AI product strategy

Adding an AI feature to a product raises the same few questions each time. Should the team build it or buy it? How will the team know it works? What should the product do when the answer is wrong? Public guidance from government and standards bodies helps with each one.

Build on a model, or buy a finished tool?

Some teams build the feature on a model they reach through its maker's programming interface (API). Others buy a tool that already does the work. Either way, the team is choosing a supplier.

The UK government's Guidelines for AI procurement were published on 8 June 2020. They were written for buyers in government. One of their ten considerations reads "Avoid Black Box algorithms and vendor lock in". So a product team can ask who would keep the feature running if the supplier changed its terms, and how hard it would be to move.

The Competition and Markets Authority (CMA) published its initial report on AI foundation models on 18 September 2023. It looked at those models and their impact on competition and consumer protection.

Test before you choose

Which model gives the right answer for this product's customers? A team can keep a set of its own examples, each with an answer it knows is right, and run every candidate over the same set.

The UK AI Security Institute built Inspect with Meridian Labs. Inspect describes itself as "An open-source framework for large language model evaluations".

Set the bar before launch

The government's AI Playbook, written for civil servants, says "You must be clear about what objective measures you're assessing the AI outputs against". Its case study on GOV.UK Chat describes experts checking the tool's answers. The GOV.UK Chat team found that "accuracy gains would be required prior to the product being deployed for users on the site".

What level of accuracy would this team accept? Who decides, and when?

Work out the cost from your own use

The Playbook warns that putting AI in place can "have considerable compute costs". The Open Worldwide Application Security Project (OWASP) runs a Gen AI Security Project, which lists "Unbounded Consumption" among its risks for applications built on large language models.

How many times a day will customers use the feature? What happens to the bill if one customer uses it far more than the rest? A team can answer these from its own numbers before it signs anything.

Design for the wrong answer

OWASP says "Misinformation occurs when LLMs produce false or misleading information that appears credible." It also lists "Improper Output Handling", where the output is passed on to other systems without enough checks.

What will the customer see when the answer is wrong? Can they tell the answer came from AI? Who or what checks it before another part of the product acts on it? The US National Institute of Standards and Technology (NIST) published a Generative AI Profile on 26 July 2024. It gives a longer list of risks to plan for.

Personal data and selling abroad

The Information Commissioner's Office (ICO) publishes guidance on AI and data protection. If the product is sold into the EU, the European Commission explains the AI Act and its risk-based rules for AI developers and deployers.

Useful links