TL;DR
A claims tool and a writing aid can need different answers. Compare local, cloud, and hybrid options against each workflow's data, access, actions, support, and exit needs.
What the paper develops
A claims team wants AI to help with sensitive records. One group favors a local model. Another offers a cloud service with stronger support. The leader cannot choose from model quality alone: neither offer yet says who may read the records, what AI may do, or who restores service when it fails.
A low-risk writing aid may need a different answer. Local, cloud, and hybrid are ways to run AI. Each has to meet the needs of the work it supports.
Check data, access, actions, changes, failures, operations, and supplier exit for each workflow. Have the workflow owner recommend an option. A leader with approval authority makes the choice, accepts the remaining risk within that authority, and records when the choice must be reviewed again.
What to do next
Run seven checks on two real workflows. Have the workflow owner recommend an option and name who can approve it and accept the remaining risk.
Inside the white paper
- Why a model comparison misses the business decision
- How two workflows lead to different hosting choices
- Who recommends, approves, and accepts the remaining risk
Sources and notes
- Chloe Autio, Reva Schwartz, Jesse Dunietz, Shomik Jain, Martin Stanley, Elham Tabassi, Patrick Hall, and Kamie Roberts, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile," NIST AI 600-1, July 26, 2024 — NIST's Generative AI Profile addresses risk management across the AI lifecycle and third-party components.
- Cybersecurity and Infrastructure Security Agency, United States Digital Service, and Federal Risk and Authorization Management Program, "Cloud Security Technical Reference Architecture," Version 2.0, June 2022 — CISA's cloud architecture describes shared responsibilities that vary by the service used.
- Peter Mell and Timothy Grance, "The NIST Definition of Cloud Computing," NIST Special Publication 800-145, September 2011 — NIST defines cloud computing through service and deployment models.
- Wayne Jansen and Timothy Grance, "Guidelines on Security and Privacy in Public Cloud Computing," NIST Special Publication 800-144, December 2011 — NIST's public-cloud guidance explains security and privacy considerations.
- Lee Badger, Tim Grance, Robert Patt-Corner, and Jeff Voas, "Cloud Computing Synopsis and Recommendations," NIST Special Publication 800-146, May 2012 — NIST's cloud synopsis discusses cloud computing choices and recommendations.