AX Project Playbook, Part 1 — Strategic AI Use Case Selection and Requirements Definition

The journey towards enterprise-level AI adoption is complex, demanding a structured approach to transform potential into tangible business value. This five-part AX Project Playbook series is designed to guide organizations through this strategic endeavor, ensuring robust planning, development, implementation, and governance. Part 1 focuses on the critical foundational elements: Planning, encompassing the initial project kickoff and comprehensive analysis. Subsequent parts will delve into Development (Part 2), Tools & Multi-Cloud Platform (Part 3), Guardrails (Part 4), and finally, Security, Governance & Operations (Part 5).

AX Project Playbook — all parts
AX Project Playbook, Part 1 — Strategic AI Use Case Selection and Requirements Definition (you are here)
AX Project Playbook, Part 2 — Open-Source AI Integration Patterns for Existing Systems
AX Project Playbook, Part 3 — Securely Connecting AI Agents: A Playbook for MCP Tool Design, OAuth, and Defenses
AX Project Playbook, Part 4 — LLM Guardrails: Essential Design & Red-Teaming for Secure AI Deployments
AX Project Playbook, Part 5 — Essential AI Security Governance: LLMOps, Threat Modeling, and Regulatory Compliance for Go-Live
See the full series (hub) →

This initial phase, structured as a System Integration (SI) project's kickoff and analysis, establishes the bedrock for successful Accelerated Experience (AX) initiatives. The primary deliverables of this phase include a detailed project plan, a comprehensive AI risk register, a precise requirements specification, clearly defined roles and responsibilities, a data classification framework, and a robust use-case scoring sheet. These artifacts ensure alignment, mitigate risks, and set clear expectations for the entire project lifecycle.

AX vs DX

Digital Transformation (DX) has been a primary strategic imperative for organizations globally, focusing on digitizing processes, enhancing operational efficiency, and leveraging data for informed decision-making. Accelerated Experience (AX) represents the next evolutionary step, where artificial intelligence and advanced automation are integrated not merely to digitize, but to fundamentally augment human capabilities, automate complex cognitive tasks, and deliver hyper-personalized experiences at unprecedented speeds and scales.

Where AI Fits (Rule-Engine Else Branches, Manual Review Queues, Document-Heavy Work)

In existing enterprise systems, AI strategically fits into areas ripe for augmentation and optimization. This often includes:

Rule-Engine 'Else' Branches: AI can intelligently handle exceptions or complex scenarios that traditional rule-based engines cannot process, moving beyond predefined logic to infer solutions, significantly reducing manual intervention and improving throughput.
Manual Review Queues: High-volume, repetitive review tasks in areas such as financial transactions, legal document analysis, or security incident triage can be dramatically streamlined by AI, flagging critical items for human review while automatically processing routine cases.
Document-Heavy Workflows: AI-powered Natural Language Processing (NLP) models can automate extraction, summarization, and classification of information from vast unstructured datasets, accelerating processes in legal discovery, customer service, and research.

Use-Case Scoring (Value, Feasibility, Data Readiness, Risk, Reversibility)

Identifying the right AI use cases is paramount for maximizing return on investment and ensuring successful adoption. A structured approach ensures that AI initiatives are aligned with core business objectives and strategic priorities. Each potential use case must undergo rigorous evaluation against a predefined set of criteria:

Value (Business Impact & ROI): Quantifies the potential financial benefits (cost reduction, revenue generation), operational efficiencies, or strategic advantages the AI solution offers.
Feasibility (Technical Readiness & Complexity): Assesses the technical viability, availability of necessary infrastructure, skill sets, and the complexity of developing and integrating the AI model.
Data Readiness (Availability, Quality, Volume, Annotation): Evaluates the existence, accessibility, cleanliness, relevance, and volume of data required for model training and operation. Critically, it also assesses the effort needed for data annotation and preparation.
Risk (Security, Ethical, Operational): Identifies potential security vulnerabilities (e.g., adversarial attacks), ethical concerns (e.g., bias, fairness, transparency), and operational risks (e.g., reliability, false positives).
Reversibility (Ease of Rollback or Manual Override): Measures how easily the AI system can be reverted to a previous state or how straightforward it is for human operators to override or intervene when the AI system falters.

