The main risks of an AI implementation project are automating the wrong workflow, data that cannot support it, model errors nobody catches, data leaking through the system around the model, and cost without a measured return. Good agencies reduce them by recording a baseline before building, piloting one workflow with human review, and monitoring it in production. Below is the checklist ATI Lab works from, mapped to the NIST AI Risk Management Framework and the OWASP Top 10 for LLM Applications.
We are an agency, so we have a stake in how you judge agencies. The checklist is written so you can use it on us or on anyone else.
AI implementation project risks and how to mitigate them
Most AI implementation project risks sit outside the model, so you mitigate them with project controls. In RAND's 2024 interviews with 65 data scientists and engineers, four of the five root causes of failure were a misunderstood problem, missing data, a focus on new technology over users, and weak infrastructure. The fifth was a problem too hard for AI. The table lists eight risks to plan for on any build, the control for each, and where it sits in NIST AI RMF and the OWASP list (2025 edition, checked 2 November 2026). Rows 1, 2, 3 and 7 are steps in our published delivery process, and row 8 adds the spend limits from our guide to tracking token costs per workflow. Rows 4, 5 and 6 are checks we recommend for any system that reads untrusted input or holds sensitive data.
| # | Risk | Control | NIST AI RMF | OWASP LLM Top 10 |
|---|---|---|---|---|
| 1 | Automating a workflow that does not pay back | Record cycle time, error rate and labour hours before building; say where AI should not be used | Map | none |
| 2 | Data or tools that cannot support the automation | Check data access and system interfaces during scoping, before the build starts | Map | LLM04 Data and Model Poisoning (only if you train or fine-tune) |
| 3 | Wrong outputs that nobody notices | Pilot with human review of exceptions; validate fields against business rules before anything is written to a system | Measure | LLM05 Improper Output Handling, LLM09 Misinformation |
| 4 | An agent that can do more than its job needs | Give each agent the narrowest permissions; route irreversible actions to a person | Govern, Manage | LLM06 Excessive Agency |
| 5 | Untrusted emails or documents steering the model | Treat inbound content as data; check outputs before they trigger an action | Manage | LLM01 Prompt Injection, LLM07 System Prompt Leakage |
| 6 | Sensitive data leaking through logs, queues and caches | Choose who processes the data; test that redaction and deletion actually happen | Govern, Manage | LLM02 Sensitive Information Disclosure, LLM08 Vector and Embedding Weaknesses |
| 7 | A system that fails silently in production | Monitor the outcome (records created, documents processed), not only whether the job ran | Manage | none |
| 8 | Cost that grows without a return | Measure each workflow against its baseline; set usage limits and spend alerts | Measure, Manage | LLM10 Unbounded Consumption |
Two OWASP items get less weight in this table. LLM03 Supply Chain matters most to teams that pull in third-party models, plugins or packages, so list every model and component the system depends on, and who updates each. LLM04 matters when a project trains or fine-tunes a model, which most business automation does not need.
How do you de-risk an AI implementation against NIST AI RMF, OWASP LLM Top 10 and ISO 42001?
Use NIST AI RMF to organise project risk work, the OWASP LLM Top 10 to test what you build, and ISO/IEC 42001 to govern AI company-wide. The NIST AI Risk Management Framework (AI RMF 1.0, released 26 January 2023) is voluntary and organises risk work into four functions. The OWASP Top 10 for LLM Applications (2025 edition) lists the security failures specific to systems built on language models. ISO/IEC 42001:2023 (published December 2023) specifies a management system for AI across a whole organisation.
How our checklist maps to Govern, Map, Measure and Manage
Each NIST function lines up with part of our delivery process, so an auditor can see where each control lives.
- Govern (NIST calls it cross-cutting): agree who owns each workflow, who approves irreversible actions and which data the system may touch. Our Claude enterprise rollout guide shows these decisions in a real rollout.
- Map (the context and risks of the system): map where the hours go, check that the data and tools can support automation, and record the baseline. This is also where we say plainly when AI is the wrong tool.
- Measure (assess and track the risks): run the pilot with human review of exceptions and compare results against the baseline recorded before work started.
- Manage (act on the risks you mapped and measured): run the system in production with monitoring and alerts, and improve it as the business and the models change.
NIST also published a Generative AI Profile (NIST AI 600-1) on 26 July 2024, and its framework page says AI RMF 1.0 is being revised under the White House AI Action Plan (as of 2 November 2026). Check that page before an audit, because the version you map to may change.
Which OWASP LLM risks apply to business automation?
Four OWASP risks apply directly to email intake, document processing and support assistants that answer from internal knowledge. Test for these four before a pilot goes live:
- LLM01 Prompt Injection. An inbound email or PDF can contain instructions. The model should read it as content to extract, and nothing it outputs should trigger an action without passing validation.
- LLM05 Improper Output Handling. Our shipment intake system validates the extracted details against the operator's rules before it creates labels and carrier bookings. It reports zero monthly entry errors on our published case results.
- LLM06 Excessive Agency. An agent that drafts a reply does not also need permission to send it, delete records or change prices.
- LLM02 Sensitive Information Disclosure. Data can leak through logs, retry queues and debug exports as well as through the model host, as our guide to where AI agents can run on sensitive data explains.
