1. Start with a measurable business problem
The starting point is not the model but an observable friction: processing time, duplicate entry, document review, request routing or decision quality. Describe the baseline, affected users and the metric that will determine whether the pilot works.
2. Define the role of human decision-making
State what the system prepares, recommends or executes, and which situations require human approval or takeover. The EU AI Act emphasises risk management and, for high-risk systems, traceability and human oversight.
3. Qualify data before selecting a solution
Inventory sources, quality, representativeness, access rights, retention and personal data. France’s data protection authority, the CNIL, notes that any use of personal data through an AI system must comply with the GDPR and data-subject rights.
4. Classify regulatory risk
Use cases do not all follow the same regime. The ACPR notes that risk assessment and pricing in life and health insurance are among the high-risk uses identified by the AI Act. Obtain legal confirmation for the actual use case rather than inferring it from a generic label.
5. Prepare IT and operational integration
Map inputs, outputs, interfaces, controls, possible failures and accountability. An isolated pilot may prove a technical capability without proving that it fits front-office, back-office or cross-functional processes.
6. Set stop and scale criteria
Before testing, agree thresholds for quality, robustness, security, explainability and adoption. A moderate but well-understood result can be more useful than high performance that cannot be controlled.
7. Organise the evidence
Keep versions, tests, decisions, known limits, incidents and approvals. This documentation supports audit, governance and continuous improvement and avoids rebuilding the project rationale afterwards.
A one-page framing sheet
Start with: problem and population; baseline metric; expected outcome; required data; human role; risk level to confirm; IT interfaces; owners; success and stop criteria. This is a generic example to adapt to the real context.
Sources and next step
Verified sources: Regulation (EU) 2024/1689 on artificial intelligence; the ACPR’s AI Act page; CNIL resources on AI and data security. 10h10 Conseil supports insurance organisations with project framing and delivery, process and IT transformation, data and AI integration.