Guidance for AI proof of concept to scale: common challenges and mitigation options

Common challenges and mitigation options

The table below identifies the common challenges for AI PoCs across various implementation dimensions, whilst also suggesting potential mitigation options and a nominal project owner. Incorporation of the mitigation suggestions will assist in managing project risk, and allocating ownership will strengthen implementation accountability. In some agencies suggested owners may wear multiple project hats.

- Chasing technology hype without business case
  - Mitigation option: Require a problem statement and value hypothesis approved by business owners before funding the PoC.
  - Potential owner: Accountable Official/Chief AI Officer
- Undefined or unrealistic success measures
  - Mitigation option: Establish SMART KPIs with baselines and success criteria tied to policy or service outcomes.
  - Potential owner: Program/Project Manager
- Lack of senior stakeholder buy-in
  - Mitigation option: Secure executive sponsor and governance body endorsement before starting for ownership and accountability.
  - Potential owner: Accountable Official/Chief AI Officer
- Ignoring interoperability and integration standards
  - Mitigation option: Align to the AI technical standard and reuse existing APIs where possible.
  - Potential owner: Enterprise Architect
- Over-engineering or under-engineering scope
  - Mitigation option: Define scope boundaries, assumptions, and identify the potential for scalability during design.
  - Potential owner: Solution Architect
- Accumulating technical debt without a transition plan
  - Mitigation option: Maintain a technical debt register with planned remediation.
  - Potential owner: Technical Lead
- Using poor quality data
  - Mitigation option: Assess data quality, lineage, provenance and completeness early. Implement data validation checks, metadata standards, data cleansing processes and establish governance controls before use in PoCs.
  - Potential owner: Data Custodian/Data Architect
- Using real sensitive data prematurely
  - Mitigation option: Use synthetic or anonymised datasets until governance approvals are in place.
  - Potential owner: Data Custodian
- Poor integration planning, duplication and silos
  - Mitigation option: Conduct an integration impact assessment with data architects before building.
  - Potential owner: Enterprise Architect
- Ignoring privacy, retention and sovereignty obligations
  - Mitigation option: Apply PSPF, ISM and Privacy Act requirements from the outset and get data custodian sign-off.
  - Potential owner: Privacy Officer/Data Custodian
- Vendor lock-in due to short-term tooling
  - Mitigation option: Choose open standards and modular architectures; and include exit clauses in procurement contracts.
  - Potential owner: Procurement Lead/Enterprise Architect
- Skipping security/compliance reviews for rapid setup
  - Mitigation option: Run early "security by design" reviews and integrate ISM compliance testing into CI/CD.
  - Potential owner: Security Lead
- Over-investing in disposable PoC tech
  - Mitigation option: Use low-cost sandbox or cloud credits and set "disposable tech" rules for PoCs.
  - Potential owner: Project Manager
- Gap between business needs and technology solution
  - Mitigation option: Ensure all business requirements are validated against a requirements traceability matrix during implementation.
  - Potential owner: Business/Enterprise Architect
- Excluding key end-users or policy teams
  - Mitigation option: Use co-design workshops and embed frontline staff in sprint reviews.
  - Potential owner: Product Owner/Project Manager
- Reliance on contractors without knowledge transfer
  - Mitigation option: Require contractors to produce documentation, training and shadowing arrangements.
  - Potential owner: Program/Project Manager
- No workforce strategy for scaling
  - Mitigation option: Align to relevant APS Workforce Strategy and develop a skills uplift plan early.
  - Potential owner: Human Resources/Workforce Planner
- Not considering workforce process redesign
  - Mitigation option: Map the current and future business processes and redesign work function and roles to meet new requirements.
  - Potential owner: Business Analyst/Workforce Planner
- Treating governance as an afterthought
  - Mitigation option: Set up a lightweight governance board with risk and compliance representation for the PoC.
  - Potential owner: Governance Lead
- Ignoring probity in vendor selection
  - Mitigation option: Use Commonwealth Procurement Rules, AI Procurement Guideline and run probity checks even for small-scale PoCs.
  - Potential owner: Procurement Lead
- Overlooking mandatory standards (for example, PSPF, ISM)
