The 52 AI Reality Check

Do you know what your company spent on AI in the last ninety days, including what employees expense?

Finding · You cannot yet put a number on what AI costs the business — the subscriptions, the vendor add-ons, and the personal accounts your people expense. That is the first layer of the cost failure: spend nobody is watching cannot produce a return anybody can measure.

Thirty-day move · Ask your bookkeeper for one list: every AI subscription, every vendor AI add-on, and every expense line with "AI," "GPT," "Copilot," "Gemini," or "Claude" in it for the last ninety days. One page. Thirty minutes.

Has any AI effort you have run produced a result you could point to on the P&L or in hours actually freed?

Finding · Nothing you have done with AI so far has produced a result you could point to. You are in good company — 95 percent of enterprise pilots have the same problem — but the reason is usually the question the effort started with, not the technology.

Thirty-day move · Pick the one AI effort you spent the most on. Write one sentence: what the business can do now that it could not before, or what hours were freed and where they went. If you cannot write the sentence, that effort has no charter — and the next one should start with one.

Is there a spending limit that would stop an AI tool or agent before it ran over budget?

Finding · There is nothing in place that would stop an AI tool from running over budget. For a chatbot that is a nuisance; for an agent that pursues a goal and bills for every retry, it is how Uber spent a year's budget in four months.

Thirty-day move · Put a hard monthly cap on every AI account the company pays for — most vendors allow it in settings — and name the person who gets the alert. For anything that acts on its own, set the cap per agent, not per company.

Before an AI-written document leaves the company (a proposal, contract, filing or customer reply), does a named person check it?

Finding · AI-written material is leaving the company without a named person owning the check. Deloitte Australia refunded part of a A$440,000 contract for exactly this; more than 1,900 courts have sanctioned parties for the same thing.

Thirty-day move · Write one rule and send it to everyone: nothing AI-drafted goes to a customer, a court, a regulator or a lender until a named person has read it and put their initials on it. Name the person for each document type this week.

For anything AI produces, can your team see which sources it used?

Finding · Your team is acting on AI output without seeing where it came from. Without sources, a confident wrong answer and a confident right one look identical — and the paid tools are, by the evidence, more confidently wrong than the free ones.

Thirty-day move · For the two or three tasks where your people use AI most, switch to a mode or tool that shows its sources (most now have one), and make "where did that come from?" the first question in review.

When AI gives your team an answer, do they have a routine way to verify it before acting on it?

Finding · There is no routine for verifying what AI tells your team before they act on it. The companies that get results treat verification as a step in the work, not a judgment call each person makes alone.

Thirty-day move · Add one line to the two processes where AI answers matter most: "verify against [the system of record / the contract / the policy] before acting." Make it a checklist item, not advice.

If a customer is dealing with your AI (chat, phone or email), can they reach a person within a minute or two?

Finding · A customer who is dealing with your AI cannot easily reach a person. That is the design Klarna reversed in public: the human path treated as a leak to plug instead of a feature.

Thirty-day move · Add a visible "talk to a person" option to every AI contact point, and route it to someone with the conversation history attached. Measure how often it is used; that number tells you where the AI is failing.

Does your AI tell customers that it is an AI?

Finding · Your customers may not know when they are talking to an AI. Beyond the trust problem, transparency obligations now apply — the EU AI Act's from August 2026, and state laws following.

Thirty-day move · Add one sentence of disclosure at the start of every AI-handled contact. It costs nothing and it is the first thing a regulator or a lawyer will look for.

Do you measure customer satisfaction or first-contact resolution on AI-handled contacts, separately from human-handled ones?

Finding · You cannot see whether AI-handled contacts are better or worse than human-handled ones, because they are not measured separately. "The work of 700 agents" is the metric that produces a reversal; first-contact resolution is the one that does not.

Thirty-day move · Tag every AI-handled contact and report two numbers monthly, split AI versus human: resolved on first contact, and customer rating. If you do not have a rating, add a one-question survey.

