Frequently asked questions
The questions we hear every week, answered.
Each answer comes from the page it belongs to, so it says the same thing there as here. Search, or start from a topic.
Getting started
Where should we start if we are not sure what we need?
Start with the free AI Readiness Assessment. It takes about five minutes, scores your organization across the dimensions that decide whether a data or AI build succeeds, and returns a prioritized list of what to fix first. If you would rather talk it through, a first conversation with a senior advisor is about the work, not a pitch.
From Home
How do you work with our existing team and technology?
In your cloud, on your accounts, with your data staying in your environment, and what we build is yours to run. We are model-neutral by policy and hold no exclusive vendor incentives, so the architecture recommendation follows your data sensitivity, volume and existing footprint rather than a partner quota. Where your team needs more depth to keep pace, we extend it with senior specialists rather than replacing anyone.
From Home
What does a first engagement look like?
Fixed scope, fixed fee, and a defined decision at the end. Most clients begin with an Assessment Sprint, an AI & Agent Pilot or a Data Platform Accelerator depending on where their uncertainty sits, and most start within two to three weeks of a signed scope. Larger platform engagements are scoped individually, but we would normally run a bounded program first so the scope rests on evidence rather than assumption.
From Home
About Data Products
Who is Data Products?
A data and AI consultancy, headquartered in Chicago. We take the work from deciding what is worth building, through the data platform, the models and the interfaces people use, to the security around them and the skills to keep them working. The team that writes the roadmap builds the system it describes.
From Data IQ™
What services do you offer?
Eight practices cover the work from end to end: Strategy & Governance, Data Engineering & Platforms, AI & Machine Learning, Generative AI & AI Agents, BI & Data Visualization, AI Security & Cyber Risk, AI & Data Literacy, and Staff Augmentation & Expert Services. Six starter services are fixed-scope ways to begin, each ending in a defined decision.
From Practices
Do you offer training?
Yes. AI & Data Literacy programs are built around the work people actually do, and measured by how that work changes rather than by attendance. For leadership teams, the Executive AI Workshop is a working session on what AI is for in your organization and which uses are worth funding.
From AI & Data Literacy
How do I talk to someone?
Use the contact page to book a call or send a message. A person reads every message and replies, and nothing you send puts you on a mailing list.
From Contact
Where can I read more from you?
Under Insights: articles that argue one decision each, the Executive Bytes newsletter written up in full, case studies with the figures clients reported, and the articles from the Private Executive Bites tables.
From Insights
Do you use AI to write this website?
Yes, as a tool, and the way we advise clients to use it: with people accountable for the result. We use AI in research and drafting. Every page is reviewed and approved by Data Products before it is published, the sources we rely on are linked, client figures are the clients’ own, and no one at a Private Executive Bites table is named or quoted without written permission. Data Products takes responsibility for everything published here.
From Insights
Can AI tools read and use this site?
Search engines and AI search assistants are welcome to read these pages and cite them, with a link. Crawlers that collect content to train AI models are asked not to, in the site’s robots.txt. We have turned down an offer to buy our data for model training, and we take the same view of what we publish.
From Insights
Key terms
What is artificial intelligence?
The broad field of building computer systems that perform tasks normally associated with human thinking, such as recognizing images and speech, understanding language, making predictions and taking decisions. It includes machine learning and generative AI. In practice, the useful question is not whether something uses AI but which specific task it does and how reliably.
From the glossary
What is machine learning?
A branch of AI in which computers learn patterns from data to make predictions or decisions, rather than following rules written by hand. It works best when there is plenty of relevant historical data and a clear target to predict; the quality and representativeness of that data usually matter more than the choice of algorithm.
From the glossary
What is generative AI?
AI systems that create new content, such as text, images, code or audio, by learning patterns from large amounts of existing material. They can draft, summarize and answer questions quickly, but output can be fluent and still wrong, so business use needs human review, grounding in trusted sources and clear rules on data handling.
From the glossary
What is data science?
A field that combines statistics, programming and business knowledge to extract insight and predictions from data. Data scientists frame questions, prepare data, build models and communicate findings. Its value in practice depends on solid data foundations and on linking each model to a real decision or business process.
From the glossary
What is data strategy?
A plan that sets out how an organization will collect, manage, govern and use data to meet its business goals. It covers priorities, use cases, architecture, skills, governance and funding. A sound data strategy starts from business outcomes rather than technology, and is revisited as priorities change.
From the glossary
What is data governance?
The policies, roles, standards and decision rights that set how an organization's data is defined, owned, accessed, protected and used. Good governance makes clear who is accountable for each dataset. Treating it as paperwork rather than a working process is a common reason it fails to improve trust in data.
From the glossary
What is business intelligence?
The tools and practices for collecting, organizing and presenting business data through reports, dashboards and queries so people can track performance and spot trends. It mostly answers what happened and where. Its value depends heavily on agreed metric definitions; without them, different reports give different answers to the same question.
From the glossary
Free assessments
Free assessments
Are the assessments really free?
Yes, and there is no email gate. You see your complete result on screen — every dimension score, the strengths, the gaps and the priorities — without giving us an address. At the end you can ask us to email you a PDF of the report, which is an offer rather than a condition.
From Free assessments
What do you do with my answers?
Scoring happens in your browser and nothing leaves it unless you ask for the report by email. If you do ask, your address and your dimension scores are sent so we can send the report. Your individual answers are never transmitted.
From Free assessments
How long does an assessment take?
AI Readiness is eighteen questions and takes about seven minutes. AI and Data Literacy runs two tracks in one sitting, about twelve minutes. Data Maturity and the Cyber Risk Screen are fifteen questions each and take about six. You can move backwards and change an answer at any point before you finish.
From Free assessments
Which one should I take?
Take the one matching the question you are actually being asked. If someone wants to know whether an AI programme will survive contact with production, take AI Readiness. If adoption is the problem rather than tooling, take AI and Data Literacy. If the doubt is about the data underneath, take Data Maturity. If the question came from security or audit, start with the cyber screen.
From Free assessments
How accurate can a questionnaire be?
A questionnaire scores what you believe about your organization. That is genuinely useful — it shows which dimension is weakest and gives you language for the budget conversation — but it cannot inspect your data, your contracts, your architecture or your actual run costs. Verifying those is what a paid diagnostic does.
From Free assessments
Will taking one put me on a mailing list?
No. There is no newsletter subscription attached to any assessment, and no tracking pixel in the emailed report. If you ask for the report, you get the report.
From Free assessments
AI Readiness assessment
Is the AI Readiness Assessment really free?
Yes, and it asks for no email address. The eighteen questions are scored in your browser, nothing is transmitted or stored, and the full result with its prioritized recommendations appears on the page immediately. It is distinct from the AI & Data Assessment Sprint, which is a paid advisory engagement.
What does the assessment measure?
Six dimensions, three questions each. Data foundation, whether anything reliable exists to build on. Governance and review path, whether a working system could actually launch. Evaluation and assurance, whether you could prove it works. Cost and portability, whether it stays affordable at scale. Adoption and literacy, whether the organization uses what you build. Security and AI risk, whether the exposure is understood.
How long does it take?
About five minutes. Eighteen questions with three answers each, and the result appears as soon as the last one is answered.
What is the difference between this and the Assessment Sprint?
This is a free self-assessment: it scores what you tell it, and cannot see your architecture, read your contracts or interview your people. The AI & Data Assessment Sprint is a paid engagement covering a maturity audit, stakeholder interviews, architecture review, investment scenarios and a board-ready recommendation.
AI & Data Literacy assessment
Is the Literacy Assessment really free?
