Before you buy another AI tool: five decisions to make first.

AI tools are easy to demonstrate and increasingly easy to buy. The hard part is deciding whether a particular use will improve the business once setup, review, training and risk are included.

Australian Government guidance makes a similar starting point: identify the business problem, examine tools already available, start small, assign accountability and test before broader use. NAVE’s owner-side addition is to turn those ideas into five purchase decisions that can be reviewed before a subscription, integration or data connection creates momentum of its own.

Decision 1: What business result should change?

Describe the problem without naming a product. “We need an AI assistant” is a solution statement. “Quotations wait two days because the owner must find scope details across three systems” is a business problem.

Choose one measure that would show movement: preparation time, turnaround time, rework, conversion, cost per task or capacity released. Record the current baseline, even if it is a reasonable range. Without a baseline, a fast demonstration can feel valuable while the operating result remains unchanged.

Decision 2: Where does responsibility stay human?

Name the person accountable for the use and the points where a person must check, approve, override or stop it. The same product can be low risk when it drafts internal notes and much higher risk when it communicates with customers or contributes to employment, credit, health or legal decisions.

The National AI Centre’s current adoption guidance starts with accountability and recommends a responsible person for each AI system. For a small business, that does not require a committee. It requires a named owner, a permitted purpose and an escalation path when the output is uncertain or the use changes.

• Who owns the result?
• Who checks the output, and against what?
• What can the system never send, decide or change by itself?
• How can staff report a problem and return to the previous process?

Decision 3: What is the full value case?

Compare the expected benefit with the whole implementation cost—not only the licence. Include configuration, integration, process redesign, staff time, review time, training, support, security work and the cost of errors. Then state a confidence level rather than presenting a rough estimate as a forecast.

A simple value case has six lines: baseline, target, people affected, implementation cost, confidence and review date. It also has a stop condition. If the trial does not achieve the agreed threshold, the business should change the approach or stop rather than keep paying because work has already begun.

Decision 4: What information will the tool receive?

List the information needed for the defined purpose, where it comes from, who can access it and what must remain excluded. Begin with sanitised, non-sensitive examples wherever possible. Do not connect an entire mailbox, drive or customer system merely because integration is available.

The Office of the Australian Information Commissioner recommends due diligence when commercially available AI products handle personal information, including scrutiny of intended use, human oversight, privacy and security risks, and who can access input or generated information. Its guidance also recommends, as a matter of best practice, not entering personal—particularly sensitive—information into publicly available generative AI tools. Privacy obligations depend on the organisation and use, so obtain appropriate advice where personal information is involved.

Cyber security due diligence belongs in the same decision. Review the provider’s data use, retention, access controls, authentication, incident process, subcontractors and change terms. A sales page is not a security assessment.

Decision 5: What is the smallest controlled test?

Define a short experiment with real work but bounded consequences. Compare the new process with the baseline, inspect quality as well as speed, and involve the people who will use and review it. The Australian Government’s business guidance recommends starting with one or two areas and testing accuracy and safe use before wider rollout.

The five-decision gate

A purchase is ready for a controlled trial when the owner can answer all five questions:

1. Result: What measurable business result should change?
2. Responsibility: Who remains accountable and where is human approval required?
3. Value: What is the rough benefit, full cost, confidence and stop condition?
4. Information: What data is needed, allowed and excluded?
5. Test: What bounded experiment will produce enough evidence to decide?

If an answer is missing, the next step is not necessarily to abandon AI. It is to resolve that uncertainty before scaling commitment.

What this checklist does not decide

This is an initial commercial and control screen. It is not a procurement, privacy, cybersecurity, legal or technical assessment. Higher-impact uses, sensitive information, complex integrations and consequential decisions need qualified review. A tool that passes this gate can still be unsuitable after detailed due diligence.