Shipping AI, Without the Surprises.

The first Field Guide, AI, Without the Hype¹, covered what Artificial Intelligence (AI) is. The second, Building With AI, Without the Guesswork², covered how to build with it. This third one covers what happens after the work ships, when it meets people who never saw the brief: a regulator, a search page, a shopping assistant, a stranger with bad intentions, and eventually the client's finance team. Nine explainers sit behind these eight chapters. Each opened on a question someone asked out loud, and nearly every one of those questions is cheaper to answer before launch than after. So read this as the list to run through at kickoff. Each chapter names the surprise, shows what the evidence supports, and points back to the explainer that has the detail.

1. What goes in

Two choices shape how an AI feature behaves long before anyone outside sees it: which model runs it, and what that model gets to read. Both reward the same instinct. Start small. The first is size⁴, and inside one model family the price gap is already five to one: Anthropic lists its smallest Claude model at one dollar per million input tokens and its largest at five¹². The second is context⁷, meaning the instructions, documents, tools and history the model sees when it answers. Anthropic treats that as a finite resource with diminishing marginal returns¹³. Pour in everything and the answer can get worse.

• •Small models have closed a surprising amount of ground. The smallest model to clear 60% on a broad knowledge test went from 540 billion parameters in 2022 to 3.8 billion in 2024, a 142-fold reduction¹⁴.
• •Trying the cheap model first is a proven design. Stanford's FrugalGPT sent each query to cheaper models before escalating, and matched the best single model with up to a 98% cost reduction¹⁵.
• •Where a fact sits changes whether it gets used. Models handle information at the start and end of a long input better than in the middle, even for explicitly long-context models¹⁶. A key fact buried halfway down can be walked straight past.

2. Who gives the orders

An AI feature that reads outside content can be steered by it. Prompt injection¹¹ is the name for instructions planted in that content, and Anthropic describes them as adversarial instructions hidden within the content that AI models process¹⁷. The Open Worldwide Application Security Project (OWASP) puts prompt injection¹⁸ first on its list of risks for apps built on a Large Language Model (LLM). The reason it works ties back to chapter one. Your instructions, a retrieved web page and a customer's email all arrive in the same stream of text, so a sentence that sounds like an order can be taken as one, whoever wrote it.

• •Nobody claims a cure. OpenAI writes that prompt injection is unlikely to ever be fully “solved”¹⁹, and OWASP says no reliable prevention mechanism exists today¹⁸.
• •Defenses cut the odds. None closes them. In Anthropic's own browser-agent testing, an attacker still got through about 1% of the time against its latest model and safeguards, a result the company says still represents meaningful risk¹⁷.
• •The worst case depends on reach. Simon Willison's lethal trifecta²⁰ is private data, untrusted content and a way to send things out. Take one of the three away and that particular path to stolen data is gone.

3. Saying it was AI

The first surprise from outside is legal. In 2026 three governments wrote AI disclosure into law, and the labeling explainer³ maps all three. The European Union (EU) AI Act's transparency rules apply from August 2, 2026²¹: providers must mark generated content so it is detectable as artificially generated²², and deployers must clearly label²² deepfakes. California's AI Transparency Act reaches generative systems with over 1,000,000 monthly²³ users. New York now requires an advertiser who knows an ad contains a synthetic performer²⁴ to conspicuously disclose²⁴ it. None of this replaces counsel on a live campaign.

• •Most agencies use these tools; few build them. California's duties to label output and offer a free detector fall on the provider of a system that size, which is usually the tool vendor.
• •The fines are modest. New York's runs $1,000 for a first violation and $5,000 for each after, per its synthetic performer law²⁴. The bigger bill is re-cutting an ad after it has already run.
• •Key words are still loose. New York leaves “conspicuous” undefined, and the EU's “clearly” will be settled by Commission guidelines²¹ and early practice.

4. Proving where it came from

A label tells the audience AI was involved. A content credential⁵ is the record underneath it: signed metadata in the file saying who made it, when, with what tool, and whether AI generated or altered it. The open standard is the Coalition for Content Provenance and Authenticity (C2PA). The big generators already write provenance by default. OpenAI attaches C2PA Content Credentials to the images its models generate²⁵, and Google embeds a SynthID watermark²⁶ in the images, audio and video its models make.

