Column: Though Businesses Are Moving Fast to Use AI, There Is Much They Are Still Getting Wrong

North Carolina companies are moving fast on AI adoption and strategy, from Charlotte's banks to the Triangle's tech employers to manufacturers across the Piedmont. The strategic mistakes I see most often in this work are not about the technology but instead about how leadership thinks about it. Below I outline four recurring errors, and the practical fix for each.

• Scale Pilots Before Pressure-Testing Failure Cases

A 60-day pilot program in a controlled environment proves very little about what happens when the pilot scales across the business.

The situations that drive litigation and regulator attention are the edge cases: a customer-service chatbot that quotes a discount the company will not honor, an automated claim or benefit denial that turns out to fall hardest on a protected class of individuals, a sales-enablement AI tool that confidently describes a product feature that does not exist.

A Charlotte hospital system, a Greensboro insurer and a Raleigh fintech all have the same exposure on this point. Before scaling the AI tool, company leadership should run the pilot against the 50 worst plausible inputs, set a risk threshold above which outputs require human review, and put real names next to who owns the review. Human-in-the-loop has to live in the process flow, not in a policy binder.

• Operating Under Vendor Contracts Signed Before AI Tools Were Introduced

Most enterprise software agreements were negotiated two and three years ago, before a vendor that a company works with added AI features through a release note. Today those same terms govern systems that ingest customer financial data, employee performance reviews and possibly protected health information into models the customer never agreed to train.

To the extent the agreement includes a standard data-processing addendum, such addendum may be silent on training rights, output ownership and indemnification for AI-generated errors.

Companies should collate active vendor contracts that touch sensitive or regulated data, flag the contracts where the vendor has shipped new AI features and plan to renegotiate before the auto-renewal date. Do not assume an existing data processing agreement covers AI training.

• Waiting for North Carolina or Federal AI Law

Currently, there is no comprehensive federal or North Carolina AI statute. But that isn't a reason to push off AI adoption.

A company headquartered in Charlotte that sells products in California may already be subject to the California Consumer Privacy Act's rules on automated decisions. A Triangle hiring platform inherits Colorado's AI Act the moment a Colorado candidate applies, as well as New York City's bias-audit rule the moment that applicant is in NYC. A Piedmont manufacturer running a chatbot for European customers is in scope of the European Union AI Act.

The posture of the federal and state government has shifted as well: the Federal Trade Commission and state attorneys general have already brought enforcement actions against companies for deceptive AI claims and unfair automated decisions under existing consumer-protection authority.

Businesses should build their AI program now using accepted frameworks for AI management. Retrofitting your AI program after an incident, with outside counsel, forensic vendors and customer-retention concessions routinely costs many multiples of what it would have cost to build the program in advance.

• Focusing on Customer-Facing AI Risk and Ignoring HR Risk

The headlines always focus on chatbots and image generators. The faster moving legal exposure for North Carolina employers is internal: resume screeners that filter out candidates with employment gaps; performance tools that score remote and in-office workers on different signals; productivity software that captures keystrokes and screen activity in ways that brush up against state wiretapping laws; and interview platforms that quietly evaluate candidates on tone or accent.

The Equal Employment Opportunity Commission has already brought enforcement actions in this area. A North Carolina employer with multi-state hiring inherits whichever state's law is most protective the moment a candidate applies from there. Here, companies should map every workplace AI use, document the testing, and disclose what the law of each candidate's home state actually requires.

The companies getting this right are not the slowest. They are the ones with strong leadership that treat AI deployment with the same rigor they give a new product launch: clear ownership, documented testing, contracts that match the system and a paper trail that holds up to scrutiny.

Attorney Robert Botkin is a partner and AI team services leader at the Parker Poe law firm in Charlotte. He has a bachelor's degree from Florida State University and a law degree from Wake Forest University. This column originally appeared in Business North Carolina.