How to Safely Operationalize AI: From Hype to Enterprise Value

Shrink the World: Why Less is More in Context

Language models have grown in capacity, with context sizes reaching into the millions of tokens (units of text, like a word, part of a word, or even a punctuation mark, that the model uses to process and understand language). However, more context, or information, isn’t always better for an AI model. In fact, as Paul notes, providing excessive context increases the likelihood of hallucinations, where models confidently generate incorrect or misleading outputs.

Instead, AI solutions should focus on shrinking the world to the smallest, most relevant set of data needed to answer a query. This not only improves accuracy but helps control costs, improves performance, and makes it easier to apply access rules and citations.

Information Retrieval and Classification: Foundational Steps

Safe AI begins with high-quality, secure, and relevant information. Two key enabling disciplines are:

• Information Retrieval: Modern semantic and vector search methods overcome limitations of keyword search by accounting for vocabulary mismatch and intent. These are vital in surfacing accurate data from large, unstructured repositories – a huge part of the enterprise data landscape. This information can then be used for RAG-based use cases, like AI assistants.
• Classification: Labelling information by topic, department, or sensitivity is a powerful way to apply security rules, streamline secure discovery, and enable AI data governance. Automated techniques, such as clustering, can help scale classification without relying solely on manual effort – a feat that’s no longer feasible at enterprise scale, if you want to get data ready for AI.

Paul underscores that this dual focus – organising and surfacing the right data – forms the foundation for trustworthy AI.

Security and Access Control: Non-Negotiables

In the AI context, traditional access controls become more critical than ever. Many organizations use access control lists and sensitivity labels to govern who can see what. However, once data is fed into a model, particularly during training or fine-tuning, those controls can become ineffective.

This is where RAG excels. Because the model doesn’t retain the data, it only processes it during the query, security controls remain enforceable.

“When you use RAG, you only feed the model what the user is allowed to see. That’s the key to safe AI,” Paul says.

This approach allows AI to be deployed across sensitive, dynamic environments without compromising confidentiality or security.

Explainability, Citations, and Human Oversight

For AI to be truly trusted, it must be auditable. That means maintaining detailed logs of:

• Input prompts
• The data used to generate the answer
• The output itself
• Decisions made or actions taken

Citations are particularly valuable, enabling users to verify where information originated. This creates a safety net around hallucinations, which are an unavoidable artefact of how language models work.

Paul recommends human-in-the-loop systems where AI results are always subject to review, especially when they impact critical decisions or backend systems. This balance of automation and oversight is central to safe AI.

Agentic AI and Function Calling: Automation with Guardrails

Agentic AI – where models perform multi-step tasks and even control workflows – is rapidly gaining attention. But Paul cautions that with power comes complexity.

Through function calling, models can request actions like retrieving data from systems, updating records, or executing backend queries. While this expands AI’s utility, it also requires robust guardrails, including:

• Access controls on individual tools
• System prompts to limit scope
• Real-time user validation

Reducing UI Complexity: A Shift in Interaction Design

Generative AI has the potential to replace rigid UIs with natural language interaction. Instead of navigating menus and forms, users can simply ask questions, issue commands, or request summaries.

This flexibility can:

• Shorten development cycles
• Improve accessibility
• Adapt interfaces to user needs dynamically

However, Paul stresses that designing these interactions requires careful thought. User experience now encompasses data transparency, clear feedback loops, and error-handling when AI is uncertain.

A Use Case Focus

Successful early AI adoption means focusing on use cases that are repeatable, high-value, and verifiable. Paul advises organisations to avoid “mega chatbots” and instead focus on narrow, solvable problems where AI adds immediate value to productivity, efficiency, or insight – with a measurable ROI.

This includes using AI to support advanced tasks like:

• Planning incident responses by sourcing relevant data from multiple systems to collate insights that inform critical decision making
• Automating document classification and compliance labelling at scale, such as to prepare for a data migration
• Handling legal disclosures and subject access request (SAR) workflows

From Public to Private Models: Data Privacy Considerations

One common concern is the use of public models such as ChatGPT, popular with individuals. These platforms may log or reuse inputs for their own training, creating compliance risks when used for business data.

In an enterprise setting, Paul recommends using private versions of large models hosted in controlled cloud environments, such asAzure OpenAI, and deploying open-source models like Llama or Mistral within virtual machines for maximum security. Coupled with sensible approaches to use cases and appropriate training for teams on when and how to use AI tools, these approaches are non-negotiable for most legal and IT security teams.

Education and Confidence-Building

Adoption of AI often stalls – not because of technical limitations, but because of cultural and organizational resistance. According to Paul, this often stems from hype-driven confusion and a lack of understanding.

“The ‘protectors of the realm’ in legal and IT are there to keep us safe. They need education, not just approval,” Paul says.

Organisations should invest in internal literacy programmes that explain AI, clearly demystifying terms like hallucination, training, and information retrieval and showing how the technology aligns with the organization’s core governance principles.

Conclusion: Build Responsibly, Act Confidently

AI has extraordinary potential. But to realise it safely, organizations must start with:

• A foundation of clean, classified, and permissioned data
• A design approach that prioritises explainability and traceability
• Carefully scoped use cases that deliver value and build trust
• Ongoing human oversight and interactivity

As Paul Maker concludes, “It’s not about removing people from the loop. It’s about empowering them to work smarter, safer, and faster with AI.”