Agron FazliuTechnology adviser
AI

The model is usually the easiest part.

AI becomes interesting when it leaves the demonstration and enters the organisation. The difficult questions then are not only what the model can do. They are what information it is allowed to see, what it is allowed to do, who is answerable when it is wrong, and whether anyone can explain afterwards what happened.

The five things below look different on the surface: a voice, an archive, a prediction, an organisation and a fleet of aircraft. What connects them is that the model was never the hard part.

How much authority are you giving it?

There are six answers, and they are not the same decision.

Most disagreements about AI turn out to be disagreements about this one question, held at different points on the same scale without anyone saying which point they mean. Open a step to see what it buys and what it costs.

  1. 1 ReadIt can see information.

    What changes

    It can reach records a person would have had to find by hand.

    What new risk appears

    Everything it can reach, it can repeat to whoever is asking.

    What control it needs

    Decide what it may see, and make that follow the permissions people already have rather than creating a second set nobody maintains.

  2. 2 SummariseIt can explain what it found.

    What changes

    People stop reading the source and start reading the summary.

    What new risk appears

    A confident summary of the wrong document is harder to catch than a wrong answer, because it reads exactly like a right one.

    What control it needs

    Make every answer cite the document it came from, so the check is one click rather than an act of faith.

  3. 3 RecommendIt can suggest what someone should do.

    What changes

    Its output starts arriving inside real decisions.

    What new risk appears

    People agree with it because it is quicker than disagreeing with it.

    What control it needs

    Show the reasoning and the source, and keep the person who acts on it accountable for the action.

  4. 4 PrepareIt can draft the email, the payment or the change.

    What changes

    The work is done and waiting for a signature.

    What new risk appears

    Approval becomes a formality when the thing is already finished and the queue is long.

    What control it needs

    Make the approval step show precisely what will happen, not a description of what was intended.

  5. 5 Act with approvalIt can carry it out once a person agrees.

    What changes

    It now changes things in real systems.

    What new risk appears

    Its identity, not a person's, is what the system records as having acted.

    What control it needs

    Give it its own identity and its own narrow permissions, and record what it changed as well as what it was asked.

  6. 6 Act within limitsIt can carry it out on its own, inside defined boundaries.

    What changes

    Volume becomes possible. So does volume of mistakes.

    What new risk appears

    A wrong decision repeats at machine speed, and the first person to notice is usually a customer.

    What control it needs

    Set hard limits it cannot exceed, a way to stop it immediately, and a tested way to undo what it has already done.

How much a system is allowed to do should follow how much of what it does can be seen and undone. Authority is earned rather than configured.

AI-native platform, synthetic voice and digital content

Why a machine finds Albanian so hard to speak

Why this matters

AI works best where an enormous amount of material already exists. Smaller languages show what happens when the data simply is not there and has to be created, carefully, by people.

A forested slope disappearing into heavy fog
Plenty of language. Almost none of it written down.

Synthetic voices sound convincing in English because they were trained on an enormous amount of recorded English. Albanian has a tiny fraction of that, and Kosovo Albanian has less again. Almost everything that makes the problem hard follows from that one shortage.

Start with the standard language. Written Albanian is built on the southern variety, Tosk. Kosovo Albanian is Gheg, the northern one. Train a voice on the standard and you get something that is correct on paper and instantly wrong to anyone who grew up with it, a bit like an English voice that had only ever read Victorian novels.

Then the spelling withholds what the voice most needs. Gheg carries nasal vowels and long vowels that the standard alphabet simply does not write down. The model is handed text that is missing the very information it needs to sound right, and has to infer what nobody wrote.

Albanian also writes single sounds with pairs of letters: dh, gj, ll, nj, rr, sh, th, xh, zh. Software that reads letters one at a time turns dh into d then h. The result does not sound like an accent. It sounds like somebody spelling a word out loud.

Ordinary speech then borrows heavily from Turkish, Serbian, German and English, often several times in one sentence. For each borrowed word the system has to decide which set of pronunciation rules applies, and every wrong guess is audible immediately to a native ear.

