How can we map where AI is influencing decisions and customer experience?

Why AI influence is often wider than the approved tool list

Most firms do not discover AI influence by looking only at the systems procurement has approved. AI can appear inside CRM notes, marketing personalisation, document review, call summaries, analytics dashboards, workflow routing, support triage and staff productivity tools. Some of that use may be helpful and low risk. The governance problem is that leaders cannot control what they cannot see.

The practical question is not whether every AI touchpoint is dangerous. It is whether the firm can explain where AI affects decisions, what data it uses, who reviews the output, and what evidence is kept when a customer, client, regulator or board asks how a decision was made.

The safest answer is an AI influence map with named controls

Build an AI influence map that links each tool or feature to the decision it supports, the customer or client outcome it may affect, the data it touches, the human owner, and the review evidence retained. Treat embedded AI features and informal staff usage as part of the same map, because both can affect judgement and customer experience.

A useful first pass should separate three categories: internal productivity with no client data, assisted professional or commercial judgement, and customer-facing decisions or communications. The second and third categories need stronger controls: confidentiality checks, quality review, escalation routes, model or vendor risk notes, and a retained audit trail.

Find AI touchpoints with an AI Risk & Efficiency Audit

What to include in the inventory

Start with the places where decisions are already made, rather than with a blank technology spreadsheet. For each business process, ask whether AI is summarising, ranking, recommending, drafting, scoring, routing, detecting exceptions or changing what a person sees first. That catches quiet influence in customer experience, sales prioritisation, operations, knowledge work and professional review.

• Workflow: the process, team and decision being supported.
• Tool or feature: approved product, embedded AI feature, automation, model or staff-used assistant.
• Data: customer, client, matter, financial, behavioural or confidential data touched by the workflow.
• Output: summary, recommendation, classification, draft, score, next action or automated response.
• Human review: who checks it, when they can override it, and what happens when confidence is low.
• Evidence: logs, reviewer notes, version history, decision rationale and exception records.

How to prioritise customer experience risk

Prioritise any AI influence that changes access, price, advice, service speed, tone, eligibility, complaint handling, financial outcome, legal position or professional recommendation. These are the areas where a weak control can create unfair treatment, confidentiality problems, poor advice, or inconsistent customer journeys.

For professional services firms, the same map should connect to accountability. If AI drafts a client note, analyses a matter, reviews evidence or prepares a recommendation, the named professional owner still needs to understand the basis of the output. Human review is not a rubber stamp. It should be visible in the record and strong enough to catch errors, bias, missing context and unsupported conclusions.

Turn the map into an operating model

Once the main touchpoints are known, assign each one a simple status: approved, approved with controls, needs remediation, or prohibited. Then set minimum standards for each status. For example, an approved customer-facing use case might require a named owner, data protection check, vendor risk note, test evidence, reviewer training and monthly exception review. A prohibited use case might include confidential client uploads into an unapproved public tool.

Keep the operating model practical. A small firm does not need a heavy committee for every prompt. It does need clear ownership, plain-English policy, repeatable review points and a way to prove that the policy is being followed.

Keep AI governance current with a retainer

Implementation steps for a first 30 days

In the first month, focus on discovery and control design rather than perfect documentation. Interview process owners, review SaaS settings, sample customer journeys, check staff tools, and trace decisions from input to output. Where evidence is missing, create the lightest record that would let a reviewer reconstruct the decision later.

1. Pick the highest-impact client or customer journeys.
2. List every system, assistant and automation used in those journeys.
3. Record what each AI touchpoint sees, produces and influences.
4. Score each item by data sensitivity, decision impact and review strength.
5. Fix the highest-risk gaps first: unapproved tools, no reviewer, no evidence, or unclear accountability.

Conclusion

Knowing where AI influences decisions and customer experience is a governance baseline. The output should be a living map, not a one-off spreadsheet: it should show the current AI touchpoints, the controls around them, and the evidence that people remain accountable for the decisions that matter.

Implement the controls around high-risk AI workflows