Yes, and it asks for no email address. The fifteen questions are scored in your browser and the complete result appears on screen. At the end you can ask us to email a PDF of the report, which is an offer rather than a condition.
What does the assessment measure?
Two tracks, scored separately. The data track covers reading (understanding what a chart does and does not show), questioning (interrogating a number before repeating it) and acting (whether evidence changes decisions). The AI track covers limits (what a model can and cannot be trusted with) and safe use (what leaves the organization, and who owns an AI-assisted decision). The gap between the two scores is usually the most useful part of the result.
How long does it take?
About twelve minutes. Twenty-five statements with three answers each, and the result appears as soon as the last one is answered.
Why score data literacy and AI literacy separately?
They are different competencies. Reading a chart well is not the same skill as recognising that a fluent answer can be wrong, and a single blended score hides the difference. In most organizations data literacy runs ahead of AI literacy, and that gap is precisely the risk: people extend their confidence with numbers to model output, where it has not been earned.
Data Maturity assessment
Is the Data Maturity Assessment really free?
Yes, and it asks for no email address. The fifteen questions are scored in your browser and the complete result appears on screen. At the end you can ask us to email a PDF of the report, which is an offer rather than a condition.
What does the assessment measure?
Five areas, three questions each. Lineage, whether you can trace a number to its source. Quality, whether the data is fit to act on. Ownership, whether anyone is accountable for it. Access, whether the right people can reach it. Platform, whether what it runs on will hold.
How is this different from the AI Readiness Assessment?
AI Readiness gives your data foundation a single score among six dimensions. This one spends all fifteen questions on that foundation, at the level of detail a data engineer would recognise. Take AI Readiness if the question is whether an AI programme will reach production; take this one if the doubt is about the data underneath it.
AI & Data Cyber Risk screen
Is the Cyber Risk Screen really free?
Yes, and it asks for no email address. The fifteen questions are scored in your browser and the complete result appears on screen. At the end you can ask us to email a PDF of the report, which is an offer rather than a condition.
What does the screen measure?
Five areas, three questions each, mapped to the NIST AI Risk Management Framework and ISO/IEC 27001. Model security, the attack surface a functional test does not cover. Data protection, what leaves your boundary and what is retained. Supply chain, the models and vendors you depend on. Identity and access, what an AI system is permitted to do. Detection and response, whether you would know.
How is this different from the AI Readiness Assessment?
AI Readiness screens security in three questions among six dimensions. This one spends all fifteen on security, at the level of detail a CISO would recognise. Take AI Readiness if the question is whether an AI programme will reach production; take this one if the question came from security, audit or a customer questionnaire.
Business priorities
Business Priorities
Is this only about AI?
No. The same five questions decide whether analytics and the data platform underneath pay off. AI often makes them more urgent: its running cost usually grows with use, and a wrong answer can reach more people before anyone notices.
From Business Priorities
Which question should we start with?
The one nobody in the room can answer with evidence. If that is not clear, a thirty-minute conversation or the free AI Readiness Assessment will point to it.
From Business Priorities
Do we have to answer all five before we start?
No. Most organizations have one that is blocking the rest. Each page ends with one way to start on that question, and hands you to the next one when you are ready.
From Business Priorities
What is a review, and how is it priced?
Each review is a bounded engagement delivered through one of our starter services, with the scope fixed and the fee agreed in writing before any work starts. It produces the evidence, a recommendation, and the next decision with its owner. Each question page says which service delivers it.
From Business Priorities
How is this different from your practice pages?
These pages start from the problem in business terms, for the people who fund the work. The practice pages describe the capability that solves it, for the people who will build it.
From Business Priorities
Value & Economics
How is AI ROI different from an ordinary business case?
The benefit side is familiar. The cost side is not: model run cost grows with use, someone has to review what the system produces, the data usually needs work, and errors carry a cost of their own. A defensible case prices all of them for one outcome, then adds them up as a total cost of ownership, with year one separate from the run rate.
From Value & Economics
Do hours saved mean money saved?
Only when spend actually goes: a role not backfilled, overtime or contractor hours cut. A task done 40% faster frees capacity. Moving that capacity to other work can be worth more than the saving, but it is value, not cost avoided, and a sound case counts it once, on the value side. Sometimes the right answer is better service, and then the case should say so rather than count payroll it will never see.
From Value & Economics
Can you put a number on it before anything is built?
An order-of-magnitude number, yes. The Assessment Sprint produces three cost paths from your own systems, with year one and the ongoing run rate separated. Where a decision needs a full financial model, we say so at the readout.
From Value & Economics
Will you tell us not to do it?
Yes, when one outcome costs more with AI and nothing it adds, such as revenue, lower risk or a capability you did not have, covers the gap, or when another route gets there for less. That answer is cheaper in week two than in month nine.
From Value & Economics
Is this only about AI?
No. The same questions apply to analytics and to the data platform underneath. AI makes them more urgent, because run cost grows with use.
From Value & Economics
Governance & Accountability
Do we need a governance program before our first AI system?
No. You need an owner, a tier and a record for that system. The program grows as the uses do. The Governance Quickstart proves the review path on one real use case before anything bigger is built.
What will a board, an auditor or a regulator ask for?
Who owned the decision, what evidence supported it, which risks were accepted, who reviewed it and against what, and what would reopen it. A record that answers those five answers most of the questions that follow.
Which frameworks do you use?
The NIST AI Risk Management Framework and ISO/IEC 42001 as the structure where they apply, sized to your organization rather than lifted whole.
Will this make us compliant with AI law?
No page can promise that, and we will not. We map the obligations that apply to each use, then build the review path and the record around them. Our guides to the EU AI Act and to Illinois AI law explain what those laws ask.
Will this slow AI work down?
It replaces an undefined review with a defined one. Low-risk uses get a light review, and the full review is kept for uses that can cause serious harm. Work waiting on an answer nobody could give gets an answer with a date on it.
Pilot to Production
Why do AI pilots stall before production?
Usually on what surrounds the model. The data was clean in the pilot, nobody could prove it was good enough, the review arrived at the end, and the unit cost was never modeled. Sometimes the model itself is the limit, and an honest evaluation shows that early. None of it is visible in a demo.
From Pilot to Production
Do we need another pilot?
Usually not. If the pilot proved the use case, the next step is a review of what production needs, then the build. A new pilot makes sense when the use case itself is still unproven.
From Pilot to Production
Should we rebuild the pilot or extend it?
Usually keep what proved the use case and rebuild what assumed a demo: the data connections, the tests, the controls and the cost model. We say which is which at the start, before anything is built.
From Pilot to Production
How do you decide it is good enough?
Against labeled answers from your own work, with a bar the business owner agrees before launch, stricter where a mistake costs more, and tested again on every change. “It seems to work” does not clear a risk committee.
From Pilot to Production
Which models do you use?
Whichever clears your bar for quality and security at the lowest unit cost, and we route between models where it pays. We are model-neutral by policy and hold no exclusive vendor incentives.
From Pilot to Production
What if production shows it is not worth it?
Then you hear it with the evidence: scale it, revise it or stop. A pilot stopped on evidence is money saved, not money lost.
From Pilot to Production
Data Readiness
How do we tell whether it is the model or the data?
Trace a handful of answers you do not trust back to their source. If the source was wrong, stale or missing, it is the data. If the source was right, the cause can still sit in between: how the data was moved or reshaped, what the system was allowed to see, how a term is defined, or the model and its instructions. Tracing shows which, and it is where the diagnostic starts.
From Data Readiness
Do we need a new data platform?
Often not. The diagnostic decides, part by part, what to keep, what to fix and what to build. Often the estate needs repairs and one missing pattern, not a replacement.