None of this can be bought. No provider is going to prioritise a language of a few million speakers, so the recordings, the transcriptions and the pronunciation dictionary have to be built rather than licensed. That is the work now: assembling clean speech data, marking the sounds the alphabet leaves out, and teaching the system where one language stops and a borrowed word begins.

And the final test is not a number. Whether it sounds right is settled by people who grew up hearing it, which makes evaluation slow, human, and the most honest part of the whole process.

How it worked technically

Before any of it can be sold, the pipeline has to be able to say which model produced a given piece of audio, what it was conditioned on, which provider served the request and what that provider retained. That means formal model evaluation so provider choice is evidenced rather than assumed, provenance carried through every stage rather than reconstructed afterwards, more than one provider so that none becomes structural, and close cost control, because inference bills nothing like hosting.

The data work underneath is a pronunciation dictionary and a phonetic annotation layer that records the nasal and long vowels the orthography omits, plus digraph-aware tokenisation so that dh, gj, ll, nj, rr, sh, th, xh and zh are handled as single phonemes rather than as letter pairs. Borrowed words are tagged by source language so the right pronunciation rules are applied to each.

Venture work. Not published, and the venture is not named.

Private wealth, trust and legal practices

An archive that answers, and never leaves the building

Why this matters

Some organisations want what modern AI can do without sending confidential records to an outside company. That is a question of how the system is built, not a reason to avoid AI.

A room lined floor to ceiling with small wooden index drawers
Decades of it, and none of it allowed to leave the building.

Some organisations cannot send their records to anyone else's cloud. Not reluctant to, cannot. The confidentiality obligations are the product, and a third-party processor is a category of risk they are not permitted to accept.

So the interesting constraint is being able to ask a question of decades of documents with nothing at all leaving the premises: the models run on hardware in the building, the scanned paper has to be turned into text before any of it can be searched, and every answer has to point at the document it came from rather than paraphrase it into something plausible.

The measure of success is unusual. Nobody is impressed by the technology. They are impressed that a question about a file from decades ago now takes seconds, and that nothing left the premises to make it happen.

Situation
Decades of scanned correspondence, instructions and files, searchable only by someone who already knew where to look.
Constraint
Nothing could leave the premises. Confidentiality is the product, so a third-party processor was not a risk to be mitigated but a category that could not be accepted.
Decision
Run the models on hardware in the building, rather than use a hosted service with contractual assurances wrapped around it.
Approach
Optical character recognition over material scanned long before anyone planned to search it, indexing built for retrieval quality, and answers that cite the source document rather than paraphrasing it into something plausible.
Assumptions
No outbound data path. Access follows existing entitlements rather than creating a second set. Every answer traceable to a document a person can open.
Result
A question about a file from decades ago now takes seconds, and nothing left the building to make that true.
Learned
Nobody was impressed by the technology, which is the correct reaction. The measure that mattered was whether the answer could be trusted without checking it.

Client work under confidentiality. Sector named, nothing else.

Consumer services marketplace, as product, data and technology officer

Everyone was waiting on the same measurement

Why this matters

The useful model was not the impressive one. It removed a costly step from something a real customer was waiting on.

A pale curved building against an open sky
One measurement, and everybody downstream of it waiting.

Running product, data and technology for a consumer services marketplace. Owners, trade firms, recruiters, property managers and insurers, all held up by the same thing: somebody driving out to measure the job on site. That visit is most of what an estimate costs, and most estimates never become work.

So the first question was not what the job should cost but how big it is. A supervised machine learning model trained on completed projects predicted job size directly from the record, which removed the visit and roughly a fifth of what evaluation cost the customer.

The second problem was spread: three quotes arriving with three very different numbers on them. A second method read the historic offers, took out the bias of any individual firm and narrowed the range, so a quote could be issued immediately rather than after days of exchange. That took close to a fifth off the time spent producing them. Both approaches were filed for patent consideration, on top of a multi-year data strategy, because a model predicting job size is only ever as good as the records it learned from.

Read the anonymised case in full
Enterprise software, data science leadership

Machine learning pointed at the organisation itself

Why this matters

Data can show how an organisation really works. The same data becomes surveillance if the privacy boundary is drawn badly, and that boundary has to be drawn first.