Do you know which AI tools your employees actually use, including personal accounts?

Finding · You do not know which AI tools your people are actually using. Enterprises discover about 23 previously unknown AI tools per quarter; in a company your size the number is smaller but the data going through them is just as sensitive.

Thirty-day move · Run a two-minute anonymous survey this week: which AI tools do you use for work, how often, and has customer or financial data gone in? Anonymous means people answer honestly. The result is your AI inventory, version one.

Is there a company-provided AI tool your employees prefer over their personal ones?

Finding · Your people prefer their personal AI accounts to anything the company provides — or the company provides nothing. Shadow AI does not end with a ban; it ends when the sanctioned tool is better than the one in their pocket.

Thirty-day move · Give the whole team one company-paid AI workspace with business terms (no training on your data) and tell them it is the one to use. Make it easier to reach than the personal account.

Has someone decided which of your data must never be pasted into an outside AI tool, and told the staff?

Finding · Nobody has told the staff what must never go into an outside AI tool. Samsung's engineers were not malicious; nobody had drawn the line. More than a third of the corporate data entered into AI tools is sensitive, and most of it flows to unsanctioned platforms.

Thirty-day move · Write five lines: customer lists, financials, contracts and pricing, employee records, and anything under NDA never go into a tool the company does not pay for. Send it, and say it out loud at the next team meeting.

Do your AI vendors' terms guarantee your data is not used to train their models, and has someone checked?

Finding · Nobody has checked whether your AI vendors train on your data. Consumer tiers often do; business tiers usually do not. The difference is a setting and a contract, and someone has to have read it.

Thirty-day move · For every paid AI tool, find the data-use clause and the "train on my data" setting. Turn it off where you can. Where you cannot, decide whether the tool stays.

Are your proprietary methods, pricing, code and deal data kept out of consumer-tier AI tools?

Finding · Your proprietary material — the pricing model, the methods, the deal data — may be going into consumer-tier tools. That is the mechanism by which know-how leaves the building without anyone calling it a breach.

Thirty-day move · Name your five crown jewels and the three people who handle them most. Move those people onto business-tier accounts first, this week, before anyone else.

If you left an AI vendor tomorrow, could you take your data, prompts and history with you and have the rest deleted?

Finding · You could not leave an AI vendor cleanly — take your data and history and have the rest deleted. Whatever the vendor holds is subject to litigation you have no part in; a 2025 court order kept "deleted" consumer chats on hold for months.

Thirty-day move · Ask each vendor two questions in writing: how do I export everything, and what is deleted when I close the account? Keep the answers with the contract.

Has counsel or an advisor told you what your company is liable for when its AI says something wrong?

Finding · Nobody has told you what you are liable for when your AI is wrong. The Air Canada ruling settled the principle — whatever your AI says, you said it — and 56 percent of the Fortune 500 now list AI as a risk factor because of it.

Thirty-day move · Book thirty minutes with your attorney and ask three questions: what are we liable for when our AI is wrong, what should we disclose, and what should AI never decide alone here? This report gives no legal advice; that conversation does.

Have you checked whether your insurance covers AI-related claims, or excludes them?

Finding · You do not know whether your insurance covers AI-related claims. Major carriers have asked regulators to let them exclude it, which means a business deploying AI may be carrying the liability itself without knowing.

Thirty-day move · Send your broker one email: "Does our current policy cover claims arising from AI we use — chatbot statements, AI-assisted decisions, data exposure through AI tools — or exclude them?" Get the answer in writing.

Are there written rules on what AI must never decide alone (hiring, firing, credit, medical, legal)?

Finding · There is no written rule about what AI must never decide alone. The first EEOC settlement on AI hiring cost $365,000; Colorado now imposes a duty of reasonable care on high-risk AI decisions. The book's own rule: no agent decides who is hired.

Thirty-day move · Write the list — hiring, firing, pay, credit, anything medical or legal, anything a regulator would ask about — and the rule: a named person decides, AI may only prepare. One page, signed by you.

