What raising a puppy taught me about GenAI controls
Oisín (pronounced Ush-Sheen) was a shy, four-month-old black Labrador with the kind of eyes that made you feel like you were his whole world. I thought the hardest part was over, the waiting and that now he would fit into what I needed instantly. I was wrong. Loyalty and stability don’t come built in. You earn them by training, patience, learning and setting controls around the what the dog needs to be a success. That’s when I realized that having a dog and implementing AI are not very different.
Why?
Because the way I started raising Oisín is the same way organisations adopt new tools, with big promises, we fall in love with the outcome and skip the controls it takes to earn it.
- GenAI isn’t dangerous when it’s obviously wrong
- It’s most dangerous when it sounds right.
Day 3 The honeymoon phase
When Oisín first arrived, he was perfect in my eyes. He followed me around the apartment like a shadow. He looked up at me as if I was the centre of his world. I remember thinking, “This is it! This is exactly what I needed”.
There’s a rule for bringing home a dog called the 3-3-3 rule: 3 days to decompress, 3 weeks to learn the routine, and 3 months to feel at home. New technology works the same way; confidence should grow over time.
When something works, you stop thinking about how to manage it. You start treating it like the solution. Teams react the same way when GenAI “works” for the first time. Someone runs a prompt across a pile of documents and gets a clean summary, a list of themes, even a quick detailed timeline. It looks structured because it’s working on material you already understand.
The first good output is the most dangerous one. It teaches the team to stop being sceptical.
This is where treating GenAI like a puppy comes into play and you keep an eye on your rug in case of accidents. Keeping it in safe lanes where mistakes won’t drive decisions but can be corrected. Use it for summaries, clustering and issue spotting. Avoid using it for relevance or privilege until it’s been tested in a repeatable way. If the team can’t point to the exact text that supports an output, then that output shouldn’t guide judgement.
GenAI Controls:
- Rule: GenAI can assist early thinking, but it cannot make decisions.
- Use GenAI only in low-risk areas first: summaries, clustering, issue spotting, basic timelines.
- No decision-making: no relevance calls, no privilege calls, no final conclusions until all controls are in place and able to verify.
- Evidence rule: if the output can’t be traced to specific text, treat it as unverified.
- Start a prompt log: write down the exact prompt and settings used (so results are repeatable).
Week 3 Early wins (Trust drift)
After a few weeks, I started feeling like I understood Oisín. He learned “sit” “wait” “stop” everything started to click, we were at zero accidents at home, and I felt pride in it going well.
Then I made a classic mistake. I was on a client call and gave him a lick mat with liverwurst, something that had worked perfectly for weeks. Now, I looked away for a minute and by the time I turned back a large chunk of the mat was missing. He’d swallowed it. The vet visit and bill were a valuable lesson.
My mistake here was I hadn’t realised that my confidence grew faster than his consistency. I began believing if he did something right once, he would do it right every time. That’s how GenAI overconfidence starts to show up in review workflows. The tool performs well. The team begins moving faster through the review and that’s exactly when quality checks (QC) start to slip. Reviewers read the summary before the document. Teams trust the “key points.”
This is where QC doesn’t break, it just quietly gets skipped.
GenAI hasn’t replaced judgement overnight. Its replaced the habit of verification.
The control here is to stop trust drift before it becomes culture.
GenAI Controls:
- Rule: No document is coded based on a summary alone.
- Summary is not greater than the source: reviewers must read the document before coding.
- Double-check requirement: any “key point” must be confirmed in the source document.
- Introduce sampling early: spot-check outputs to measure performance (not vibes).
- QC stays mandatory even when speed improves don’t let pace delete verification.
Month 3 The silent failure
The next lesson Oisín taught me wasn’t when he barked. It was when he went quiet. If you’ve lived with a puppy, you know the moment. You’re in another room and it goes too quiet. No noise. No movement. You think, great, he’s settled. Then you remember you own a Labrador.
You rush into the room and he’s chewing something dangerous with focus and pride, like it’s his job. That’s when it clicked for me: silence isn’t safety. Silence hides problems. GenAI fails in the same way. The risky outputs aren’t the obvious hallucinations, those stand out. The risky outputs look correct. A summary misinterprets one sentence that flips the meaning. GenAI isn’t actively aiming to lie. It just produces a coherent version of events that feels easy to accept. In eDiscovery, “coherent” is not the goal, defensible is.
The control to put in place at this stage is to force proof for quiet errors. Keep GenAI outputs tied to evidence. If it produces a timeline point, it should point back to the specific email or text that supports it. If it can’t, treat it as unverified. This is also where targeted Quality Checks matter the most. You don’t need to check everything. You do need to check the area’s most likely to cause silent harm, such as key custodians, critical dates, and documents that shape strategy.
GenAI Controls:
- Rule: If GenAI can’t show the supporting text, the output is unverified.
- Source-linking requirement: every timeline event/theme should point back to the exact email/text.
- Targeted Quality Checking (high impact zones):
- key custodians
- critical dates
- documents shaping strategy
- Assume “quiet wrongness” exists: the job is to detect it before it becomes the narrative.
Part 2 – Next month in the new GCN Newsletter….!
