Four questions every executive should ask before approving an AI project

Most AI projects are approved on a demo. The questions that decide whether a project pays off, stays safe and stays affordable are rarely asked at that stage. Here are four, in plain terms, each grounded in something published this year.

1. How will we know it worked?

This sounds obvious, and it is where most projects are weakest. Battery Ventures' 2026 enterprise spend survey found that 53% of enterprise technology leaders see clear ROI from some AI investments, but only 6% have a well-defined framework that tracks ROI consistently across the organization ^[1].

A good answer names one metric, a baseline measured before launch, and a date to review it. In the same survey, cost savings (76%) and time saved (73%) were the most common measures, while only 38% tracked revenue attributed to AI ^[1]. If a proposal cannot name its baseline, it is not ready.

2. Where does our data go, and how long is it kept?

Terms differ by model, and they change. As one concrete example, Anthropic's documentation for its Claude Fable 5.1 model states that it requires 30-day data retention and is not available under zero data retention arrangements unless Anthropic expressly authorizes it; a request from a workspace without 30-day retention returns an error ^[2]. That is one vendor and one model, not a rule for the industry. The point is that retention terms can decide whether a model is usable for sensitive data at all, so confirm the retention settings per model before design begins.

3. What is the system allowed to do, and as whom?

A chatbot that only answers questions has a small blast radius. An agent that can call tools, read files or send messages inherits whatever credentials it is given. The Cloud Security Alliance's guidance on tool-server security recommends per-server, least-privilege credentials, sandboxing of anything that can execute commands, and an explicit policy layer between servers instead of reliance on the agent's own judgment ^[5]. The executive question is simple: list the actions this system can take, and the account each action runs under.

4. What will it cost at volume?

Price per million tokens is the number on the vendor page. It is not the bill. Take Google's Gemini 3.8 Flash. According to one independent write-up, the standard paid rate through December 31, 2026 is $0.75 per million input tokens and $3.75 per million output tokens, and every rate doubles on January 1, 2027. The same write-up notes that output pricing includes thinking tokens, and that Google's own launch post says the model may use more tokens to maximize performance ^[3].

So a budget needs three inputs, not one: expected volume, expected tokens per task (which varies with how hard the model "thinks"), and the price after any introductory period ends. Ask for a cost-per-completed-task estimate from a real pilot, not a price-per-token calculation from a spreadsheet.

Putting it to use

Bring these four questions to the next project review and expect written answers. A project that can state its metric, data retention settings, permissions and unit cost is usually ready to proceed; one that cannot is usually missing something more basic than the model.