An AI use case has a defensible case for pilot review when its business value or context is clearly defined and the team can identify an appropriate way to measure risk. NIST’s AI Risk Management Framework states both conditions: the business value or context should be clear, and risk measurement may use quantitative, qualitative, or mixed methods.
This is a case for further examination—not proof that the use case will produce a particular result or is ready to scale.
What evidence should the team bring?
A practical evidence check can cover three questions:
| Review question | Evidence to bring | What reviewers can examine |
|---|---|---|
| Is the intended business value or context clear? | A written description of the business use and its intended value | Reviewers can distinguish the proposed use case from a broader initiative or an undefined AI objective. |
| How will risk be examined? | A proposed risk-measurement approach | The team can explain which quantitative, qualitative, or mixed-method approach fits the questions the assessment needs to answer. |
| What is known, assumed, and unresolved? | A record of available findings, supporting assumptions, and open questions | Reviewers can see which claims require further testing during a pilot. |
The first two elements come directly from the cited NIST criteria. The third is a practical way to make the evidence reviewable; it is not presented as a separate NIST requirement.
Does the team need all three measurement methods?
No universal need for all three follows from the cited wording. NIST describes quantitative, qualitative, and mixed-method tools, techniques, and methodologies as available approaches. A pilot-review submission should therefore explain the chosen approach and why it fits the risk questions being examined.
The framework excerpt does not prescribe a required sample size, scoring threshold, deadline, or automatic approval rule.
What must the team confirm itself?
Before moving the use case forward, the team should confirm that:
- The business value or context is specific enough for reviewers to understand.
- The proposed risk questions are explicit.
- The selected measurement method can address those questions.
- Existing evidence is clearly separated from assumptions that still need testing.
- Any unresolved issues are visible rather than treated as settled.
The team must also assess its particular circumstances. The cited criteria do not establish that one evidence package is sufficient for every organisation or use case, nor do they turn passage into pilot review into a guarantee of performance or outcomes.