ChatGPT and Generative AI: Capabilities, Limits and Governance

In short: Chatgpt and generative ai is best understood through practical decisions, institutional responsibilities and evidence of results. This guide explains the mechanisms, trade-offs and safeguards that determine whether policies and projects deliver lasting benefits. It updates the earlier Risalat article without treating historical forecasts or unsourced figures as current facts.

ChatGPT and Generative AI: Capabilities, Limits and Governance is not a single solution or a universal recipe. Results depend on the context, the capabilities of implementing organisations and the people affected. The sections below distinguish what is established, what must be tested locally and what project teams can do before making irreversible commitments.

What ChatGPT does and how it works

Language models and conversational interfaces

ChatGPT is a conversational service built around large language models that generate responses from patterns learned during training and subsequent development. It can draft, classify, summarise and help with code, but plausible language is not proof of accuracy.

Practical example: Ask it to summarise a policy document, then verify each important statement against the actual policy. Keep a record of the prompt, source version and human reviewer.

A useful first step is to distinguish the observable condition from its presumed cause. Teams should document who supplied the evidence, which time period it covers and what alternative explanation could produce the same pattern. This makes recommendations more defensible when circumstances change.

Before deciding, identify the decision-maker, the affected users and the cost of being wrong. A small pilot or a review of comparable cases is often less costly than adopting a permanent system on the strength of a presentation.

Multimodal work and tool use

Contemporary AI systems may work with text, images, documents and other inputs, depending on the product and permissions. Some can use connected tools to retrieve information or complete workflows, which changes both their usefulness and their security exposure.

Practical example: A procurement officer can extract requirements from a scanned tender, but should confirm quantities, dates and exceptions directly from the source before publishing.

Implementation should begin with a baseline and a description of the current workflow. Without that baseline, a later improvement may simply reflect different demand, a temporary funding increase or a change in reporting rather than the intervention itself.

Responsibilities should be written in operational terms: who collects the information, who approves an exception and who has authority to stop unsafe or ineffective work. The answer should be visible to staff, suppliers and oversight bodies.

Where generative AI adds value

Administrative drafting and analysis

Public organisations can use AI to prepare first drafts of meeting minutes, public guidance, standard correspondence and briefing structures. Staff time saved is valuable only if the review process prevents fabricated citations and incorrect advice.

Practical example: Pilot AI on anonymised, low-risk correspondence and compare correction time, accuracy and accessibility with the existing process.

Decision-makers need to consider both immediate benefits and downstream obligations. Capital spending is only one part of the cost; training, maintenance, replacement, accessibility and grievance handling may determine whether the investment remains useful.

A credible options appraisal includes a lower-cost alternative and a scenario in which expected demand or performance fails to materialise. Publishing the assumptions makes it possible to revise the plan without hiding the original uncertainty.

Education, software and citizen services

AI can create learning exercises, explain code and assist help desks. It should not be treated as a substitute for teachers, qualified clinicians, caseworkers or formal eligibility decisions.

Practical example: A service desk can offer AI-assisted answers restricted to an approved knowledge base, with escalation to a human for uncertain or sensitive cases.

Evidence should be interpreted at the right level. An improvement for one facility, neighbourhood or organisation may not transfer to another with different infrastructure, staffing, incentives or exposure to risk.

Project managers can test transferability by listing the conditions that made an earlier intervention work and checking whether those conditions exist locally. Where they do not, adapt the design rather than copy the headline result.

Risks that require active controls

Hallucinations, bias and overconfidence

Models can invent sources, misinterpret numerical tables or produce uneven results across languages and groups. A confident answer may be wrong even when the question is simple.

Practical example: Use a test set containing difficult local-language queries, conflicting documents and deliberately missing information. Score abstention and escalation as well as correctness.

Stakeholder engagement is most useful before major choices are locked in. Consultation can uncover operating constraints, informal practices and distributional effects that are absent from administrative data.

Record not only how many people were consulted but which concerns changed the design. Where views conflict, explain the trade-off and the appeal or complaints mechanism in language that affected people can understand.

Privacy, security and intellectual property

Sensitive data entered into an external system may be processed under terms that differ from an institution’s requirements. Uploaded documents can contain personal data, confidential bids or malicious instructions.

Practical example: Before a pilot, approve data classes, retention settings, access rights and incident response. Never upload identifiable patient records or sealed bids without a lawful and secure arrangement.

A useful first step is to distinguish the observable condition from its presumed cause. Teams should document who supplied the evidence, which time period it covers and what alternative explanation could produce the same pattern. This makes recommendations more defensible when circumstances change.

Before deciding, identify the decision-maker, the affected users and the cost of being wrong. A small pilot or a review of comparable cases is often less costly than adopting a permanent system on the strength of a presentation.