  - Mitigation option: Integrate APS AI assurance checklists into project planning from the start. Conduct an impact assessment using the AI Impact Assessment Tool.
  - Potential owner: Risk & Compliance Officer
- Failing to define success/failure upfront
  - Mitigation option: Document hypotheses and thresholds before running tests.
  - Potential owner: Product Owner
- Skipping user testing
  - Mitigation option: Involve user representatives and frontline staff in validation cycles.
  - Potential owner: UX Lead/Product Owner
- Missing empirical and scientific testing
  - Mitigation option: Utilise traditional and novel model evaluation techniques.
  - Potential owner: Technical/Test Lead
- Using PoCs as de facto production without validation
  - Mitigation option: Create "no production use" guardrails in governance, with approval required before scaling.
  - Potential owner: Governance Board
- Scope of PoC is not valid once the solution is scaled for production
  - Mitigation option: Set threshold performance levels to be met under scaling. Ensure the target levels are met during implementation testing.
  - Potential owner: Technical Lead/Project Manager
- Overly rigid waterfall approaches
  - Mitigation option: Adopt agile with sprint demos and incremental delivery.
  - Potential owner: Delivery Manager
- Ignoring resourcing realities
  - Mitigation option: Prepare a realistic resourcing model including contingency staff.
  - Potential owner: Project Manager/Workforce Planner
- Weak vendor management
  - Mitigation option: Assign a vendor manager role and use performance-based milestones and Service Level Agreement (SLA) targets.
  - Potential owner: Vendor Manager
- Inadequate evaluation and monitoring
  - Mitigation option: Define threshold service level expectations. Ensure best practice tools are deployed to capture measurement data.
  - Potential owner: Delivery Manager/Operations Manager
- Unclear roles and responsibilities
  - Mitigation option: Develop a RACI that clearly maps owners and accountabilities. Review and update RACI post-production release.
  - Potential owner: Delivery Manager/Operations Manager
- Underestimating performance needs
  - Mitigation option: Run load testing, chaos testing and scalability simulations before scaling.
  - Potential owner: Technical Lead/Test Manager
- Ignoring service continuity planning
  - Mitigation option: Develop Incident Management and Business Continuity playbooks and plans.
  - Potential owner: Ops Lead/Delivery Manager
- No ownership identified for long-term operations
  - Mitigation option: Define operational handover and embed ownership in BAU teams.
  - Potential owner: Service Manager/Agency Service Owner
- No budget for scaling beyond PoC
  - Mitigation option: Secure forward funding approvals tied to success metrics and ongoing evaluation. Ensure budget for continuous performance review and enhancement throughout the AI system's lifecycle.
  - Potential owner: Agency Service Owner/Finance Lead
- Loss of knowledge when contractors leave
  - Mitigation option: Require a knowledge transfer plan with embedded APS staff.
  - Potential owner: Project Manager/Service Manager
- Ignoring lifecycle end-of-service planning
  - Mitigation option: Include decommissioning/archiving as part of the PoC closure checklist.
  - Potential owner: Project Manager/Governance Lead
- Assuming AI is required when simpler solutions exist
  - Mitigation option: Assess whether the problem can be solved through non-AI approaches such as process redesign, workflow optimisation, business rules engines, or system configuration before committing to AI.
  - Potential owner: Business Owner/Policy Lead
- Overlooking root-cause issues in current processes
  - Mitigation option: Conduct root-cause analysis to determine whether the issue stems from poor processes, insufficient data quality, or legacy system constraints rather than a need for AI.
  - Potential owner: Business Analyst/Service Designer
- Over-engineering with unnecessarily complex AI models
  - Mitigation option: Start with the simplest viable model and progressively increase complexity only if required.
  - Potential owner: AI Scientist/Technical Lead
- Ignoring explainability, risk and compliance requirements
  - Mitigation option: Assess explainability requirements, risk tier, latency constraints, hosting needs and governance implications when selecting the AI type.
  - Potential owner: Risk & Compliance Officer/Technical Lead
- Insufficient evaluation of alternative AI methods
  - Mitigation option: Compare multiple AI types during PoC to identify suitable approach. Document reasons for selecting each.
  - Potential owner: Product Owner

Common scenarios – lessons from the challenges

Guidance for AI proof of concept to scale

Common challenges and mitigation options

Next page

Connect with the digital community