Find where AI can hurt you. Control it there.
Your people are already using it, and most of what they do with it is harmless. Some of it might not be. I help you find the difference, then put real controls where the risk actually is. The same way you would prove out any new process before you trust it with real work.
The Root Cause Analyzer is an AI tool I built, tried to break, and controlled before I would put it in front of anyone. It is live. Go use it.
Fine in a brainstorm. Costly in a quote. Hard to undo in a CAPA.
Your team is using AI to do useful work, and that should keep happening. The question is whether it is safe in the places they are using it. The tool does not change between any of those jobs. The exposure does. A brainstorm gets argued with and thrown away. A quote leaves the building with a price the customer will hold you to. A CAPA lands in a controlled record and stays there, and what goes into that record is the whole risk: an invented lot number or date that reads exactly like a real one, or a wrong cause that sends your corrective action after a problem you do not have while the real one keeps running.
So the question is not whether AI can be trusted in general. It is where each output lands, and whether anyone downstream would catch it if it were wrong. That is a rating exercise, and it is where this starts.
The list first, then the work
It opens with the inventory almost nobody has: where AI is already being used in your shop, where it is headed next, who is doing it, and what each of those uses touches on the way out. Most of that has never been written down, and some of it never came through you at all.
Then each use gets two questions. How bad is it if that output is wrong, and would anybody catch it before it mattered. Those two answers sort the list, and they sort it the way your own risk work already does, because a use nobody checks is a use that needs the control built in. The top of the list gets the work below. The rest get a note and a watch item, which is the honest answer for most of them.
The failures that matter here, named
A worked risk analysis on the priority workflow. The documented failure modes are the starting checklist, rated against your process: how bad it is where that output lands, and whether anyone would catch it. Occurrence stays out of the rating: there is no rate to look up. Severity and detection set the priority, and the testing step measures what actually failed on your data.
The detection question, answered honestly
Most shops are running on "someone will notice." Sometimes that is the right control and sometimes it is a hope with a job title. Where the risk earns more, checks run in code: unsourced claims get flagged, thin evidence gets stopped, flattery gets stripped. Either way it gets decided before the workflow goes live, not after the first escape.
Tested hard, against your data
Not the vendor demo. Your messy NCR narratives, your unfinished travelers, your real quoting history. The rounds are built to make the AI fail, so you can watch whether the controls catch it when it does.
A control plan your people own
What runs where, which checks protect it, what to watch, and when to revalidate, because a model update is a process change. Your team runs it and owns it after the engagement ends.
A fixed fee engagement, scoped to the workflow the ranking picks. The scope gets set on the 30 minute call.
- SOP drafting
- NCR history search
- Quoting support
- Investigation records
- Customer correspondence
- Wherever the pain is
I ran this on my own product first
A demo is not a capability study. A demo is the supplier's best part, hand carried. So I built the Root Cause Analyzer and refused to call it done until it survived this same discipline: challenge round after challenge round, with new defects still surfacing deep into testing.
Invented specifics. Confident wrong conclusions. Flattery where there should have been challenge. Each one got a control, and the controls are running in the live product today. The late defects never show up in a demo.
You cannot test it for everything. So rank it.
These systems invent detail, agree with your theory, and write confidently past the edge of what they know. Each new model does it less. None of them do it never, and nothing in the output tells you which one you just got. You cannot inspect that out. You control for it.
You also cannot test it for everything. AI gets used for anything somebody can type, and no shop is going to run a study on every task. So you do what you already do with equipment and processes. What can go wrong. How bad is it if it does. Would anyone catch it. Rank by that, control the top of the list, and stop paying for control the low risk uses never needed.
None of this is new to you. A new supplier gets a first article before their parts touch your product. A new operator gets trained, observed, and signed off. A new process gets a capability run before it ships a part. AI arrived without any of that, and it is the only thing in your building that did.
Who this is for
Manufacturers of any kind: job shops, contract houses, OEMs, food, metals, plastics, devices. If your people are using AI on work that matters, this applies. Most of my career was in FDA-regulated medical-device plants, where a wrong entry in a record follows you around for years. You do not have to be regulated to want that standard on your own work.
If you want confidence in how your team is using AI, proven rather than promised, let's talk.
30 Minutes. Your Process. No Pitch.The rest of the practice if you want the background first.