Applying AI inside a design thinking process for your team

Two people reviewing sticky notes on a whiteboard, with a laptop open beside them
TL;DR

AI can speed up the ideation and prototyping stages of design thinking for small UK teams, generating more concept variants in less time and drafting early artefacts quickly. The real constraint for owner-managed businesses is data governance: UK GDPR applies the moment personal data enters an AI tool, and uploading real customer research to a public model without a lawful basis and a DPIA creates regulatory exposure.

Key takeaways

- AI augments all five design thinking phases as an additional team member, not a replacement for workshops; the model generates options and clusters themes, your team makes the decisions. - Ideation and prototyping show the clearest productivity gains, with IBM case studies reporting three to four times more concept variants produced in the same time window as human-only sessions. - UK GDPR applies to personal data used in AI-assisted design work: uploading customer transcripts or emails to a public AI tool without a lawful basis and a DPIA likely breaches the law. - Anonymise before you upload: remove names, email addresses, and postcodes from all research data before it enters any AI tool, and use aggregated or synthetic data for workshops rather than live records. - AI-generated design artefacts may not attract UK copyright protection unless a human made the creative selections; retain visible human involvement in your design choices to protect your IP.

Your team is mid-sprint. Sticky notes are across three walls and a Miro board, and someone suggests running the interview transcripts through ChatGPT to find the clusters faster. Before you know it, five weeks of customer conversations, including real names, a billing dispute, and the supplier concern nobody has resolved yet, are sitting in a public model’s context window. Nobody meant for it to happen. The session just moved faster than anyone planned.

That scenario is avoidable, and so is the opposite mistake: ignoring AI entirely when it genuinely speeds up the parts of design thinking where it belongs.

What does AI inside a design thinking process actually mean?

The five-step design thinking cycle, Empathise, Define, Ideate, Prototype, and Test, maps cleanly onto AI assistance at each stage. Research from the Hasso Plattner Institute at Hochschule Stralsund and IDEO describes AI as an augmentation layer across the whole cycle, not a replacement for workshops or human critique. The model suggests options, generates stimuli, and clusters themes. Your team still decides what to keep.

In practice, small teams are reaching for a short list of commercial tools. In the Empathise phase, AI transcription converts recorded interviews to text and a large language model proposes initial theme clusters. In Ideate, tools like Miro AI group sticky notes automatically after a workshop, cutting the synthesis step from hours to minutes. In Prototype, Figma plugins generate wireframes and interface copy from concept briefs. Each of these is a genuine time saver at the right moment.

These tools accelerate the generation step, but critical judgement about what is worth keeping stays with your team. IBM’s consulting practice has documented projects where generative models created multiple variations of user stories and interface copy from design requirements, but every project included structured critique sessions where cross-functional teams filtered the output. The speed gain is real. So is the dependency on human review before anything moves forward.

Why do ideation and prototyping deliver the clearest AI gains?

In controlled tests, design teams using generative models during ideation produced three to four times as many low-fidelity concept variants in the same time window compared with human-only sessions, according to an IBM study with the University of Limerick. The productivity gain is measurable. The catch is that those extra variants still need a human critique session before any of them becomes a direction worth pursuing.

The Hochschule Stralsund research, which synthesises multiple design sprint studies, finds that AI performs best in two phases: generating alternative concepts in Ideate and creating quick artefacts such as mock-ups and test scripts in Prototype. The Empathise phase benefits from AI-assisted clustering of large volumes of qualitative interview data. The research is consistent on one thing across all phases: human teams still outperform AI on originality and usefulness unless they iterate their prompts carefully and filter outputs against their actual knowledge of the user.

McKinsey’s 2023 research on generative AI’s economic potential found that organisations integrating AI into product and service development can reduce time-to-market by 20 to 30 per cent in content generation and prototyping workflows. That figure carries a qualifier: it typically requires upfront investment in prompt libraries, process changes, and staff training before the gains become predictable.

Where do the UK data protection constraints actually bite?

The UK ICO’s guidance on AI and data protection treats personal data used in AI-assisted ideation as in scope of UK GDPR. If your design sprint uses real customer interviews, support transcripts, or emails, you need a lawful basis before the data enters any AI system, plus a data protection impact assessment if the processing is likely to result in high risk to individuals.

The Samsung incident from 2023 illustrates how quickly this goes wrong in practice. After employees pasted sensitive internal code into public ChatGPT prompts, the company temporarily banned the tool across staff. The same risk applies to client data in a design context: raw customer service transcripts, health details, or financial information uploaded to a public generative AI service constitute a new processing purpose under UK GDPR, requiring a lawful basis and, in many cases, a DPIA before you begin.