From Data Readiness
Can we start on AI before the data is fixed?
Yes, if the use case is narrowed to what the data supports, or the gap is contained where the answer is made. Those are two of the three ways forward.
From Data Readiness
Who should own the data once it is fixed?
A named owner in the business for each source and each definition, not the data team alone. Ownership is one of the tests the diagnostic runs on every part of the estate, so a gap there is found before it undoes the fix.
From Data Readiness
Adoption & Workforce
How do we know whether it is being used?
Count the work it changed, not the logins: decisions made with it, cases closed through it, reports nobody rebuilds by hand. Then ask the people expected to use it, without their managers in the room.
From Adoption & Workforce
Is this a training problem or a change-management problem?
Usually both, and neither alone. Skills and confidence are one cause; the work and the organization around it are the others. Training by role, on people’s own work, helps once the work fits and leaders reward the new way. Change management that stops at announcements does not.
From Adoption & Workforce
Who should own adoption?
The business owner whose number it is meant to move, not IT or learning and development alone. They sponsor the change, and their teams should see them work the new way. If nobody owns it, nobody notices when it stops being used.
From Adoption & Workforce
We haven’t launched yet. Does this apply?
Yes, and it costs less before launch. The same three causes are the readiness test: can people do their work with it, does it fit the work, and do targets and decision rights reward it? The Adoption Review works the same way on a change you are about to make.
From Adoption & Workforce
Is retiring it a failure?
No. Retiring a system on evidence stops a running cost and tells you what people will actually use. Keeping it because it was expensive is the failure.
From Adoption & Workforce
Data IQ™, our method
Is Data IQ™ something we buy?
No. It is how every engagement runs. You see it in what you keep: a scored baseline, a ranked shortlist, a signed Decision Brief, a decision log and a handover your team can run from.
From Data IQ™
Do we have to go through every stage?
No. The stages are groupings, not a sequence to complete. Most engagements start in one and pull in two more, and security runs through all of them.
From Data IQ™
Why both stages and phases?
They answer different questions. The stages say what the work is: set direction, build, secure, make it stick. The phases say when it happens inside one engagement. Security and governance are not a phase because they run across all five.
From Data IQ™
How does the maturity model relate to the stages?
The stages organize the work; the six dimensions measure readiness before and during it. A dimension that scores low points to the one engagement that fixes it, as listed in the scoring sheet on the Data IQ™ page.
From Data IQ™
How is this different from a maturity survey?
A survey scores your answers. The Assessment Sprint scores the same six dimensions against your systems, with four tests of evidence on each: is it documented, owned, measured and tested.
From Data IQ™
Do you publish the whole model?
We publish the six AI-readiness dimensions in full. The complete model reaches wider; it is applied in the Assessment Sprint and in our engagements, where it is scored against your systems rather than described in general.
From Data IQ™
Does it work with frameworks we already use?
Yes. Governance work follows NIST AI RMF and ISO/IEC 42001 where they apply, and security work maps to NIST AI RMF and ISO/IEC 27001. Data IQ™ organizes the work; it does not replace the frameworks your auditors expect.
From Data IQ™
Practices
Strategy & Governance
How do you calculate AI ROI?
From first principles: the baseline today, the intervention, its total cost, the adoption and process change it needs, the measurable outcome, and the value realized. Total cost covers data remediation, integration, workflow redesign, infrastructure, change management, oversight and run cost, not only the model. Return can be revenue, margin, cycle time, capacity, customer outcomes, risk reduction or avoided cost. We keep the business case and value realization separate: one is what the investment should return, the other is whether it did.
How do you prioritize AI use cases?
First each idea is articulated well enough to compare: the business problem, the user and process, the outcome and its baseline, the data required, an owner, the dependencies, the risk and a success measure. Then the portfolio is ranked on value, strategic fit, readiness, time to value, dependencies, cost, adoption requirement and risk. The result is a funding decision, not a scored spreadsheet.
What does an AI strategy roadmap include?
Business outcomes tied to the use cases that move them, the capability gaps in the way, the data and platform dependencies, the operating-model changes, the governance each stage needs, the funding gates and the delivery sequence. It is what connects strategy to the engineering and AI work that follows.
How do you assess AI and data maturity?
Against your systems and the people who run them, with sources cited, across data, architecture, technology, talent, process, governance, operating model, adoption and value management. The free online assessments are a self-diagnostic for orientation. An engagement assessment replaces your answers with evidence, and exists to answer one question: what can we realistically do next?
How does AI governance support executive and board oversight?
By producing the evidence oversight relies on: what leadership knew, which alternatives and risks were considered, who owned the outcome, what supported the decision, and what would cause it to be revisited. The decision log is the mechanism. We do not offer legal advice; we build the decision structure and the record.
Will governance slow our teams down?
A single heavy review for everything does. Tiered review does the opposite: the low-risk majority takes a fast lane with a short record, and depth goes where a use case touches sensitive data, affects people or acts on its own.
How do you build trust in AI systems?
By making it concrete. Can the data be relied on? Can a decision be reproduced and explained? Is the source of the evidence known? Do people know when a human must step in? Is there a trigger for re-review when performance changes? Each becomes a control with an owner.
We already have an AI policy. Do we start over?
No. Most policies have the right intent and no decisions in them. We keep the intent and add the criteria, thresholds and named owners, then re-run past requests through it so you see it decide rather than defer.
Which frameworks and regulations do you work with?
NIST AI RMF for structure, ISO/IEC 42001 for the management-system shape auditors recognize, and the obligations that actually apply to you: federal and state requirements, sector rules and your contracts. Your own policies are the starting point.
Data Engineering & Platforms
What do we get from the Data Platform Accelerator?
The diagnostic: every component through the seven tests, with its keep, fix or build call and the reason. A working foundation on the chosen platform, with its access and governance model. The first pipelines live, built as the pattern for the rest. And the runbook, walked through with the team that will own it. Two to four weeks, fixed scope, with a fixed fee agreed in writing before work starts.
Do we have to replace our data warehouse?
Usually not. The warehouse is often sound; what is broken is around it, such as ingest that fails silently, missing lineage, or definitions that drifted apart. Every component goes through the same seven tests. What passes is kept, what is worth saving is fixed, and only what does not exist is built.
Our migration stalled. Do we have to start again?
No. Migrations usually stall on things nobody designed: a pipeline pattern, an access model, one set of conventions across two teams. We find the missing pattern, build it once, and what is stuck follows it. What already moved is kept.
Which platform should we use: Fabric, Databricks or Snowflake?
If you have already chosen, we build on it. If you have not, the decision is made on the diagnostic: your existing cloud footprint, the workloads the platform has to carry, and the team that will operate it. We work across all three, and the recommendation is not conditioned on an exclusive vendor relationship.
Will our team be able to run it afterwards?
That is the seventh test and the last acceptance criterion. Your team gets the runbook to operate, extend and add a source, is walked through it on the platform itself, and adds a new source from the template before handover.
Do you only run accelerators?
No. The accelerator proves the pattern on a bounded scope. The practice exists for what follows: full platform builds, migrations of every source and workload, integration and master data, and the DataOps that keeps a platform reliable once it is live.
Can our current platform carry AI workloads?
Often the constraint is one layer, not the whole estate: the storage and compute that documents, retrieval and models need. We modernize that layer and carry forward the semantic models, history and access rules that still work.
How do you keep platform costs under control?
Unit economics is one of the seven tests. Budgets, per-run cost tags and alerts are built in from the start, so the cost per pipeline run and per query is known at the volume you are planning, before the bill arrives.
AI & Machine Learning
Do you build only the model, or the whole system?
