Compare governed usefulness, not whether a supplier has an AI assistant. NIST’s Generative AI Profile identifies risks including confabulation, data privacy and information security. Those risks justify buyer-specific tests for unsupported conclusions, restricted evidence and unsafe actions; they do not establish that any named supplier fails those tests. (nvlpubs.nist.gov)
The following is a proposed evaluation structure, not a claim that every product offers each mode.
| Automation mode | Suitable evaluation task | Evidence to require | Boundary to establish |
|---|---|---|---|
| Deterministic workflow | Route an overdue action or run a defined rule | Inputs, rule version, execution log and failure handling | What happens when an input is missing or stale? |
| Generative assistance | Draft a policy summary or suggest control mappings | Source references, limitations and reviewer corrections | Does the system distinguish a suggestion from an approved conclusion? |
| Agentic action | Create tasks or propose record updates | Permissions, approval gates, action history and recovery | What can it change without human approval? |
Use a synthetic test pack containing an outdated policy, contradictory evidence, a missing document and a restricted finding. Ask the AI to summarise the issue, suggest a mapping and propose remediation.
Acceptance should require:
- References that actually support the claim.
- Explicit acknowledgement of missing or contradictory evidence.
- No disclosure of restricted material through answers or actions.
- Human approval before high-consequence changes to approved records.
- Traceable actions and an agreed recovery process.
- Measurement of total preparation, review and correction time.
Do not award a higher score merely because an AI produced more mappings or longer narratives. The procurement question is whether it produces an acceptable result with less total effort and controlled risk.
Sources cited on this page
- nvlpubs.nist.gov ↗nvlpubs.nist.gov