Repeating concrete forms in raking light
Structure you can see, once you stop reading the chart.

Leading a data science team inside a software business, the most interesting model was not customer-facing. It read the company's own communication graph and surfaced the people holding entire functions together while sitting nowhere near the top of the chart.

That technique is a surveillance tool if handled carelessly, so the real work was designing it to answer questions about the network without ever becoming a way to watch an individual. Consent and purpose, settled before the analysis runs rather than after it produces something interesting.

Finding the people who hold it togetherThe method behind it
Consumer platform, and advanced drone systems

Where AI is mostly a trust problem

Why this matters

Most of the AI here is invisible. It exists so that strangers can deal with each other safely, and so that something in the air stays inside its limits.

A misted coastline seen from high ground
Strangers dealing with each other, safely, without ever meeting.

On a consumer platform built around vehicle identity and local services, almost none of the AI work is a feature. It is verification, privacy safeguards, moderation at a volume no team can read, and automation of the service flows underneath, all of which exist so that strangers can transact without either of them being exposed.

On drone fleets it takes a different shape again: AI-assisted deployment and coordination, reusable templates so a show is planned rather than improvised, and automation that has to stay inside hard safety constraints. A model that is merely usually right is not acceptable when the failure mode is airborne.

Current venture work. Nothing published yet.

Six questions

The same six questions come up every time a system is given real access. Settled in advance they take an afternoon. Settled afterwards they take an incident.

IdentityAuthorityDataProvidersObservationRecoverybefore itis trusted

Identity, authority, data, providers, observation, recovery. Not a maturity model and not a certification: six things that have to have answers before a system is allowed to act on anything that matters.

Who is it when it acts?

In the profession: Identity

Not a shared account that three systems and two people also use. Its own identity, its own credentials, and the ability to answer the question of which system did something without a process of elimination.

What is it allowed to do?

In the profession: Authority

Reading a document, recommending an action and carrying that action out are three different levels of trust. They are routinely granted as one.

What can it see, and what can that tell it to do?

In the profession: Data

Which records it may reach, and for what purpose. A document or a web page it reads may also contain instructions written to manipulate it, so anything it reads has to be treated as information rather than as orders.

Who else touches the information?

In the profession: Providers

A request passes through more companies than the interface suggests. Where it travels, who keeps a copy, for how long, and whether any of it is used to train something else.

Can we reconstruct what it did?

In the profession: Observation

Which model answered, which tools it used, what it read and what it changed. Without the last of those, an investigation can describe what was intended but not what happened.

Can someone stop it or undo it?

In the profession: Recovery

Every authority granted needs a way to withdraw it and a way to reverse what was done with it, tested rather than assumed.

What comes next

Views rather than predictions, and held loosely enough to be argued with.

An agent that can act is a non-human insider

The useful mental model is not a tool but a new employee with system access, no judgement about consequences, and no fear of being dismissed. Everything about how access is granted follows from taking that seriously.

Identity stops being about people

Identity management has spent two decades on humans. The population it now has to govern is humans, workloads and agents, and only one of those three can be phoned and asked what it just did.

The knowledge layer outlives the model

Model choice is already commoditising and will keep doing so. What an organisation owns is its data, its context and its authorisation design, and those are what determine whether a change of provider is a migration or a rebuild.

Confidentiality forces a split

Organisations whose confidentiality obligations are structural rather than preferential will end up using outside models for some work and running their own, on their own hardware, for the rest. That is a decision about how the thing is built, not a decision about what to buy.

Exit becomes a board question

Provider concentration in AI is arriving faster than it did in cloud, and the question of how quickly a provider could be replaced will be asked by boards before it is asked by architects.

Value shows up as changed work

Not in adoption dashboards. In decision time, senior hours reclaimed, cycle time, errors removed and work that was previously impossible. If none of those moved, nothing happened.

Published on this

If AI is already in use and nobody has decided what it may see or do, start with that.

A short description of the situation is enough. You do not need to have worked out which question above is the one biting you.

Start a private conversation on LinkedIn How I work with private offices and trusts