A use-case scoring sheet provides a quantitative framework for comparing and prioritizing potential AX projects:

Criterion	Weight (Example)	Score (1-5)	Weighted Score	Notes
Business Value	30%	4	1.2	High potential for cost savings in X department.
Technical Feasibility	20%	3	0.6	Requires integration with legacy system Y.
Data Readiness	25%	5	1.25	High-quality, labeled data already available.
Risk Profile	15%	2	0.3	Low ethical risk, moderate security risk from data access.
Reversibility	10%	4	0.4	Easy human-in-the-loop fallback.
Total Score			3.75

Open vs Commercial Models and Licenses

Choosing between open-source and commercial AI models is a critical decision. Open-source models, such as Llama 3, Mistral, or Gemma, offer flexibility, transparency, and often lower initial costs. However, organizations must meticulously examine their licenses (e.g., Apache 2.0, MIT, specific community licenses like Llama 2's that might have commercial use clauses), as restrictions on commercial use, redistribution, or modification can significantly impact deployment and intellectual property rights. It is imperative for all organizations to review and understand the full implications of any open-source license before integration. Commercial models, while potentially more expensive, often come with enterprise-grade support, performance guarantees, and pre-trained capabilities. Factors influencing this choice include performance requirements, data privacy concerns, the need for custom fine-tuning, and long-term maintenance costs.

Agree Success Criteria After Measuring a Baseline

Prior to any AI solution development, clearly defined Key Performance Indicators (KPIs) and success criteria must be established. These metrics should be quantifiable and directly linked to the identified business value. Crucially, a baseline measurement of current performance must be captured. This baseline serves as the objective reference point against which the AI solution's impact and ROI will be evaluated post-implementation, ensuring that improvements are measurable and verifiable.

Risk Classification (EU AI Act Tiers, Korea's AI Basic Act High-Impact AI)

The development of an AI risk register is fundamental for managing the unique threats posed by AI systems. This register systematically identifies potential risks, assesses their likelihood and impact, and outlines mitigation strategies. Common AI-specific risks include:

Data Privacy Risks: Unauthorized access to or misuse of sensitive data used for training or inference.
Bias and Fairness Risks: AI models making unfair or discriminatory decisions due to biased training data or algorithmic design.
Hallucination Risks: Generative AI models producing factually incorrect or nonsensical outputs.
Adversarial Attack Risks: Malicious actors manipulating AI models to behave in unintended ways (e.g., data poisoning, model evasion).
Operational Failure Risks: Unforeseen errors, performance degradation, or system downtime impacting business operations.
Transparency and Explainability Risks: Inability to understand or explain AI model decisions, hindering accountability and debugging.

Navigating the evolving landscape of AI regulations is critical. The EU AI Act, for example, categorizes AI systems into distinct risk tiers:

Unacceptable Risk: AI systems deemed to pose a clear threat to fundamental rights (e.g., social scoring by governments) are banned.
High-Risk: AI systems used in critical areas like safety components of products, employment, critical infrastructure, law enforcement, or democratic processes. These require stringent conformity assessments, risk management systems, human oversight, and robust data governance.
Limited Risk: AI systems with specific transparency obligations (e.g., chatbots must disclose they are AI).
Minimal Risk: The vast majority of AI systems (e.g., spam filters), which are subject to minimal or no obligations.

Similarly, the Korea AI Basic Act emphasizes the responsible development and use of AI, promoting ethical principles, safety, and transparency. Organizations must also consider security standards such as the OWASP Top 10 for LLM applications, which highlights vulnerabilities like prompt injection, insecure output handling, and excessive agency, ensuring that AI security is integrated from the design phase.

