Common AI implementation mistakes in Peruvian companies and how to avoid them

An operational review with Peruvian context

EY Peru’s AI & Boards 2026 surveyed 250 board members, shareholders and senior executives associated with seven sectors online between January 12 and March 5, 2026. It identifies knowledge and governance gaps; it does not represent all businesses or micro and small enterprises. [1] The following mistakes are diagnostic questions for your operation, rather than allegations about particular companies.

For each one, find an observable warning sign, estimate the cost and verify the correction with evidence. A persuasive explanation from the assistant does not demonstrate that the process has improved.

1. Starting with a tool while leaving the problem open

A license can create opportunities, but the team needs to know which outcome it must deliver. NIST recommends identifying context and measuring risks throughout the system lifecycle. [2]

• Warning sign: each person describes a different objective for the pilot.
• Cost: scattered effort and results that cannot be compared.
• Correction: select one task, an accountable owner and an accepted outcome definition.
• Evidence: initial cases with documented times, errors and acceptance criteria.

2. Connecting data without resolving its meaning

A CRM may use a customer code that differs from the ERP’s code. Asking a model to guess that relationship leaves a business decision unvalidated.

• Warning sign: prices differ or one customer has multiple identities.
• Cost: incorrect quotations, duplicates and manual corrections.
• Correction: establish identifiers, currency, taxes, freshness and an authorized source.
• Evidence: a reconciled sample with expected outcomes and an owner responsible for updates.

3. Sending sensitive information without reviewing processing

An instruction saying “do not disclose data” does not replace access restrictions or provider terms. OWASP identifies sensitive information disclosure as a risk in these applications. [4]

• Warning sign: complete customer files are uploaded through personal accounts.
• Cost: information exposure and loss of control over its processing.
• Correction: minimize data and review purpose, authorizations, provider and retention.
• Evidence: an inventory of transmitted data, access rights and approved terms.

4. Granting authority to act before controlling the actions

The executing system must enforce authorization. OWASP recommends limiting functionality, permissions and autonomy; high-impact actions need human approval. [3]

• Warning sign: the assistant can modify other users’ records or write without confirmation.
• Cost: incorrect transactions or duplicates on retries.
• Correction: start with read access, limit actions and bind approval to a specific operation.
• Evidence: role-based rejection tests and a retry that creates no second business effect.

5. Evaluating only examples that work well

A fluent answer may omit or invent information. NIST’s profile provides guidance on managing generative AI risks. [2] Turn that review into tests of your process.

• Warning sign: the demonstration avoids ambiguous queries and outdated documents.
• Cost: errors reaching customers or requiring additional review.
• Correction: prepare ordinary, difficult and prohibited cases with independent expected answers.
• Evidence: versioned results, including when the system should abstain or hand off.

6. Teaching buttons while overlooking the real work

The team needs to practice detecting errors, protecting data and asking for help. Knowledge gaps observed by EY provide context for that preparation. [1]

• Warning sign: people accept everything or redo every answer from scratch.
• Cost: rework, informal use and unresolved exceptions.
• Correction: rehearse job-specific tasks, review and handoff to an accountable person.
• Evidence: users recognize an incorrect outcome and follow the correction path.

7. Counting conversations while overlooking the economic outcome

Usage indicates activity. To decide whether to expand, compare resolved cases of similar difficulty and include human effort.

• Warning sign: many queries are logged, but nobody knows the cost of resolving a request.
• Cost: rising spending and unproven benefits.
• Correction: count integration, licenses, consumption, review, support and rework.
• Evidence: total time, errors and cost per accepted case compared with the initial process.

How to choose the first correction

Prioritize consequences. If the system exposes information or changes records without authorization, restrict those functions first. If an incorrect source is the problem, correct the data before adjusting instructions. If nobody can demonstrate value, narrow the pilot and establish a baseline.

Checklist before expanding use

• Task, accountable owner and accepted outcome defined.
• Current sources, reconciled identifiers and reviewed permissions.
• Tests for errors, unauthorized access and human handoff passed.
• Complete cost, support and return to the previous process understood.
• Feedback recorded and reassessment after changes.

In Peru, review the framework of Law No. 31814 and its regulation alongside Law No. 29733 and its personal data protection regulation. Applying requirements involves considering the specific use case and relevant deadlines. [5] [6]

If you use Dova to prepare data, its documented Mapping, Session, Workflow and Monitor journey provides a way to verify an integration run. [7] Compare output with expected results. That foundation does not replace assistant evaluation or guarantee an economic return.