Do you need ISO/IEC 42001 certification?
A mid-size company can usually run a first AI workflow without ISO/IEC 42001 certification, though the standard is a useful guide to the policies you will need later. ISO describes 42001 as a management system standard that uses Plan-Do-Check-Act and looks at AI risk across the organisation rather than at the details of one application. ATI Lab does not claim ISO/IEC 42001 certification. If an agency tells you it is certified, ask for the certificate and the name of the body that issued it. A customer contract or regulator may require certification regardless, so check those first.
The failure mode that checklists miss
A checklist cannot catch a control that reports success while doing nothing. It happened in our own automation. An internal ATI pipeline had a scheduled cleanup step whose pre-flight check passed every time, while the delete call was refused by a permission layer that returned quietly. The job logged success on six consecutive runs and deleted nothing.
A checklist would have marked that control as implemented. The fix was to check the resulting state: count the records that should be gone, and fail loudly when the count is wrong. Apply the same rule to every row in the table above. If your design says a field is redacted, a document is deleted or a human approves every refund, something should check the stored result on a schedule. The same metric-plus-alert pattern is the subject of our guide to an AI agent that monitors a metric and alerts the team.
How do I choose an AI automation agency and what should I look for?
Choose an AI automation agency that can show a production system at your scale, records a baseline before it builds, and stays to monitor what it ships. Those three things cover most of the risks above. Ask every agency on your shortlist these questions:
- Which system like ours do you run in production today, and what was it measured against?
- What do you record before the build starts, and how will we see results against it?
- Which actions will the system take without a person approving them?
- Where will our data be stored, logged or cached, including outside the model provider?
- Who monitors the system after launch, and what alert tells you it has stopped working?
An agency that answers the first question with a logo wall and the last one with "your team takes it from there" has left most of the risk with you. Our guide to choosing an AI automation agency has more questions, including running costs and handover.
How can a B2B company actually use AI to automate operations?
A B2B company uses AI to automate operations by picking one frequent, rule-heavy workflow and connecting AI to the systems it already runs on. Typical first workflows read inbound email into a CRM or ERP, extract data from documents, or answer repeat internal questions. In our published results (checked 2 November 2026), shipment intake from email cut manual work by 95%, email-to-CRM project creation made setup 80% faster, and an ERP support assistant cut support cost by 90% on a $10,000+ monthly line. These are our own measurements, not independently audited.
In all three, the team kept the systems it already had and the automation sat behind them, which lowers the risk of a failed rollout.
How should an operations-heavy SMB start with AI agents, and which workflows come first?
An operations-heavy SMB should start with one workflow that is frequent, low-variance and easy to check, so a wrong output is caught before it costs money. Shipment intake, invoice and document data entry, and repeat support questions fit that profile. The hard, rare cases stay with people, which is how our ERP assistant handles them. Rank your candidate workflows by hours spent and by how easy it is to check the output, then build only the top one first. Our list of first workflows to automate in a small business has more candidates. ATI's published timeline is 6 to 12 weeks to the first workflow live.
Should we hire an AI consultancy or build AI automation in-house?
Hire an AI consultancy until you have enough continuous AI work to keep two full-time specialists busy, because below that point an in-house team adds delivery risk. A new team has no production systems behind it yet, so it learns the failure modes in this article on your first project. You can test whether an agency has met them by asking the questions above. Our in-house AI team vs AI agency cost comparison puts numbers on that break-even, using US Bureau of Labor Statistics wage data.
What AI automation services can an agency provide to a mid-size company?
An AI automation agency can provide strategy and a ranked roadmap, agents and workflows built into your existing tools, team training, and production operations. At ATI Lab those are parts of one partnership, and each is also available on its own. Each also reduces a risk in the table. Strategy catches the wrong-workflow risk, the build owns output validation and permissions, training lets your team review exceptions, and running the system covers silent failures and cost. To apply this checklist to your own workflows, our AI consulting team can run it as a scoping exercise, or you can book a call and bring one workflow.
Frequently asked questions
What is the biggest risk in an AI implementation project?
In our view it is choosing a workflow that cannot be measured. Without a baseline you cannot show a return, and you cannot tell when the system starts getting worse. Record cycle time, error rate and hours before the build starts.
Is the NIST AI Risk Management Framework mandatory?
No. NIST describes the AI RMF as intended for voluntary use. It gives a project a shared structure (Govern, Map, Measure, Manage) to show auditors and customers.
What is the difference between NIST AI RMF and ISO/IEC 42001?
NIST AI RMF is a voluntary framework for managing the risks of AI systems. ISO/IEC 42001 is an international management system standard for how an organisation governs AI as a whole. A company can use NIST to structure project work and 42001 for company-wide policy.
Does a person need to review every AI output?
Not forever. Review every exception during the pilot, measure how often the system is right against the baseline, then keep human approval only for irreversible actions and the cases the system flags as uncertain.
Is the OWASP Top 10 for LLM Applications only for software companies?
No. Any company whose AI system reads emails or documents, or can act in business systems, faces the same risks, especially prompt injection and excessive agency. The list tells you what to test, whoever builds the system.
NIST, OWASP, ISO and RAND details were checked on their own pages on 2 November 2026. ATI results are as published on atilab.io on the same date. This article was drafted with AI assistance.