Managers are being asked two questions at once. From above: what are we doing about AI. From the team: am I allowed to use this. Answering either one badly is expensive, and most of the material available to help is either a vendor pitch or a warning. This day is neither. It is six hours of decision work, and you leave with documents rather than opinions.
The morning is about matching the technology to your actual workload. You look at where these tools are genuinely reliable, where they need a human check to be usable, and where they should not be near the process at all, using the same failure modes any hands-on user meets. Then you map your own team's work: which tasks are high volume and low risk, which are high stakes and low volume, and which are simply someone's least favourite job. You score a shortlist against effort, risk, data sensitivity and the size of the prize, and you finish the morning with three candidate use cases ranked, and a written reason for the ones you rejected.
The middle of the day is the part that most organisations skip and then regret. You draft a one-page acceptable use policy for your team: what is approved, what needs a second pair of eyes, what is off limits, and what a person must disclose when AI helped produce the work. You classify your own data into what can go into a public assistant, what needs an enterprise or contracted tool, and what should never leave your systems. Sri Lankan organisations work through this alongside Sri Lanka's Personal Data Protection Act; teams handling EU or UK personal data alongside GDPR, and those selling into the EU alongside the EU AI Act. The course shows you what to establish and which questions to put to your legal or compliance contact. It is not legal advice and does not replace them.
You then build the list of questions procurement should be asking a vendor before anything is signed: whether your inputs are used to train their models, how long data is retained, where it is processed, who the sub-processors are, what the audit and logging story is, what happens to your data on exit, and which indemnities are actually on offer for your tier rather than for the enterprise plan in the brochure. You practise it against real product documentation, which is usually where the honest answer is buried.
The afternoon closes on execution. You plan a pilot with a defined scope, a named owner, a baseline measured before anything starts, success measures that are not vanity numbers, a stop rule, and a budget shape that accounts for licences, the time to redesign the process and the review effort that does not disappear. You leave with a scored use-case shortlist, a draft policy, a vendor question set and a pilot plan on one page. Runs live online or in the classroom in Colombo, priced in LKR for Sri Lanka and USD internationally.