Roles (RACI)

Clear role definition and accountability are indispensable for the success of any complex AX project. A RACI (Responsible, Accountable, Consulted, Informed) matrix delineates the specific involvement of each stakeholder:

Responsible (R): The individual or team who does the work.
Accountable (A): The individual ultimately answerable for the correct and thorough completion of the deliverable or task. Only one 'A' per task.
Consulted (C): Individuals or groups whose opinions are sought, typically subject matter experts.
Informed (I): Individuals or groups who are kept up-to-date on progress.

Key stakeholders in an AX project typically include Business Owners, AI/ML Engineers, Data Scientists, MLOps Engineers, Security Architects, Legal & Compliance Teams, and IT Operations personnel.

Requirements Categories (ECR, SFR, PER, SIR, DAR, SER, TER, QUR, COR, PMR, PSR)

A detailed requirements specification forms the blueprint for the AI solution, ensuring that all aspects—from business needs to technical implementation and governance—are captured. These requirements can be categorized as follows:

ECR (Enterprise/Business Context Requirements): Define the overarching business objectives, strategic alignment, and the problem AI is intended to solve.
SFR (System Function Requirements): Detail what the AI system must do, including its core capabilities and outputs.
PER (Performance Requirements): Specify criteria for speed, throughput, response time, and accuracy of the AI model.
SIR (Security Requirements): Outline necessary security controls, access management, data protection, and resilience against AI-specific threats (referencing OWASP Top 10 for LLM as appropriate).
DAR (Data Requirements): Specify data sources, formats, volume, quality, and any preprocessing or annotation needs.
SER (Scalability and Elasticity Requirements): Describe the system's ability to handle increased load and adapt to varying demands.
TER (Technical Environment Requirements): Define the necessary hardware, software, platforms, and integration points.
QUR (Quality Requirements): Cover aspects like reliability, maintainability, usability, and robustness.
COR (Compliance and Regulatory Requirements): Detail adherence to legal frameworks, industry standards, and ethical guidelines (e.g., EU AI Act, data privacy regulations).
PMR (Project Management Requirements): Outline project scope, timeline, budget constraints, and reporting structures.
PSR (Post-Implementation Support and Maintenance Requirements): Define ongoing monitoring, updates, troubleshooting, and user support needs.

Deliverable examples for this part

Below are example deliverables for this phase, based on the open-source AX lab. Adapt them to your organization. The full requirements workbook (Excel) is available on the AX Project Playbook hub.

Phase plan and deliverables — SI-style phases — each phase's deliverables are reviewed before moving on

View as a table: Phase plan and deliverables

Phase	Key activities	Deliverables	Related requirements	Course
Kickoff	Confirm scope, organization and schedule; identify AI risks	Project plan, AI risk register	PMR-001, PMR-003	1 Planning
Analysis	Analyze current systems and rule-engine else branches, select use cases, classify data, measure baselines	Requirements specification, role definitions, data classification, use-case scoring sheet	All SFR, DAR-001, PER · QUR baselines	1 Planning
Design	Architecture, permission, interface and guardrail design	Architecture design, API spec (endpoint permissions), page spec (page permissions), interface spec (MCP tool allowlist), security design	SER, SIR, ECR	2 Development · 3 Tools & MCP · 4 Guardrails
Build	Build RAG, verdict API, review queue, MCP server and guardrails; set up the evaluation pipeline	Source code, unit test results, evaluation pipeline	SFR, SIR, SER	2 Development · 3 Tools & MCP
Test	Functional, permission, AI quality, red-team and load testing	Integration test report, permission test report, AI quality evaluation, red-team report	All TER	4 Guardrails
Go-live and stabilization	Hand over to operations, training, monitoring and incident response, certification evidence	Go-live plan, operations manual, AI incident runbook, ISMS-P evidence mapping	PSR, SER-009, COR-003	5 Security & Ops