The whole system: data pipelines, features, training and serving, monitoring, the integration into the workflow, and the handover that lets your team run it. A model on its own does not change a decision.
How do you avoid models that test well and fail in production?
By validating against the decision, not the dataset. That means time-based splits, backtesting, leakage checks, segment-level performance, and a threshold set with the people who act on it. Monitoring and drift detection are in place from the first release.
Machine learning or generative AI: which do we need?
If the answer is a number, a score, a ranking or a plan, it is usually machine learning. If the work is reading, writing or conversing over documents and knowledge, it is usually generative AI. Many systems use both, and we scope them together when they do.
How do we know whether our data is good enough?
By looking at it, early. Data readiness is the first technical step: access, quality, definitions, and whether the outcome you want to predict has been recorded reliably. If it has not, we say so before modelling starts, and the Assessment Sprint exists for exactly that question.
How is the return measured?
At the workflow, against a baseline set when the decision is framed: cycle time, throughput, loss avoided, false positives, conversion or cost per outcome. The measure is agreed before engineering begins, so the result is not argued about afterwards.
Can you work in regulated settings?
Yes. Access controls, audit logging, model documentation, explanations and review routines are scaled to how much the decision matters. We build the controls and the record; we do not offer legal advice.
What happens after the model is live?
It is monitored for performance, drift and data quality, with a named owner for alerts and an agreed trigger for retraining. Your team runs it, with our support for as long as that is useful.
Generative AI & AI Agents
What do we get from the AI & Agent Pilot?
A running GenAI system on your data, handed over with its source. The evaluation harness: your test set, scoring logic and acceptance thresholds. Measured unit economics at expected volume. And a scale, revise or stop decision presented with the evidence behind it. Two to four weeks, fixed scope, with a fixed fee agreed in writing before work starts.
Do you only run pilots?
No. The pilot is where most clients start because it produces evidence quickly, but the practice exists to put systems into production and keep them there. That covers production builds, integration with your identity, data and review path, and AI Change Assurance for agents that are already live.
How do you prove an AI system is accurate enough to deploy?
We build the evaluation harness before the system. Three layers: a labeled test set with ground-truth answers, model-graded scoring for open-ended quality, and human review for edge cases. Every prompt, model or retrieval change re-runs it.
Which model should we use: a frontier API, a model hosted in our own cloud, or open source?
It depends on data sensitivity, cost per call at your volume, and your existing cloud footprint. Regulated data usually points to a model hosted inside your own cloud tenancy, under enterprise terms. High-volume simple tasks often run cheaper on small open-source models. Complex reasoning justifies a frontier model. Most systems we ship route across two or three. We hold no exclusive incentives; the recommendation follows the workload.
How do you handle hallucinations, PII, and prompt injection?
Hallucinations: grounding through retrieval, structured output constraints, and confidence-thresholded refusal. PII: classifier-based scrubbing on input and output. Prompt injection: input sanitization, channel separation between system and user messages, and output validation. We red-team every system before launch.
What happens to our AI system when the underlying model is retired or upgraded?
Model change is routine, not exceptional. One major cloud platform documents deprecation at twelve months and retirement at eighteen, with standard deployments auto-upgraded region by region and a 410 Gone response at retirement. AI Change Assurance builds a replay harness so you can prove a new model behaves acceptably against recorded production traffic before it reaches customers.
Are we legally required to revalidate when a model changes?
There is currently no broad regulatory requirement that enterprises revalidate a generative or agentic application every time an underlying model changes; certain regulated systems carry change-management or reassessment obligations, but those are use-case and jurisdiction specific. The stronger argument is commercial: an undetected change in agent behavior affects customers, revenue and operational cost well before it attracts a regulator.
Why do most GenAI pilots fail to reach production?
Four reasons, consistently. The pilot ran on clean sample data and real data is messy. There was no evaluation harness, so nobody could prove the system was good enough to ship. Governance was deferred and legal blocked launch. And cost per transaction was never modeled, so finance stopped it at scale. Every engagement in this practice is built to close all four.
What is the difference between a copilot, an AI agent, and a RAG system?
A RAG system retrieves from your data and generates a grounded answer: one turn, one answer. A copilot lives inside a workflow and helps a user complete tasks: many turns, one user. An agent takes a goal and acts: planning, calling tools, retrying, escalating. Most enterprise builds combine two of the three. The right pattern depends on the task and how much autonomy your risk posture allows.
BI & Data Visualization
Which BI tools do you work with?
Usually the one you already run. We build in Power BI, Tableau and Looker, and in embedded analytics platforms. We do not resell licences, so the recommendation is not tied to a product.
Do we need a new data platform first?
Usually not. Many reporting problems are definition and ownership problems, and can be fixed on the platform you have. Where the data underneath is not sound, we say so early, and the Data Platform Accelerator exists for that case.
How do you get people to actually use a dashboard?
By building it for a decision someone already makes, with that person in the room, and by retiring the report it replaces. After launch, where usage data is available, we track who opens it and whether the meetings it was built for rely on it.
Can self-service work without turning into chaos?
Yes, when people explore governed measures rather than raw tables. The semantic layer does the hard part once, so two people asking the same question get the same answer.
Can we ask questions of our data in plain language?
That works well on top of governed definitions and badly without them. The definitions are what stop a natural-language tool from answering confidently and wrongly. We build the semantic layer first and add plain-language questions where they earn their place.
How many dashboards will we end up with?
Usually fewer than you have now. A modernization consolidates overlapping reports into a smaller set, each with an owner and a purpose.
AI Security & Cyber Risk
Does this replace our security team or our existing tools?
No. Your program stays as it is. We add what it was never asked to cover, and hand each finding to the owner who would normally close it.
How is AI red-teaming different from a penetration test?
A penetration test looks for ways into a system. AI red-teaming looks for ways to make a model misbehave once you are legitimately talking to it: leaking data, ignoring its instructions, or taking an action it should not. You usually need both.
We do not use much AI yet. Is this premature?
Usually the opposite. Most organizations are running more AI than their security team has reviewed, because it arrives inside tools people already had. The inventory is often the most useful finding.
Which frameworks do you work to?
NIST AI RMF, the NIST Cybersecurity Framework and ISO/IEC 27001 for governance, the OWASP GenAI Security Project and MITRE ATLAS for testing, SOC 2 readiness where customers require it, and your own policies as the starting point. Sector obligations are mapped in where they apply to you.
Do you run a security operations center or do penetration testing?
No. We do not run a security operations center or a managed detection service, and we are not a general penetration-testing firm. We secure AI and the data around it, and work alongside the teams and firms that do the rest.
Do you certify us?
No. We build the controls and assemble the evidence an auditor will ask for. Certification is done by an accredited body, and we do not offer legal advice.
How do you handle agents that act on their own?
As a new kind of user. Each one gets an owner, the narrowest access that lets it do its job, credentials that expire, and a log of what it did. Irreversible or high-consequence actions require a human approval, at a threshold you set.
AI & Data Literacy
What is the difference between data literacy and AI literacy?
Data literacy is reading, questioning and acting on numbers. AI literacy is knowing what an AI system can and cannot do, using it safely and checking what it returns. A team can be strong in one and weak in the other, which is why we score them separately.
From AI & Data Literacy
How do you know the training worked?
By what people do afterwards. We take a baseline before the program, measure again after, and look at the use, quality and judgment the program was for. Attendance and completion are recorded but are not the result.
From AI & Data Literacy
Who should go first?
Usually the executive team. People adopt what their leaders visibly understand and ask about, and the leadership session decides what the rest of the program should prioritize.
