How to evaluate an AI feature before you enable it

Most agencies will meet artificial intelligence first as a feature switched on in software they already own: meeting transcription, document summarization, drafting assistance, or search. These arrive without a procurement, which means they arrive without the review a procurement would have triggered.

This process is deliberately short. It is meant to be runnable by an IT manager in a week, not to become a committee.

Steps

1. 1Find out what is being enabled and when

   Ask the vendor for the specific feature, the release date, whether it is on by default, and how an administrator turns it off. Subscribe to their release notes so the next one is not a surprise.

2. 2Establish where the data goes

   Which model processes the content, in whose infrastructure, in what region, what is retained, for how long, and whether agency content is used to train or improve any model. Get the answer in writing and check it against the contract.

3. 3Classify the data the feature would touch

   If the feature can read mailboxes, files, or case records, determine whether that includes health, criminal justice, student, or other regulated data. That determines whether the feature can be enabled at all.

4. 4Test it on your own material

   Run a sample of real but non-sensitive agency documents through it. Measure how often the output is right, how it fails, and whether failures are obvious or subtle. Vendor benchmarks do not describe your documents.

5. 5Decide the human role

   For each use, state who reviews the output and what they are accountable for. If a plausible wrong answer could affect a resident, a person must review before it is used.

6. 6Check the records implications

   Prompts, outputs, and transcripts may be public records. Decide retention, whether the feature creates records that must be disclosed, and how it interacts with litigation holds.

7. 7Set the access and configuration

   Enable for a defined group rather than everyone at once. Turn off anything that writes or sends without confirmation. Confirm logging is on and reaches your log platform.

8. 8Write the staff guidance

   One page: what the feature is for, what must never be entered into it, how to report a bad output, and who to ask. Guidance people can follow beats a policy nobody reads.

9. 9Add it to the AI inventory and review it again later

   Record the feature, its purpose, its risk classification, and the decision. Re-review when the vendor changes the model, which they will.

What you end up with

A documented decision for each AI feature, a configuration that matches it, staff guidance, and an inventory entry. When a council member or a journalist asks what artificial intelligence the agency uses, there is an answer.