• •A signature makes tampering visible. Change the file and the signed record stops matching, so a checker can flag it.
• •Metadata falls off in transit. A screenshot or a re-encoding upload can strip the credential while the picture looks identical. Watermarks written into the pixels are the paired method, and SynthID is built to survive cropping, filters, and compression²⁶.
• •The National Institute of Standards and Technology (NIST) treats provenance, watermarking and detection as complementary approaches to content transparency²⁷. Each fails in a different place, which is the argument for using more than one.

5. The face and the voice

Cloning a face or a voice now takes minutes of footage. Whether you may run the result in an ad is a question the software never asks, and California and New York now answer it in statute, as the likeness explainer⁹ sets out. Both states went after the contract. In California a digital-replica clause is unenforceable when it does not include a reasonably specific description of the intended uses²⁸ and the performer had neither a lawyer nor a union agreement covering replicas. New York voids the same kind of clause²⁹ on the same conditions. What counts as a replica is whether an audience would take it for the person: California asks if it is readily identifiable²⁸, and New York whether a layperson would not be able to readily distinguish²⁹ it from the real one.

• •Death does not free the likeness. An unauthorized replica of a deceased personality costs the greater of ten thousand dollars ($10,000) or the actual damages suffered³⁰ in California, and the greater of two thousand dollars or the compensatory damages³¹, plus profits, in New York.
• •An invented spokesperson has nobody to license, and it brings a disclosure duty. New York's advertiser must conspicuously disclose²⁴ the synthetic performer in the ad itself.
• •This is state law. A national campaign reaches California and New York by default, so the strictest rule your media plan touches is the one to work to.

6. When machines read you first

More and more, the first audience for a client's work is software. On Google, an AI Overview now answers many questions above the links, written from the same pages that rank⁶. Google says its AI features rely on our core Search ranking systems to retrieve relevant, up-to-date web pages³². A Pew Research Center study found that a search showing a summary led to a click on a traditional result in 8% of visits, against 15% when no summary appeared³³. A page can hold first place and still lose the visit.

Shopping is heading the same way. When a shopper asks an assistant what to buy, what gets picked⁸ depends on what the model can read. OpenAI says ChatGPT's product results are organic and unsponsored³⁵, surfaced when the model perceives it to be relevant to your intent³⁶ and assembled from structured metadata³⁶: the feeds, catalogs and pages it can parse. A product whose data the model cannot read has little chance of making that list, however loud its advertising.

• •Google disputes the traffic story. Its Search lead says total organic clicks are relatively stable year-over-year³⁴, without publishing figures. Weigh that against the independent counts before a forecast rests on it.
• •Clean product data is the price of entry. OpenAI asks merchants to share your product feed³⁷, and Google added dozens of new data attributes³⁸ to Merchant Center for discovery.
• •Paid placement is coming in its own lane. Google is continuing to test ads in AI Mode³⁸, kept apart from the organic results, so plan for a paid track beside the earned one.

7. Proving it paid off

Sooner or later the client asks whether it was worth it. What holds up is a number measured against what came before¹⁰, after the running cost comes out, and it is usually smaller than the vendor's slide. When Stanford's AI Index looked at what companies report, firms that saw savings mostly reported cost savings of less than 10%³⁹. Where revenue rose, the most common level of revenue increases is less than 5%³⁹.

• •On well-suited work the lift is real. In a Boston Consulting Group (BCG) field experiment, consultants using AI completed tasks 25.1% more quickly⁴⁰ and produced 40% higher quality results⁴⁰ than a group working without it.
• •On the wrong work it backfires. Given a problem built to sit outside the model's competence, the consultants who leaned on AI did worse⁴⁰ than those who did not.
• •Measurement is a schedule. NIST's risk framework says AI systems should be tested before their deployment and regularly while in operation⁴¹.

8. The agency playbook

Seven chapters share one pattern: every surprise in them is cheaper to handle before launch than after. So the playbook moves the questions to the front, in the order the work meets the world. Decide what the model sees and how big it needs to be. Limit what a fooled feature can reach. Settle labels, credentials and consent while the edit is still open. Make the work legible to the machines that read it first. And write down the before, so the result can be shown.

• •Write disclosure and likeness into the statement of work (SOW), with a named approver for each. Flagging the exposure is your job. Deciding is the client's, with their counsel.
• •Ask every vendor the same short list: which model runs where, what outside content the feature reads, what it can do if that content fools it, and which steps a person approves.
• •Report what still carries intent. Informational sessions will fall. Citations, branded demand and conversions tell the client how the work is doing.
• •Book the measurement as part of the job, with a baseline before build and a reading date after launch. It turns “we think it helped” into a number the client can take to their own boss.