From AI & Data Literacy
Do we need to use NuScienta to work with Data Products?
No. We design and run programs on NuScienta, on your own learning system, or on both. NuScienta can also be used on its own, without a consulting engagement.
From AI & Data Literacy
Does a literacy program make us compliant with AI rules?
No program does that on its own. We build role-appropriate literacy measures and keep the evidence of what was done, which is what an organization can show. Whether that meets a particular obligation is a legal question, and we do not give legal advice. Our guides to the EU AI Act and Illinois AI law set out what each covers.
From AI & Data Literacy
Is it online or in person?
Both. Executive sessions are usually in the room. Workforce tracks combine instructor-led sessions with online courses, so people practice between sessions on their own work.
From AI & Data Literacy
Can the training use our own tools and data?
Yes, and it should. Exercises are built on the systems your people already use, inside your policies, so the skill transfers to the job on the first day back.
From AI & Data Literacy
Staff Augmentation & Expert Services
Where are your people based?
The bench includes people in Latin America, Europe and North Africa, all working hours that overlap the US working day. For embedded work, that means at least four hours a day. Engagements are run and overseen from our Chicago headquarters.
What does vetting involve?
Three things before anyone is put forward: a technical screen run by a senior practitioner, a paid trial task on real work, and a check of past engagements. Agreements and confidentiality terms are signed before a person joins the bench.
How quickly can you put people forward?
For skills already on the bench there is no search to start: we shortlist from people we have vetted. We give you a date on the first call, and you interview everyone we put forward.
Who manages them day to day?
You direct the work, as you would for any member of your team. We handle performance, continuity and cover, and a senior person on our side stays close to the engagement.
What if someone becomes unavailable, or the fit is not right?
Tell us early. We would rather change the person than have you carry a poor fit. If someone has to leave, we replace them from the bench and manage the handover.
How long is a typical placement?
It is sized to the work. Some are a few months to get a workstream moving; others run longer as part of a standing team. The duration is agreed up front and can change as the need does.
How is it priced?
A rate per person, agreed in writing before anyone starts. You get the figure for your role on the first call. What you are buying is senior capacity without a hiring cycle, and the rate reflects that seniority.
How do you handle security, confidentiality and ownership of the work?
Our people work inside your environment, on your tools, under your policies and access controls. Confidentiality and ownership of the work are written into the agreement before any access is granted, and access is returned when the engagement ends.
Starter services
AI & Data Assessment Sprint
What does it cost?
We do not publish a number, because the honest answer depends on how many systems and how many teams are in scope, and a figure on a web page would be wrong for most readers. What we do commit to is the shape: a fixed fee agreed in writing before any work starts, no hourly billing, and no change orders for work inside the agreed scope. If the scope genuinely has to change, that is a conversation before it happens rather than an invoice after.
What do you need from us?
Access and some people’s time, and the specifics depend entirely on your setup. We work that out with you and write it into the proposal before you commit, so nobody discovers a hidden burden halfway through. Two weeks is short enough that we are specific about this rather than optimistic.
Can you really do this in two weeks?
For what it promises, yes — and the scope is drawn that way deliberately. Two weeks buys you a scored picture, a ranked gap register, a sized cost view and a sequence. It does not buy you a full financial model or a board paper. We would rather be exact about the boundary than quietly stretch the sprint and miss it.
Do we have to continue with you afterwards?
No, and the deliverables are built on that assumption. Everything is handed over in source and is yours to act on however you choose, including with another firm or entirely in-house. A recommendation you can only act on by rehiring the people who wrote it is not a recommendation, it is a lead magnet.
We already ran an internal assessment. Is this duplicative?
Sometimes, and we will say so before you buy. Internal assessments usually come unstuck on one of two things: the people doing the scoring are the people being scored, or the cost side was never sized, so there is nothing to take to a budget conversation. If yours has neither problem, we will tell you that on the first call rather than sell you a sprint you do not need.
How is this different from the free AI Readiness assessment?
They score the same six dimensions, and that is deliberate. The free one scores what you tell it, in about five minutes, entirely in your browser. This one scores what we find, over two weeks, against your systems — and adds the two things a self-assessment structurally cannot produce: sized costs and findings someone outside your team will accept.
AI & Agent Pilot
What counts as production conditions?
Your real or production-representative data, approved integrations, representative users, agreed security and access controls, and an expected workload. Customer-facing production deployment is included only when it is approved and inside the agreed scope.
From AI & Agent Pilot
When does the two-to-four-week window start?
At kickoff, once the access, data, environment and participant prerequisites written into the proposal are available.
From AI & Agent Pilot
What does the pilot cost?
The fee is fixed in writing before work starts, and depends on the agreed workflow, systems, integrations, user group and environment. The AI & Agent Pilot page gives where fees start.
From AI & Agent Pilot
Which models and platforms do you use?
We are not tied to one model or cloud. Recommendations follow your security requirements, existing technology footprint, workload, quality targets and unit economics.
From AI & Agent Pilot
What if the use case does not meet the success threshold?
That is a valid pilot result. You receive the system, evaluation harness, findings and measured economics needed to stop, revise or redirect the use case rather than scale it on optimism.
From AI & Agent Pilot
Who owns the work?
The engagement is designed for handoff. You receive the source and engagement-specific evaluation assets, subject to the licensing terms of any third-party components used.
From AI & Agent Pilot
Will our data be used to train public models?
The answer depends on the selected enterprise service and contract. Data handling, retention and training terms are documented before build, and the architecture is configured to follow your approved controls.
From AI & Agent Pilot
Data Platform Accelerator
Which platform?
Whichever fits your data, your existing footprint and your team. We work across Microsoft Fabric, Databricks and Snowflake, and the recommendation is not conditioned on an exclusive vendor relationship — it follows the diagnostic. If the decision is already made, the diagnostic tests it rather than reopening it.
What if the diagnostic shows we do not need a new platform?
Then that is the finding, and the engagement is re-scoped around what you do need — which is often a smaller amount of fixing than a rebuild. The diagnostic exists so that decision is made on evidence rather than on the assumption that arrived with the budget.
Is this a migration?
No. It stands up the foundation properly and connects the first sources as the pattern for the rest. A full migration of every source and every workload is the Data Engineering & Platforms practice, and the accelerator is built to lead into it with the pattern already proven.
Who runs it afterwards?
Your team. The runbook is written for them, they are walked through it, and the first pipelines are built the way every subsequent one should be so the pattern is reusable without us. Where you need more hands, that is a separate conversation about staff augmentation, not a dependency built into the platform.
What does it cost?
The fee is fixed in writing before work starts and depends on the number of sources in scope, the state of what already exists and whether the platform decision is made. Work inside that boundary is not billed hourly.
What do you need from us before kickoff?
Access to the existing estate and the cloud account the foundation will live in, the people who own the first sources, and whatever architecture or platform decisions already exist. The specifics are written into the proposal before you commit.
AI Governance Quickstart
Will this slow AI work down?
It replaces an undefined review with a defined one. Work that is currently waiting for an answer nobody can give gets an answer with a date on it.
Does this cover the AI we already have running?
Within the agreed scope, yes. Mapping what is in use there is the first stage, and existing systems are brought under the same path rather than grandfathered around it. An enterprise-wide inventory is a practice engagement, not this one.
Which frameworks do you build on?
The NIST AI Risk Management Framework and ISO/IEC 42001 as the structure, your existing policies as the starting point, and the federal and state requirements that apply to you as the constraint. The path is sized for your organization, not lifted from a standard.
Who writes the policy, you or us?
We draft it, in your organization's voice, from the review path we design together. Your legal, risk and security owners work through it with us until it is ready for their approval. Your counsel reviews it; this is not legal advice and we do not replace them.
