AI in government needs a better answer than no
It goes without saying that there’s plenty of demand for AI to be used on government projects at the moment. Some of that comes from clients who want to see where it could help, there are internal stakeholders looking to drive project delivery faster and perhaps with less resource, and some from engineers and delivery teams already finding useful ways to work with it.
The difficulty comes when somebody asks for permission to use it. If the person making that decision doesn’t really understand the risks, the safest default answer is no. Given the services and data involved, that’s understandable, but it can also mean potentially useful applications of AI get stopped because nobody has a good way of deciding whether they are actually safe.
That was the problem we were trying to address with the Made Tech AI Risk Assessment Framework. The idea is fairly simple: make the risks visible, work out which ones apply, decide what you are going to do about them and give whoever needs to approve the work something useful to make that decision with.
Different uses have different risks
Talking about “using AI” as if it were one thing isn’t particularly helpful.
Using AI to analyse some code or process research transcripts is very different from building an AI-enabled feature into a government service. What you are sharing with the tool will be different, the consequences if it gets something wrong will be different, and the amount of autonomy you give it can change the risk significantly.
The framework starts with practical questions. What are you trying to do? What data or code will you be sharing? Which tool are you using? Is the tool training on the information you give it? How much autonomy will the AI have?
From there, teams work through risks including data leakage, hallucinations and inaccurate outputs, bias and fairness, security and licensing.
There are less obvious risks too. One we included is people becoming too reliant on AI. In software engineering, part of becoming good at something is working through difficult problems and learning along the way. If you immediately ask an AI tool for the answer every time, some of that learning disappears.
That doesn’t mean don’t use AI. It means recognising the risk and thinking about how you manage it.
Give people something they can assess
For every relevant risk, the team looks at how likely it is to happen and what the impact would be. They then consider any safeguards they can put in place and reassess the risk that remains.
Describing the whole process can make it sound quite heavyweight, but for a straightforward use of AI it can be worked through relatively quickly. You can even use AI to help think through some of the risks, provided you apply the same judgement to its answers.
The important result is the risk record. Instead of asking somebody to approve an AI use case based on a vague reassurance that everything should be fine, you can show them what you have looked at.
They can see where there is a risk, what the impact might be, what you are doing to reduce it and what risk remains afterwards. They may decide that is acceptable, or they may ask for more to be done before they are comfortable signing it off.
That record is useful later too. If a government service assessment asks what you have done about hallucinations or bias, you can show how you assessed it, what safeguards you put in place and why you decided the remaining risk was acceptable.
A framework teams can actually use
There is plenty of AI guidance around already, and rightly so. What we wanted was something slightly different: a practical tool that could be brought into a project and used by the people doing the work. That’s why we’ve built the Made Tech AI Framework.
The Framework has come directly from the reality of trying to use AI on government projects. Teams want to explore what these tools can do, but they also need to know they are not introducing a problem without realising it.
We are already using it on project work and starting to use it more widely across Made Tech. We have also released it under an open licence, so government departments, suppliers and other delivery teams can pick it up and use it themselves.
It is only the first iteration. AI is changing quickly, so the risks will change too. People using the framework will almost certainly spot things we haven’t or find better ways of approaching parts of it, and we’d like to hear about those.
The point isn’t to make it easier to say yes to every use of AI. Sometimes the answer absolutely should be no. But it’s much better if that answer comes from understanding the risks than from not having a practical way to assess them.
