12 questions to ask before starting an AI project at a mid-market company

Before any technical consideration: frame the why with the business sponsor.

1. 01

   What is the business problem this project must solve, stated without using the word "AI"?

   Why: If you can't restate the need in purely business terms, the project is a solution looking for a problem. A common anti-pattern in 2024-2026.

   Anti-answer that should alert you: Typical answer: "because we want to do AI", "because it's the hot topic", or "because the exec committee asked". These answers are red flags.

2. 02

   Who is the expected end user, and how many people will use the system daily?

   Why: Volume and user profile determine the architecture, the budget and the governance requirements. A 5-user POC and a 500-user system are not the same project.

   Anti-answer that should alert you: Typical answer: "all employees", "the whole company", with no segmentation by use case. Indicates scoping wasn't done.

3. 03

   Why now? What changes if you start in twelve months rather than today?

   Why: The real urgency drives the go/no-go. Often what's presented as urgent isn't. Conversely, what isn't urgent today can become so within six months for regulatory (AI Act) or competitive reasons.

   Anti-answer that should alert you: No clear answer to this question, or an answer driven solely by fear of competition with no measurable benefit identified.

Every AI solution rests on data. Before coding, you know what you have and what you don't.

1. 04

   Which data sources must this project query, and who owns them in your organisation?

   Why: The inventory of sources and the mapping of data owners drive the permissions to obtain, the ACLs to wire, the DPA contracts to update.

   Anti-answer that should alert you: A vague answer, or "all the company's data". Indicates no mapping has been done.

2. 05

   What is the current quality of these sources: are they up to date, structured, readable, deduplicated?

   Why: Data quality is the ceiling on the AI system's quality. No model fixes a badly scanned PDF, inconsistent SharePoints, or business databases with 30 percent duplicates.

   Anti-answer that should alert you: Typical answer: "we'll see in use", or "it'll do to get started". High risk of a POC that works then blows up in production.

3. 06

   What is the sensitivity level of each source: public, internal, confidential, or secret?

   Why: Classification drives the GDPR obligations, the access-control requirements, and the hosting choice (public vs sovereign cloud).

   Anti-answer that should alert you: No documented classification. Indicates the topic hasn't been escalated to the DPO or the CISO.

A realistic technical scope: what already exists, what must be integrated, what constrains.

1. 07

   Which technical stack is already in place, and which systems will the AI solution have to integrate with?

   Why: An isolated AI project rarely serves a purpose. Integrations (CRM, ERP, SharePoint, business databases, Active Directory) often represent 60 percent of the real production effort.

   Anti-answer that should alert you: Answer: "we'll see at deployment time". Guarantees surprises in month 4.

2. 08

   What latency is acceptable from the user's point of view, in seconds?

   Why: The target latency (P50, P95) determines the model choice, the cache architecture, and the need for self-hosted inference. A 2-second answer and a 12-second answer are not designed the same way.

   Anti-answer that should alert you: No quantified target. Risk that latency becomes the issue during the pilot, when it's too late to change the architecture.

3. 09

   What monthly LLM inference budget is approved for going to production, and who pays for it?

   Why: The inference cost of an LLM in production can go from €50/month in a POC to €5,000/month in a 200-user pilot. Approving the target budget must precede the model choice.

   Anti-answer that should alert you: No identified budget, or a "we'll optimise later" budget. Near-systematic among projects that die at the finance committee in month 6.

AI projects almost never die on the technical side. They die on governance.

1. 10

   Who is the sponsor for this project at executive or leadership level?

   Why: Without an identified executive sponsor, an AI project carries no weight against objections (a DPO holding back, an ethics committee, a CISO blocking). The sponsor acts as arbiter when these objections surface, beyond a mere kickoff sign-off.

   Anti-answer that should alert you: No explicit sponsor, or a "default" sponsor who isn't aware of the level of commitment being asked.

2. 11

   Which committee will approve the production rollout, and against which quantifiable criteria?

   Why: Without production criteria defined in advance, you'll discover the requirements on go-live day. AI ethics, security and compliance committees each have their own grids.

   Anti-answer that should alert you: "We'll see with the committee when we get there". Practically a guarantee of a block six weeks before deployment.

3. 12

   Which regulatory obligations apply to this system: AI Act, GDPR, sector frameworks (ACPR, HAS, HDS, NIS2)?

   Why: The AI Act classifies AI systems by risk level, with obligations that vary considerably. An HR system, a credit-scoring system and a consumer chatbot don't have the same requirements. Identifying the applicable regime drives the documentation to produce and the audits to plan.

   Anti-answer that should alert you: "We're not concerned". Most enterprise AI systems fall under at least one applicable regulatory framework.