What does it cost?
The fee is fixed in writing before work starts and depends on how many AI systems are in scope, how many review functions are involved and how much existing policy there is to build on. Work inside that boundary is not billed hourly.
What do you need from us before kickoff?
Access to the people who currently say yes or no, your existing policies, and a rough list of the AI in the agreed scope. The specifics are written into the proposal before you commit.
Executive AI Workshop
Is this training or facilitation?
Neither. The decisions are yours; the AI judgment, the decision method and the challenge in the room are ours. We tell the team which ideas will not survive contact with their data, their controls or their economics, and why — then help them choose among the ones that will.
Who should be in the room?
The people who will fund and be accountable for the first use case: typically the executive team and the function heads most likely to own it. We agree the list in scoping and keep it small enough to decide.
How long is it?
A working session of several hours, with a short pre-read and a few sponsor conversations before it and a readout after. The exact length is set in scoping from the size of the team and how settled the question already is.
What if the team still does not agree at the end?
Then the readout says exactly what is still contested and by whom, which is the most useful output a divided team can get. Nothing gets funded on the assumption of an agreement that was not reached.
What does it cost?
The fee is fixed in writing before the session, and depends on the size of the team, the preparation required and where the workshop is held. The Executive AI Workshop page gives where most fees land.
What do you need from us beforehand?
The participant list, a few short conversations with sponsors, and whatever strategy, plans or AI activity already exists. The specifics are written into the proposal before you commit.
Cyber Risk Sprint
We have a security programme already. Why this?
Because AI introduces exposure that a programme written before AI arrived does not look for: model behaviour, prompt and data leakage, adversarial input, third-party model dependencies, agents holding credentials. The sprint covers that surface specifically, maps every finding to a control your programme already recognises, and hands the findings to your programme to own. It is built to strengthen the programme you have, not to replace it.
From Cyber Risk Sprint
Is this a penetration test?
No. It is a posture assessment against recognised frameworks, focused on AI and data. Where a technical test is warranted — a red-team exercise against a specific assistant, say — the readout says so, says what it should target, and that becomes a scoped piece of work in the security practice rather than something hidden inside this one.
From Cyber Risk Sprint
Do you need production access?
Read access to configuration, logs and the data flows in scope, and time with the people who own each system. We do not need to run anything against production, and nothing in scope is changed by us. The specifics are written into the proposal before you commit.
From Cyber Risk Sprint
Which frameworks?
The NIST AI Risk Management Framework and ISO/IEC 27001 as the structure, so every finding lands on a control your auditors already recognise. Where you are held to a sector regime — financial services supervisory guidance, for instance — the register carries that mapping too. We use the frameworks you are measured against, not a proprietary one you would have to translate.
From Cyber Risk Sprint
What does it cost?
The fee is fixed in writing before work starts and depends on the number of AI systems and data flows in scope and on whether an inventory already exists. Work inside that boundary is not billed hourly.
From Cyber Risk Sprint
What do you need from us before kickoff?
Whatever inventory of AI systems exists, even an informal one; read access to the configuration and logs of the systems in scope; the people who own them; and the frameworks and regulators you are held to. The specifics are written into the proposal before you commit.
From Cyber Risk Sprint
Industries
Industries
Do you only work in these eight industries?
No. These eight have pages of their own. The work underneath, joining systems, settling the numbers, checking the rules and putting AI into production with an owner, carries across sectors. The Industries page shows where neighboring sectors are covered, and the business priorities start from the decision rather than the sector.
From Industries
Why do two of the pages show results from other sectors?
Because we publish only engagements we can describe, and not every industry has one yet. The Education page presents three results from other sectors as transfer credit, and the Private Equity page files three operating-company results by value lever. Each says so where its evidence starts.
From Industries
Is the rules content on each page legal advice?
No. Each rules section is dated, says who each rule reaches, and links to its source, so your counsel can check it quickly. It shows what is worth evaluating; your counsel decides what applies.
From Industries
How do the industry pages differ from the practice and business priority pages?
They are three ways into the same work. An industry page starts from your sector’s numbers and rules, a business priority from the decision in front of you, and a practice page from the capability, such as data engineering, AI or governance.
From Industries
Can we start with one department, plant, program or deal?
Yes. The first steps on every industry page are scoped to one problem, and none commits you to the next.
From Industries
Healthcare & Life Sciences
Will our patient data leave our environment?
It does not need to. We build in your cloud, on your accounts and under your access controls, and what we build is yours to run. The first diagnostic usually works from definitions, metadata and a sample rather than the full record. Where the work needs protected health information, the agreement that covers it is in place before anyone touches it.
Do you work only with hospitals?
No. We work with hospitals and health systems, other care providers, health plans and insurers, pharmaceutical and life-sciences companies, and digital health companies. The work differs: for providers it is usually workforce, patient flow and the revenue cycle; for health plans and insurers, prior authorization, member service and quality reporting; for pharmaceutical and life-sciences teams, assistants that answer only from approved content.
Our record system and other vendors are adding AI features. Why build anything?
Use what is built in where it fits; it is often the fastest route. We help you decide which features to switch on, govern them like everything else, and build only where a question crosses systems that no single vendor sees, such as staffing against census or denials against documentation.
How do you handle substance use disorder records and other sensitive data?
As data with its own rules. Records covered by 42 CFR Part 2, psychotherapy notes and other sensitive categories are tagged at the source, so access, consent and any later use can follow them. Where de-identified or limited data will do the job, that is what we use.
Does an AI tool that supports clinicians count as a medical device?
It can. Software that informs a clinical decision may fall under FDA oversight, depending on what it does and whether the clinician can review the basis for its output. The work on the Healthcare & Life Sciences page is operational, administrative and commercial; where a tool would inform a clinical decision, we settle the question with your regulatory and clinical leads before anything is built.
Can we start small?
Yes. The free Data Maturity Assessment takes about six minutes. The Assessment Sprint takes two weeks. A first build takes two to four weeks once access and approvals are in place, and ends with a decision to scale, change or stop.
Financial Services & Insurance
Does customer data leave our controls?
No. We work in your cloud, on your accounts, under your entitlements and your third-party risk review, and what we build is yours to run. The first diagnostic usually needs definitions, metadata and a sample, not full customer records. Where the work needs customer information, your vendor and security reviews come first.
Can you work inside our model risk management program?
Yes, and we build for it from the start: the inventory entry, the development documentation, the testing evidence and the monitoring plan your validators ask for, so independent validation reviews a finished package rather than a reconstruction.
Does the new model risk guidance apply to us?
It depends on who supervises you and your size. The banking agencies expect SR 26-2 to matter most for banks with over 30 billion dollars in assets, and generally not for smaller banks’ models unless their model risk is significant; credit unions answer to the NCUA. Whatever applies, a proportionate inventory, testing and monitoring are what auditors, boards and examiners ask about.
Our generative AI is outside the new model risk guidance. Does it still need governing?
Yes. The revised guidance issued in April 2026 leaves generative and agentic AI out of scope for now, and the agencies plan to ask the industry about AI model risk. Until they say more, the questions are the same ones your program already asks: what it is used for, how it was tested, what it must never say or do, and who watches it. The AI Governance Quickstart takes one real use case through that path.
Do you work with insurers and asset managers, or only with banks?
With all of them: banks, credit unions, insurers, and asset and wealth managers. The work differs: for banks and credit unions it is usually fraud, credit and the customer view; for insurers, claims, underwriting and the written AI program; for asset and wealth managers, portfolio data and advisor tools.