Role definitions — Who authenticates how, and the most each role can access

View as a table: Role definitions

Role	Description	Authentication	Granted by	Maximum access	Notes
Anonymous	Visitor before login	None	—	/health, login page	No data access
Employee	AI Q&A user	Keycloak OIDC (PKCE)	IdP group sync	Own conversations, own department's documents	Default role
Knowledge manager	Manages department knowledge documents	OIDC + group	Department head approval → IdP	Register and view own department's documents	No delete permission
Reviewer	Approves or rejects AI verdicts (HITL)	OIDC + group	Assigned by business owner	Assigned verdicts	Cannot approve own requests (segregation of duties)
Admin	Policy, model and role settings	OIDC + MFA	Security officer approval	Configuration changes (two-person approval)	Privileged account — periodic review
Auditor	Reads audit logs	OIDC + MFA	Assigned by security officer	Audit logs, read-only	No update or delete API
Service account	Rule engine → verdict API calls	OAuth client credentials	Issued by admin	decisions:write scope	One account per system; key rotation
Agent (MCP)	Calls tools on behalf of a user	User-delegated token (OAuth)	User consent	At most the delegating user's permissions	Write tools need user confirmation

Requirements ③ Environment · Test · Quality · Constraints · Management · Support — Where it runs, how it is verified, what it must respect, and how it is handed over

View as a table: Requirements ③ Environment · Test · Quality · Constraints · Management · Support

Requirement ID	Category	Requirement	Description	Acceptance criteria	Priority	Related design IDs	Verification	Course
ECR-001	Equipment	AI inference environment	Host open-weight LLMs in-house (vLLM in production, Ollama in development). Hardware specified after model selection	Inference requests never leave the internal network	High	API-13	Network egress check	2 Development
ECR-002	Equipment	Data store	PostgreSQL + pgvector. Separate schemas for documents, embeddings, conversations and audit logs	Audit log schema has no permissions beyond application writes	High	API-11	DB permission check	2 Development
ECR-003	Equipment	Authentication platform	Keycloak (OIDC). MFA for admins and auditors	All user authentication goes through the IdP only	High	All ROLE, API-01	Authentication flow test	1 Planning
ECR-004	Equipment	Observability and secrets	Langfuse · OpenTelemetry (internal network); secrets injected at runtime via OpenBao/Vault	No secrets in code, images or env files	High	API-15, PG-08	Secret scan	5 Security & Ops
TER-001	Test	Requirements traceability test	Functional testing based on the requirements traceability matrix	Every requirement has a test result	High	Traceability matrix	Test report	4 Guardrails
TER-002	Test	Permission test	Exhaustive allow/deny testing of roles × APIs and pages	Results match the matrix 100%	High	All ROLE · API · PG	Automated tests	4 Guardrails
TER-003	Test	AI quality evaluation	Golden-set evaluation (Ragas · DeepEval), CI regression tests (promptfoo)	Agreed criteria met, no regressions	High	SFR-001, SFR-004	Evaluation report	2 Development
TER-004	Test	Red-team test	OWASP LLM Top 10 scenarios (garak · PyRIT · promptfoo)	High-risk scenarios blocked	High	SER-005~007	Red-team report	4 Guardrails
TER-005	Test	Load test	Load and fault-injection testing against the PER targets	Agreed targets met	Medium	All PER	Load test report	5 Security & Ops
QUR-001	Quality	Answer quality criteria	Accuracy and grounding targets agreed after measuring a golden-set baseline	Agreed criteria documented and met	High	SFR-001, DAR-005	Evaluation report	2 Development
QUR-002	Quality	Explainability	Record rationale, confidence and model version for every verdict	Zero verdicts without rationale	High	API-08	Sample review	2 Development
QUR-003	Quality	Reproducibility	Version models, prompts and policies; verdicts can be reproduced	Past verdict versions traceable	Medium	API-12, API-13	Version history check	5 Security & Ops
COR-001	Constraint	Licenses	Review commercial-use terms of model and library licenses in advance	Nothing outside the reviewed list is used	High	—	License list review	1 Planning
COR-002	Constraint	Cross-border data transfer	Self-hosting by default; external models only with prior approval and masking	Zero unapproved external transfers	High	API-13	Egress logs	1 Planning
COR-003	Constraint	Regulatory compliance	Review Korea's Personal Information Protection Act and Korea's AI Basic Act (whether it is high-impact AI); for overseas users, the EU AI Act and APPI	Applicability and measures documented	High	—	Legal review	5 Security & Ops
COR-004	Constraint	No changes to existing systems	The rule engine gets only an else-branch call; no structural or data changes	Existing rules pass regression tests	High	API-08	Regression test	2 Development
PMR-001	Management	Phase reviews	Review deliverables at each phase from kickoff to go-live before moving on	Phase review records	High	—	Review minutes	1 Planning
PMR-002	Management	Requirements change management	Change requests, impact analysis, approval, traceability matrix updates	Every change reflected in the traceability matrix	Medium	Traceability matrix	Change history	1 Planning
PMR-003	Management	AI risk management	Run an AI risk register (wrong answers, bias, leakage, misuse)	An action and owner for each risk	High	—	Risk register review	1 Planning
PSR-001	Support	Training	Role-based training for employees, reviewers and admins (review criteria, guardrail policy)	Training completed per role	Medium	All ROLE	Completion records	5 Security & Ops
PSR-002	Support	Handover to operations	Hand over the operations manual, AI incident runbook and monitoring	Operations team confirms handover	High	API-15, PG-08	Handover check	5 Security & Ops
PSR-003	Support	Stabilization support	Tuning and incident support during the stabilization period after go-live (length agreed in the contract)	Stabilization completion report	Medium	—	Completion report	5 Security & Ops

