company wants to use AI to improve hiring.
The irresponsible version is letting the system scan resumes, score candidates, and reject everyone below a threshold.
The more responsible version looks like this:
- AI consolidates information from the resume
- Flags missing details
- Compares the candidate's experience to the role requirements
- Suggests interview questions
- Identifies contradictions or points to verify
- A qualified person makes the next-step decision
- The reason for the decision is documented
- The outcome can be revisited
Same technology. Completely different level of accountability.
That's the point most people miss. The question isn't only whether you use AI. It's what role you give it inside the system: advisor, assistant, reviewer, recommender, or executor.
Not every role fits every process.
Autonomy is built, not granted
AI agents can perform more actions independently. They can read data, make intermediate decisions, update systems, send messages, and trigger processes.
That's real capability. But automation and autonomy aren't the same.
Automation runs inside defined rules. Autonomy makes decisions along the way.
The more autonomous a system is, the more boundaries it needs, not fewer.
You need to define:
- Which actions it's allowed to take
- Which data it's allowed to access
- The maximum amount or risk involved
- Which actions require approval
- How you stop it
- How every action is logged
- Who reviews its performance
- Under what conditions permissions get narrowed
Instead of jumping straight to full autonomy, step up in stages. First AI suggests. Then a person approves. Then AI performs a limited action. Then you move to spot-checking. Only after the system has proven stable do you widen its scope.
Trust isn't a feature you switch on in a settings screen. It's the result of consistent performance under supervision.
Customer service: don't turn AI into a wall
Customer service is a natural place for automation. Customers want fast answers, service teams are overloaded, and a lot of the inbound repeats.
AI can resolve a large share of it. It can identify intent, retrieve information, explain a process, and point the customer to the next step. It shouldn't be the only channel.
A customer has to be able to reach a person when:
- They already tried and didn't get an answer
- The issue involves money
- There's a significant service failure
- The case is unusual
- The customer is in a sensitive situation
- There's a medical, legal, or safety implication
A company shouldn't only measure how many tickets closed without an agent. It should also measure how much frustration the system saved and how much it created.
A high automation rate looks good in a report. A customer who spends twenty minutes arguing with a bot is less impressed by the report.
Eight questions every management team should ask
Before approving a new AI use, answer eight questions:
- What decision or action does the system perform?
- What business value do we expect from it?
- Who could be harmed if it's wrong?
- Can the action be reversed?
- Can we explain how the result was reached?
- Who is able to check the quality of the output?
- Who is the business owner of the system?
- Under what conditions do we stop or shut it down?
No answer to question seven means no ownership.
No answer to question eight means no control.
And if you can't define the business value, there may not be a project here. There may just be enthusiasm.
How to say no to AI without stopping innovation
This is one of the political problems around AI. No manager wants to be the one saying no while everyone else is talking about the future.
So sharpen the language.
Instead of "we're not ready for AI", say: "we're not approving autonomy in this process until we have oversight".
Instead of "it's too risky", say: "the cost of error here is higher than the value we'd save right now".
Instead of "let's keep it manual", say: "we'll use AI for preparation and recommendation, and keep the decision with the role owner".
That isn't slowing innovation. It's an architecture of accountability.
The mark of an advanced organization
An organization doesn't become advanced by putting AI into every department.
It becomes advanced when it can tell the difference between:
- A task you can accelerate
- A decision you can improve
- An action that requires oversight
- Accountability you must not hand off
- A process that needs fixing before automation
- A situation where the person is still the most important part of the system
The future won't belong to the organizations using the most AI. It'll belong to the ones using it in the right place, at the right dose, with clear boundaries, and with people who keep taking responsibility after the system enters the room.
FAQ
How do I decide where to put AI in my organization? Sort every use into one of three zones. Green: low cost of error, reversible action, easy to check the output. Yellow: meaningful business or human impact — AI recommends, a person decides. Red: high cost of error, irreversible action, or impact on rights — AI does not make the call.
When should AI not make the decision? When the action is hard or impossible to reverse, when the decision affects rights, health, money, or a career, when you can't explain how it was reached, or when nobody can genuinely supervise the system. The deciding question: what is the maximum damage the system can do before someone notices.
Should we connect AI to all our company data? Technically you can. Managerially, usually not yet. First know who owns the data, who is allowed to see it, what consent was given, and what happens if it leaks. If you can't answer, you don't have an AI problem — you have a data governance problem. AI just makes messy data faster to reach and more dangerous.
Should we use AI to measure employees? Only with real care. Employee data is almost always partial. Email volume isn't contribution. Hours online isn't impact. A system fed partial data produces a complete-sounding conclusion in confident language, and that's what makes it dangerous. The rule: don't let a system judge a person on information you wouldn't judge them on yourself.
How do I say no to an AI project without stopping innovation? Sharpen the language. Instead of "we're not ready for AI", say "we're not approving autonomy in this process until we have oversight". Instead of "it's too risky", say "the cost of error here is higher than the value we'd save". That isn't blocking innovation. It's an architecture of accountability.
Summary
The most important question about AI in an organization isn't what it can do. We already know it can do a lot.
The question is which decisions we're willing to hand to it, which actions we let it take, and where we draw a clear line.
AI shouldn't be where:
- The cost of error is high
- The action is hard to reverse
- The decision can't be explained
- The data isn't controlled
- The process itself is broken
- Nobody owns it
- No expertise exists to check the output
- Or real human presence is required
Deciding not to use AI isn't necessarily fear of technology. Sometimes it's the clearest sign that leadership actually understands it.
Real innovation isn't putting the newest tool everywhere it fits. It's knowing where it creates value, where it creates risk, and when management responsibility requires leaving it outside the room.