Our core and CRM vendors now ship AI. Where does building still pay?
Where a question crosses systems no single vendor sees, such as fraud across cards and deposits, or a household view across products. Elsewhere, use what your vendors ship; it is often the fastest route. We help you decide which features to switch on and bring them under your model risk and third-party risk programs.
What is the smallest first commitment?
Six minutes and no email: the free Data Maturity Assessment. After that, the Assessment Sprint takes two weeks. A first decision through governance, or a first build, takes two to four weeks once access and approvals are in place, and ends with a decision to scale, change or stop.
Manufacturing, Industrial & Utilities
Will anything you build connect to our machines, SCADA or controls?
Only to read, and only by the route your OT team approves: usually the historian, or a gateway in the plant or substation DMZ, never directly to a controller. Nothing we build writes back to controls or sits in a safety function. When a recommendation should change a setting or a switching plan, a person makes the change through your normal change process. For utilities, nothing reaches a system inside a NERC CIP electronic security perimeter without your compliance team’s approval.
Do you work with utilities as well as manufacturers?
Yes: electric, gas and water utilities, on asset health, outage and vegetation risk, load and meter data, and the security rules that come with operational systems. The case studies published so far are from manufacturers.
Our ERP and MES are old. Do we need to replace them first?
No. The food manufacturer in OP 20 kept its MRP; the work added cleaner signals and a layer on top. We read from the systems you run, model the data once, and leave your systems of record where they are.
Our software vendors are adding AI. What is left for you to do?
Switch on what fits; vendor features are often the quickest route. We help you decide which to use and bring them under one policy, and build only where a question crosses systems no single vendor sees, such as downtime set against maintenance history and the production plan, or a forecast that uses orders, market data and lead times together.
One plant has good data and three do not. Where do we start?
In the plant with the data, on one line or one asset group, measured against a number that plant already tracks. What works there becomes the template the other plants connect to, and the gaps in the other three are listed with what it would take to close them.
How soon will a predictive maintenance model show results?
The diagnostic takes two weeks and ends with a go or no-go. After that it depends on how often the asset fails: a press that jams monthly proves a model sooner than a pump or a transformer that fails once a year, which is why the diagnostic checks the failure history first.
How do you handle drawings and data that are export-controlled or CUI?
We find and mark them first, keep them out of anything not cleared for them, and build on systems that meet NIST SP 800-171 where controlled unclassified information is involved. Controlled data stays in your environment and under your access controls, and only people your export compliance program authorizes work on it.
Will operators trust it?
When it explains itself and they had a say. We build with the operators and technicians who will use it, show the reason behind every alert, and leave the decision with them. Supervisors decide what changes in standard work, and training happens on the plant’s own equipment, during the shift.
Do you only work with large companies?
No. The work is sized to one plant, one line, one asset group or one question at a time, so it fits a family-owned manufacturer or a municipal utility as well as a global company. Many start with the Executive AI Workshop or the free Data Maturity Assessment.
Professional Services
Will client documents leave our environment?
No. We build inside your cloud and your document controls, and what we build keeps the permissions and ethical walls you already have. Nothing learns from client documents unless you decide it should, with the consent that takes.
Some clients’ terms restrict AI on their work. Can we still use it?
Yes, where their terms allow, and not where they do not. We start by sorting clients by what their engagement letters and guidelines say, so tools are switched on client by client, and any consent you need is asked for once and recorded.
Our document, practice management and tax software already have AI features. Why build anything?
Use them where they fit; they are often the quickest route. We help you decide which to switch on and bring them under your AI policy, and build only where a question crosses systems no single vendor sees, such as margin across time, billing and staffing, or one view of a client across practices.
Can partners see what an engagement earns while it is running?
Yes. Time, rates, write-downs, staffing and billing are joined by engagement, with the definitions in § 3 agreed first, so partners see utilization, realization and margin while there is still time to restaff, reprice or talk to the client. It usually starts with one practice and the engagements its partners worry about most.
Who is responsible for AI-assisted work?
The professional who signs it, as before. The ABA, the IRS Office of Professional Responsibility and engineering boards say the same thing: AI assists, and the lawyer, the tax practitioner or the engineer of record reviews, decides and signs. We design the review into the tool rather than around it.
Do you work only with law firms?
No. We work with law firms, accounting and tax firms, consulting firms, and architecture and engineering firms. The work differs: for law firms it is usually precedents and billing; for accounting and tax firms, research, returns and audit analytics; for consulting firms, proposals and staffing; for architecture and engineering firms, project margin and standards.
Can we start with one practice?
Yes, and it is usually the right place to begin. A managing partner usually starts with the engagement profitability diagnostic, a two-week Assessment Sprint scoped to that question; a general counsel with the AI-use and client-terms review, run as the AI Governance Quickstart. The free Data Maturity Assessment takes about six minutes. A first build in one practice takes two to four weeks once access and approvals are in place, and ends with a decision to scale, change or stop.
Government & Public Sector
Can you work within our procurement rules?
We set out a first engagement with a defined scope, deliverables and price, so your procurement office can weigh it against your purchasing rules. Before any work begins, we work with procurement on the competitive process, the contracting route, the vendor documentation and the approvals those rules require. Your rules decide the route, not the size of the engagement.
What will our procurement office need from you?
What we set out in a proposal: the scope, deliverables and price; who is responsible for security and data handling; our accessibility commitments; any subcontractors; and how the work is handed over at the end. If your process asks for something else, tell us at the start and we will say plainly whether we can meet it.
Will resident data leave our environment?
It does not have to. We start from your data classification, your approved environments and your security plan, and where they require it, covered data stays in agency-approved infrastructure with access, processing, retention and vendor controls set out. Before anything is deployed, every data flow is written down, logs and backups included, with the approvals each needs. Training a model on resident data, using it to answer a question, and keeping prompts and outputs are three separate decisions, each yours. Where the agency holds criminal justice, federal tax or health data, CJIS, Publication 1075 or HIPAA apply to everyone who touches it, us included.
Our case system is decades old. Does it have to be replaced first?
Usually not. We first check its interfaces, its data quality and the security restrictions on it, and if reading from it will not work, we say so before anything is built. Where it will, we read from what you run, including mainframe extracts, model the data once, and leave the system of record where it is, so replacement can follow on its own schedule and budget.
Do we have to tell residents when they are dealing with AI?
In Texas, for AI systems meant to interact with residents, yes, before or at the start of the interaction. Elsewhere it depends on state law, the use and agency policy, and most agencies choose to say so anyway. We design the disclosure, and the way to reach a person, into the tool.
Are AI prompts and outputs public records?
Often, yes, though it turns on your state’s law and what they were used for. In many states, material made or received in the course of public business is a record whatever tool produced it. We set what is kept, and for how long, with your records officer before anything goes live.
How do we meet the accessibility deadline for dashboards and documents?
Start with what residents use most: the top pages, forms, PDFs and dashboards. Equal access is already required; the rule sets the technical standard from April 26, 2027 for governments of 50,000 people or more and April 26, 2028 for smaller ones. We rebuild dashboards to WCAG 2.1 Level AA, test each one with a keyboard and a screen reader, in a sensible focus order, through the whole journey a resident takes, add text alternatives for charts, and give the data behind each chart a download.
Do you work with cities and counties as well as states?
Yes. One of the two public engagements on the Government & Public Sector page is a major city’s 311 service, the other a state government.
Can a small team keep it running after you leave?
That is the plan from the first week: documentation, training by role, and a handover to named owners, with the tools built on what your team already supports.
Retail & Consumer
Do we need a customer data platform before we start?
