Generative AI has moved from research curiosity to business reality in under two years. Every major organization is now asking: what does GenAI mean for us? The CDO's role is to move beyond the hype and deliver answers based on real capability assessment, not vendor promises or press releases.
Large language models (LLMs) are trained on vast text corpora to predict the next tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → in a sequence. From this simple objective emerges a broad set of capabilities:
Summarization: Condensing long documents (contracts, reports, research) into structured summaries. High reliability, immediately deployable.
Classification: Categorizing text (customer complaints by type, emails by priority, documents by topic). Can match or exceed fine-tuned classical ML with careful prompting.
Generation: Writing first drafts (marketing copy, product descriptions, code, emails). High speed, variable quality, always requires human review for brand-sensitive content.
Extraction: Pulling structured information from unstructured text (extracting dates from contracts, addresses from emails, clinical data from notes). High value in document-heavy industries.
Question answering (RAG): Answering questions grounded in a specific knowledge base using Retrieval-Augmented Generation. The model retrieves relevant documents, then answers based on them. Enables "chat with your documents" use cases.
Code generation: Writing, completing, reviewing, and debugging code. GitHub Copilot productivity gains of 20-30% have been validated in controlled studies.
Knowledge check
1. What fundamental limitation of large language models does Retrieval-Augmented Generation (RAG) primarily address?
2. In the RAG architecture, what is the correct sequence of operations when a user asks a question?
3. According to the lesson, what should guide a CDO's assessment of generative AI capabilities?
4. Select ALL statements that correctly describe generative AI capabilities as presented in the lesson.
Select all the correct answers.
5. Select ALL tasks that the lesson identifies as capabilities of large language models.
Select all the correct answers.
Retrieval-Augmented Generation (RAG) is the most important GenAI pattern for enterprise use cases. It solves the LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition →'s fundamental limitation: the model's knowledge is fixed at training time, and it hallucinates when asked about information it wasn't trained on.
RAG works in two steps:
1. Retrieval: When a user asks a question, search your knowledge base for relevant documents/passages (using vector similarity search)
2. Generation: Pass the question and retrieved documents to the LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition → as context; it answers based on the provided documents
The result: a model that knows everything in your knowledge base, not just what was in its training data. Up to date, grounded in your specific information, with citations to source documents.
Use cases: internal knowledge management (employees query HR policies, product documentation, past projects), customer-facing support (queries answered from product documentation and FAQs), contract review (flag non-standard clauses by comparing against standard templates).
Generative AI introduces risks that traditional ML doesn't:
Hallucination: LLMs confidently generate false information. In a customer-facing application, hallucinated legal or medical information could create liability. Mitigation: RAG (grounds responses in verified documents), output review for high-stakes applications, uncertainty signals.
Prompt injection: Malicious input designed to override the system's instructions. Example: a user crafts a query that causes the model to ignore content filters. Mitigation: input validation, sandboxed execution, defense-in-depth.
Data privacy: Sending sensitive data to a third-party LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition → APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → (OpenAI, Anthropic, Google) means that data leaves your environment. Mitigation: private deployment (on-premise or private cloud), data anonymization before APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings. calls, vendor DPA agreements.
Bias and fairness: LLMs inherit biases from training data. In HR or lending applications, biased outputs create legal exposure. Mitigation: human review for high-stakes decisions, bias auditing, diverse evaluation datasets.
Brand and reputational risk: Customer-facing GenAI applications can produce outputs that are accurate but inappropriate, or inaccurate and damaging. Mitigation: output filters, human review, limited initial deployment scope.
A GenAI governance framework for enterprise:
Tiered deployment approval: Low-risk internal use (summarization for employees) → expedited approval. Customer-facing applications → full review including legal, compliance, and brand. High-stakes decisions (lending, hiring, medical) → explicit risk assessment and regulatory review.
Acceptable use policy: What can employees use GenAI for? Personal devices vs. corporate-approved tools? Handling of confidential information? A policy that employees understand and follow.
Vendor assessment: For any LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition → APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition →, assess: Where is data processed? What are the data retention policies? Is there a DPA? Is the model auditable?
Output monitoring: For production applications, monitor output quality, user satisfaction, and error rates continuously. GenAI applications degrade differently from classical ML, usually through quality drift, not accuracy drift.
1. Qu'est-ce que le RAG (Retrieval-Augmented Generation) permet principalement dans un contexte enterprise ?
A) Il rend les LLMs plus rapides
B) Il permet au LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition → de répondre en se basant sur votre base de connaissances spécifique (pas seulement ses données d'entraînement), réduisant les hallucinations
C) Il réduit les coûts d'inférence des modèles
D) Il améliore la qualité du code généré
Réponse: B
2. Quel est le principal risque du "prompt injection" dans une application GenAI ?
A) Le modèle génère des réponses trop lentes
B) Une entrée malveillante conçue pour contourner les instructions système du modèle, potentiellement désactivant les filtres de contenu
C) Le modèle consomme trop de tokenstokensA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition →
D) Les réponses contiennent trop d'hallucinations
Réponse: B
3. Dans un framework de gouvernance GenAI par niveaux, quel type d'application nécessite une revue légale et compliance complète ?
A) Résumé de documents internes pour les employés
B) Génération de code pour les développeurs
C) Applications customer-facing et toute décision à enjeux élevés (crcrThe percentage of visitors or prospects who complete a desired action (purchase, sign-up, contact form), calculated as conversions divided by total opportunities.View full definition →édit, embauche, médical)
D) Traduction de documents internes
Réponse: C
These actions are compiled in the role's Playbook.