Is there a written list of every AI tool and agent in use, with a named person accountable for each?

Finding · There is no written list of the AI tools and agents in use, with a named person accountable for each. This is the absence the book finds behind most of the other failures: nobody owned it, so nobody caught it.

Thirty-day move · Start the list today: tool, what it is used for, who owns it, what data it touches, how to turn it off. Ten rows is a governance program. Zero rows is a liability.

Is there a written AI policy that employees have actually read?

Finding · There is no AI policy your employees have actually read. Only 38 percent of organizations have a formal one; a quarter have none. The policy does not need to be long. It needs to exist and to have been read.

Thirty-day move · One page: the sanctioned tools, the data that never leaves, the decisions AI never makes alone, and who to ask. Have every employee acknowledge it by name within thirty days.

Could you switch off any AI system in your business within an hour, and do you know who would do it?

Finding · You could not switch off an AI system in your business within an hour — or you do not know who would. More than half of digital-trust professionals say the same. The kill switch is the first control every successful deployment has, and most failed ones lacked.

Thirty-day move · For every tool on your list, write down the off switch and the person who holds it. Then test one: have them actually turn it off and back on. Thirty minutes, once.

Is your AI plan written around what the business will be able to do that it cannot do today, rather than around cutting headcount?

Finding · Your AI plan is written around cost — hours and headcount — rather than around what the business will be able to do that it cannot today. That sentence at the top of the project is, in the book's evidence, the single thing that separates the five percent from the rest.

Thirty-day move · Rewrite the first sentence of your AI plan. Finish this: "In twelve months this business will be able to ___ that it cannot do today." If the only answer is "the same work, cheaper," the plan is pointed at the wrong target.

Do the people who will work alongside AI have training and a say in how it is used?

Finding · The people who will work alongside AI have not been trained for it and have had no say in how it is used. That is how a company gets 34 percent of staff quitting over an AI deployment, and work that looks finished but shifts effort downstream.

Thirty-day move · Pick the team closest to your first AI use. Ask them, in a room, what they would hand to an agent and what they would never trust it with. Their answers are a better design brief than any vendor's.

Does anyone check the quality of AI-assisted work before it lands on a colleague's desk?

Finding · AI-assisted work is landing on colleagues' desks unchecked. "Workslop" — polished-looking work that pushes the effort downstream — reached 40 percent of desk workers in one month and costs about two hours of rework each time.

Thirty-day move · Make it a norm, said out loud: if you used AI to produce it, you read it before you sent it, and you say so. A one-line "AI-assisted, reviewed by me" footer does the job.

If any AI acts on its own (sends, books, changes records), did it run in a watch-only mode first, with limits on what it may touch?

Finding · An AI that acts on its own in your business did not run in watch-only mode first, or has no limits on what it may touch. Replit's agent deleted a production database during a code freeze; the guardrails were added afterward. They should exist first.

Thirty-day move · For anything that sends, books or changes records on its own: switch it to draft-and-approve for thirty days, log every action, and write down what it may never touch. Promote it back only on what the log shows.

Is the data your AI works from (customer, financial, operational) accurate, current and in one place you trust?

Finding · The data your AI works from is not accurate, current, or in one place you trust. This is the failure beneath the others: Gartner expects 60 percent of AI projects unsupported by AI-ready data to be abandoned. An agent working from three versions of the truth guesses — confidently.

Thirty-day move · Answer one question for customers, money, people and work: which system is the truth? Write the four answers down. Where there are two answers, that is the first data problem to fix before any agent touches it.

Is there a separation between where AI is tried out and where it touches live systems and real customers?

Finding · There is no wall between where AI is tried out and where it touches live systems and real customers. That is the separation Replit, Google and Amazon all added after the damage — development from production, planning from acting.

Thirty-day move · Create a sandbox: a copy of the data, a test inbox, a dummy customer. Nothing new touches a live system or a real customer until it has run there first. Say it as a rule.