FAQ

Q1: What is the primary difference between DX and AX?

A1: Digital Transformation (DX) primarily focuses on digitizing existing processes and leveraging digital technologies to improve efficiency. Accelerated Experience (AX) extends DX by integrating AI and advanced automation to augment cognitive tasks, enable hyper-personalization, and achieve significantly faster, more intelligent outcomes beyond mere digitization.

Q2: Why is a use-case scoring sheet critical for AX projects?

A2: A use-case scoring sheet provides an objective, quantitative framework to evaluate and prioritize potential AI initiatives based on predefined criteria such as business value, technical feasibility, data readiness, and risk. This ensures that resources are allocated to projects with the highest potential for impact and success, aligning with strategic objectives.

Q3: What are the key considerations when choosing between open-source and commercial AI models?

A3: Key considerations include licensing implications (especially for commercial use of open-source models), total cost of ownership, required performance, data privacy and security needs, the ability to fine-tune or customize the model, and the availability of enterprise-grade support and maintenance.

Q4: How does the EU AI Act impact AX project planning?

A4: The EU AI Act mandates a risk-based approach to AI development and deployment. Project planning must incorporate early risk classification of the AI system (unacceptable, high, limited, minimal risk) to ensure compliance with specific regulatory obligations, including conformity assessments, risk management systems, human oversight, and transparency requirements.

Q5: What role does a RACI matrix play in an AX project?

A5: A RACI matrix clarifies roles and responsibilities by defining who is Responsible, Accountable, Consulted, and Informed for each task and deliverable. This reduces ambiguity, improves communication, streamlines decision-making, and ensures all stakeholders understand their involvement, which is crucial for complex, cross-functional AI initiatives.

The successful initiation of an AX project hinges upon meticulous planning, rigorous analysis, and a clear understanding of both the opportunities and risks involved. By defining precise requirements, evaluating use cases strategically, and establishing a robust governance framework, organizations can lay a strong foundation for transformative AI adoption. Part 2 of the AX Project Playbook will elaborate on the crucial next steps: Development, Implementation, and Prototyping, focusing on the practical execution of these initial plans.

Next: AX Project Playbook, Part 2 — Open-Source AI Integration Patterns for Existing Systems →

Talk to us about your AX project

SeekersLab works with your team SI-style, from choosing the use case and defining requirements to building and running it. If you're considering an AX project, get in touch.

Email: contact@seekerslab.com
Phone: +82-2-2039-8160 (weekdays 09:00–18:00 KST)

Contact us →