Decision checklist:

• Define the problem and the people affected.
• Confirm the baseline and its limitations.
• Compare at least two feasible options.
• Assign a named owner to each major risk.
• Specify a measurable outcome and review date.

How to procure and govern AI

Risk assessment and human accountability

The NIST AI Risk Management Framework and its generative AI profile offer useful structures for mapping harms, measuring performance and managing risks. Accountability remains with the deploying institution.

Practical example: Create an AI use-case register identifying owner, purpose, affected groups, permitted data, reviewer and shutdown procedure.

Implementation should begin with a baseline and a description of the current workflow. Without that baseline, a later improvement may simply reflect different demand, a temporary funding increase or a change in reporting rather than the intervention itself.

Responsibilities should be written in operational terms: who collects the information, who approves an exception and who has authority to stop unsafe or ineffective work. The answer should be visible to staff, suppliers and oversight bodies.

Vendor evaluation and measurable testing

Procurement should examine interoperability, accessibility, information security, model updates, audit logs and exit options. Marketing demonstrations rarely represent day-to-day accuracy on local tasks.

Practical example: Require vendors to demonstrate performance on representative documents and provide a documented process for challenging or correcting outputs.

Decision-makers need to consider both immediate benefits and downstream obligations. Capital spending is only one part of the cost; training, maintenance, replacement, accessibility and grievance handling may determine whether the investment remains useful.

A credible options appraisal includes a lower-cost alternative and a scenario in which expected demand or performance fails to materialise. Publishing the assumptions makes it possible to revise the plan without hiding the original uncertainty.

Государственные ведомства и проекты, финансируемые донорами

Choosing a safe first pilot

Start with a narrow use case where errors are reversible and human review is practical. Define baseline cost and quality before adding automation, and do not scale simply because staff like the interface.

Practical example: A donor project can test AI-assisted project-report drafting using public data, measuring factual corrections and staff hours over a fixed trial.

Evidence should be interpreted at the right level. An improvement for one facility, neighbourhood or organisation may not transfer to another with different infrastructure, staffing, incentives or exposure to risk.

Project managers can test transferability by listing the conditions that made an earlier intervention work and checking whether those conditions exist locally. Where they do not, adapt the design rather than copy the headline result.

Institutional capability and oversight

Effective adoption needs staff literacy, procurement rules, records management and a route for citizens to challenge decisions. Training alone is insufficient if system ownership and budgets are unclear.

Practical example: Build an implementation plan covering policy, training, data governance, evaluation and independent assurance before production use.

Stakeholder engagement is most useful before major choices are locked in. Consultation can uncover operating constraints, informal practices and distributional effects that are absent from administrative data.

Record not only how many people were consulted but which concerns changed the design. Where views conflict, explain the trade-off and the appeal or complaints mechanism in language that affected people can understand.

Worked implementation exercise: Assemble a cross-functional group with a service owner, technical specialist, finance representative and one person able to speak for intended users. Give them a realistic constraint: limited funding, incomplete information and a decision due within one month. Ask each participant to propose one action, one alternative and one reason their preferred option might fail. Agree on the smallest safe test, its budget, the evidence that would justify expansion and the condition that would trigger suspension. At the next review, separate what the team actually observed from assumptions and opinions. Document the reasons for changing course. This exercise is deliberately more demanding than a general awareness workshop because it tests decision rights, evidence quality, operational feasibility and the ability to respond to adverse findings. It can be adapted to an individual facility or a multi-agency programme without pretending that every context has the same constraints.

For ministries and project implementation units, the next step is to convert these principles into a short action plan. Identify one bottleneck, the evidence needed to verify it, the responsible official, the first corrective action and the date on which management will review the result. The Risalat Diagnostic Centre can support a structured initial discussion, while the programme categories provide routes for developing staff capability. Organisations requiring tailored support can request a proposal.

Selected original sources for further verification:

• NIST Generative AI Profile
• NIST AI Risk Management Framework
• UNESCO Recommendation on the Ethics of AI

Часто задаваемые вопросы

What does ChatGPT and generative AI mean in practice?

It means making context-specific choices based on reliable information, clear responsibilities and measurable outcomes rather than relying on a single technology or policy.

How should an organisation begin work on ChatGPT and generative AI?

Establish a baseline, consult affected groups, compare feasible options and assign a decision owner before spending significant resources.

What are the main risks to manage?

Common risks include weak data, insufficient capability, hidden operating costs, unequal effects and lack of accountability for corrective action.

How can project teams measure results?

Use a small set of baseline and follow-up indicators, verify records independently where practical and report limitations alongside achievements.

How can public agencies apply these lessons?

Integrate the approach into procurement, budgets, safeguards, reporting and long-term operations, with named owners and periodic management review.