No. We start from point-of-sale, loyalty and online order data as they are, match customers well enough to run a clean test, and build the shared customer record as part of the work where it pays for itself.
From Retail & Consumer
How do you prove an offer earned the visit?
With a holdout: a random group of similar customers who do not get the offer. The difference in visits between the two groups is what the offer added. Every campaign we design has one, sized so the result can be read in the weeks the offer runs.
From Retail & Consumer
Are member-only offers caught by the new pricing laws?
Usually not, when the terms are published, open to every member who qualifies and the same for each of them: the three state pricing laws passed in 2026 all allow loyalty discounts on those terms. An offer whose amount is set for one member from their data is another matter, and in New York it may need the disclosure. We map each offer type with your counsel before launch.
From Retail & Consumer
We are a franchise system. Whose data is it?
The franchise agreement decides that. We work from what it says about point-of-sale and loyalty data, build reporting each franchisee sees for their own restaurants, and keep anything shared across the system aggregated where the agreement asks for it.
From Retail & Consumer
Will our customer data train someone else’s model?
No. We build inside your cloud accounts and under your security controls, nothing learns from customer data unless you decide it should, and the AI services are set up so that providers neither keep nor train on what you send them.
From Retail & Consumer
Do chat transcripts and session recordings carry privacy risk?
They can. Several states treat recording a conversation without consent as wiretapping, and lawsuits over website chat and session replay are common. We set consent, disclosure and retention for transcripts before an assistant goes live, and keep only what you need.
From Retail & Consumer
Do you work with restaurant brands as well as retailers?
Yes. Both published results on the Retail & Consumer page are restaurant brands’ loyalty programs: a national quick-service chain and a regional fast-casual brand. The same work applies to grocery, specialty and online retail, and to consumer brands selling direct.
From Retail & Consumer
How soon would we see a result?
An offer test is read in the weeks the offer runs, so the first answer usually comes inside the first cycle. A forecast or promotion model is judged against your own history before it changes an order or a price.
From Retail & Consumer
Education
Can you work with our student information system as it is?
Yes. We read from the systems you run, model the data once, and leave the system of record where it is. Replacing a student system is a decision for another day and another budget.
From Education
Is our student data safe to use with AI?
It can be, though FERPA’s school official exception is only one test. The others are the purpose, who can see what, the vendor’s terms, how long prompts and outputs are kept, the security controls, whether anything trains a model, who handles an incident, and which state law and COPPA apply. We work through each with your privacy officer and registrar, and build inside your environment where your policy requires it.
From Education
Do you work with community colleges and school districts, as well as universities?
Yes. Most of the Education page is written for colleges; districts have their own track in its DATA 230 section, with chronic absence, early screening, special education timelines and state reporting. The rules differ too: districts add COPPA for younger students, state student privacy agreements with every vendor, and in some states a required AI policy.
From Education
What does the accessibility rule mean for our dashboards and course content?
Equal access is already required. The technical standard, WCAG 2.1 Level AA, applies from April 26, 2027 where the government a public college or district belongs to serves 50,000 people or more, and from April 26, 2028 for smaller ones; private colleges answer to other rules. It covers websites, apps, documents, videos and the content in the learning platform. We rebuild dashboards to that standard, check them with a keyboard and a screen reader from start to finish, add text alternatives for charts, and offer the data behind each one as a download.
From Education
How do you keep early alerts fair?
Leaving out race, sex and other protected traits is not enough, because other signals can stand in for them. Before launch the model is tested on your own students, group by group, for the students it misses as well as the ones it flags wrongly. Advisors decide what happens and see why each student was flagged, students can ask about a flag, and every term we check whether outreach and support reach each group equally.
From Education
Can you help with the new federal earnings test?
With the data you have to report: program-level enrollment and completers each October, checked against the Department’s lists, and the cost and outcome data your own program review needs. The earnings themselves come from federal tax data, not from you.
From Education
Do you train faculty and staff on AI?
Yes. Role-based AI and data literacy, built on your own tools and policies, with academic integrity and student privacy part of every session rather than a separate module.
From Education
Can a small IR or IT team keep it running?
That is planned from the first week: documentation, training for the people who will own it, and tools built on what your team already supports.
From Education
Private Equity & Portfolio Companies
Can you work inside the deal timetable?
Yes. Data diligence runs alongside the financial and commercial work, in the data room or in the company’s systems where access is given, and reports in the format the deal team already uses. Two weeks covers one company’s revenue, customer and margin data.
We have no system access before signing. Is it still worth doing?
Yes, with less depth. From the data room’s exports we can test whether the numbers in the CIM can be rebuilt and show where they cannot; access after signing confirms the rest in the first weeks.
How do you keep AI value in the plan honest?
Every initiative is tied to a line already in the P&L, with a baseline and a control group, and its run-rate counts only once it has been measured in production. That is also how a buyer’s quality-of-earnings review tends to look at it.
Can one approach work across very different portfolio companies?
The definitions and the reporting feed are shared; the data work is sized to each company. A distribution business and a software business get different builds, and report the same KPIs to the fund.
Who owns the data and the tools when the company is sold?
The portfolio company. We build in its accounts and under its contracts, so everything transfers with the business and nothing depends on the fund or on us.
Will deal data or investor data train anyone’s model?
No. We work inside your environment or the company’s, under the data room’s confidentiality terms, and the AI services are set up so that providers neither keep nor train on what is sent.
Do you work for the fund or for the portfolio company?
Either, and often both: diligence and portfolio reporting for the fund, the build for the company. The engagement letter says which, so it is clear who the work is for and who pays for it.
Can you help get a company ready to sell?
Yes. The KPIs, cohorts and AI evidence a buyer asks for are built from the systems well before the sale, so the sell-side data room comes together in days and the numbers survive the buyer’s diligence.
Private Executive Bites
Why does Data Products convene these?
The decisions we work on, what to fund, what it will cost and who owns the outcome, are argued best among the people who carry them, before they harden into a budget. The tables give that argument a room; the articles give it back to everyone else.
Who is at the table?
Ten to fourteen senior leaders, most of them operating executives who live with the question, plus one or two voices who sharpen the argument. We never publish a guest list.
Is anything I say attributed?
No. Ideas may leave the room; attribution does not, unless you agree in writing.
Does requesting an invitation guarantee a seat?
No. Tables are deliberately small and curated, so requesting an invitation does not guarantee a seat. It subscribes you to nothing.
What comes out of a table?
An article on the argument the table had, published on the Private Executive Bites page under From the Table. It names no one without their written permission, and it ends with the business question it bears on, such as what AI is worth and what it will cost.
When and where is the next one?
Every announced table is under Upcoming tables: the city and the month are public, and the date and the question go to the invitation list first. Chicago hosts about one table a quarter, with tables in other cities between.
Partnerships
Do partners influence what you recommend?
No. We are model-neutral by policy: the recommendation follows your data, your contracts and your team. We hold partnerships, none exclusive, and take no exclusive vendor incentives.
From Partnerships
Do you work on platforms not listed on the Partnerships page?
Yes. The partners and platforms on the Partnerships page are the ones we lead with. The wider stack lists more of the tools our teams build with, and the practice pages describe the work whatever the platform.
From Partnerships
Can we see work built on our platform?
Yes. The partner pages show the engagements built on each platform, and the case studies describe them in full.
From Partnerships
I sell for one of these partners. What happens after I send an account?
A person from our team replies, and we agree the approach with you before anyone contacts the customer. Nothing you send is added to a mailing list.
From Partnerships
No question matches. Try another word, or ask us directly.
Did we miss your question?
Send it. A person replies, and if others are asking it too, the answer joins this page.
Question not answered here? Ask us; a person replies.