Decision and owner
Name the operating decision, sponsor, workflow owner, technical owner, risk approver, and final decision authority.
Treat the pilot as a controlled business decision, not a model demonstration. Fix one workflow, its baseline, authority boundary, evidence set, acceptance thresholds, and decision owners before testing begins.
By Onyx Devs Lab · Published · Updated
A credible pilot makes the decision boundary explicit enough that a polished demo cannot move the goalposts.
Name the operating decision, sponsor, workflow owner, technical owner, risk approver, and final decision authority.
Record users, frequency, current cycle time or quality, systems of record, included cases, exclusions, and the counterfactual.
Separate read, recommend, draft, approve, and execute rights; map personal data, retention, access, cross-border movement, and prohibited uses.
The final decision should be reproducible from evidence rather than confidence or presentation quality.
Use representative common, edge, high-impact, missing-data, and adversarial cases with metric definitions and minimum thresholds.
Measure latency, cost, availability, failure recovery, audit completeness, overrides, escalations, and user adoption in the complete workflow.
Record scale, redesign, hold, or stop; list unmet gates, accepted residual risks, conditions, accountable signatories, and the next review date.
Approve the problem, baseline, data, authority, evaluation set, thresholds, owners, timeline, and stop conditions before build.
Test the complete workflow with controlled users and preserve versions, inputs, evidence, failures, interventions, and costs.
Mark each criterion pass, fail, inconclusive, or not tested; do not hide severe failure behind an average score.
Scale only the approved authority tier; otherwise redesign, hold, or stop with a documented reason and evidence owner.
These are the primary regulator materials used by this implementation guide. This page is not legal advice.
No. A demo may establish technical possibility, but acceptance also needs representative quality, data and authority controls, operational reliability, human review, and a defensible business measure.
No. Thresholds should follow task consequence and risk. Averages must not compensate for a failed privacy, permission, safety, or other mandatory gate.
No. It is a provider-authored implementation template grounded in public Hong Kong guidance. Adapt it with your legal, privacy, security, risk, procurement, and sector specialists.
We will first clarify the workflow, evidence, data boundary, and outcome standard before recommending the next step.
Contact Onyx