The ICO also makes clear that sending personal data to AI tools hosted outside the UK or EEA triggers international transfer rules. For US-hosted tools, you need an adequacy mechanism and a transfer risk assessment. For a typical owner-managed business, the practical fix is straightforward: anonymise before you upload. Remove names, email addresses, postcodes, and any identifiable detail before data enters any AI tool. Use aggregated or synthetic versions of client data for workshops rather than live records. NCSC guidance is direct about this: treat public AI tools like any other cloud service and do not paste data into them unless you have contractual assurances about how it is stored and whether it is used for model training.

When should you bring AI into the process, and when should you hold back?

AI delivers genuine value in the Empathise phase for clustering large volumes of interview data, in Ideate for generating many concept variants quickly, and in Prototype for drafting low-fidelity artefacts. In the Define and Test phases, human judgement about what the data means is the decisive factor, and AI output can mislead as easily as it helps.

A practical sequence for a small team looks like this. Start by pseudonymising your research data before any session where AI tools will be involved. In the Empathise phase, use AI to propose initial themes from anonymised transcripts, then bring your team together to validate, add, and reject those themes against what you actually heard. In Ideate, give the model your problem statement and constraints, ask for multiple concept variants, run a timed human critique, and select no more than three directions to develop. In Prototype, use AI to draft landing page copy, email flows, or interface wireframes from your chosen concepts, keeping all of these clearly labelled as early sketches.

Where to hold back: the Define stage is where you write your “How might we” problem statements. AI can generate options, but the selection depends on business context the model does not have. The Test stage requires you to judge whether the feedback you are getting from real users reflects genuine preference or an artefact of how the test was run. Digital Catapult’s guidance on responsible AI adoption makes this explicit: continuous alignment between what is designed and what is legally and technically viable requires human oversight at every stage, not just at the handoff points.

What connects to this in your wider AI practice?

AI-assisted design thinking connects to three broader areas: your data governance setup, your IP position on design artefacts, and how your team evaluates AI output critically. Getting governance right before your first sprint protects you from avoidable regulatory risk. The IP question matters too, because AI-generated artefacts may not attract copyright under current UK law unless human creative judgement shaped the final output.

On data governance, the UK Government’s 2023 AI Regulation White Paper sets out five cross-sector principles, including accountability and transparency, that regulators expect to see applied in internal AI-assisted processes. A short data map noting which AI tools receive which categories of data gives you a defensible record if you are ever asked to account for how your workshops were run.

On IP, the UK Intellectual Property Office has confirmed that copyright subsists only in works with human authorship. Design artefacts generated entirely by AI, without a human selecting and arranging the output, may not be protectable. The practical implication: retain visible human involvement in the creative choices, not just in writing the prompts.

If you want to think through what a defensible AI-assisted design process looks like for your specific business, Book a conversation.

Sources

- Hochschule Stralsund (2025). AI in Design Thinking. Synthesises multiple empirical studies finding AI most effective in ideation and prototyping phases; documents human teams needing to iterate prompts carefully and critique outputs before proceeding. https://www.hochschule-stralsund.de/storages/hs-stralsund/FAK_WS/INNO/MIL/20250301_BJ_ai_in_dt.pdf - IDEO (2023). AI and Design Thinking. Describes AI as an augmentation layer across the design thinking cycle, acting as another team member that produces options and stimuli for human critique rather than replacing the process. https://www.ideou.com/blogs/inspiration/ai-and-design-thinking - Digital Catapult (2023). From Design to Deployment: Accelerating Responsible AI Adoption with MLOps and Design Thinking. UK-focused paper noting that SMEs pairing design thinking with structured governance typically see value from responsible AI pilots within 6–12 months. https://www.digicatapult.org.uk/publications/post/from-design-to-deployment-accelerating-responsible-ai-adoption-with-mlops-and-design-thinking-paper/ - IBM (2023). Generative AI Design, IBM Consulting. Documents design teams using generative models to produce three to four times as many low-fidelity interface variants in ideation, with human critique sessions required to select viable concepts. https://www.ibm.com/case-studies/gen-ai-design-ibm-consulting - ICO (2023). Guidance on AI and Data Protection. Establishes that personal data used in AI systems, including for ideation and prototyping, is in scope of UK GDPR; requires lawful basis, data minimisation, and DPIA where processing is likely to result in high risk. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/ai-and-data-protection/ - ICO. Data Protection Impact Assessments. Sets out when a DPIA is required; explicitly includes innovative technology and profiling as triggers relevant to AI-assisted design work using customer data. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-impact-assessments/ - ICO. International Data Transfers. Explains the requirements when personal data is sent to AI tools hosted outside the UK or EEA, including the need for adequacy mechanisms and transfer risk assessments. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/ - NCSC (2023). Generative AI: Guidance for Organisations. Advises treating public AI tools as untrusted unless contractual assurances exist about data storage and training use; warns against pasting sensitive data into public generative AI prompts. https://www.ncsc.gov.uk/blog-post/gen-ai-advice-for-organisations - McKinsey (2023). The Economic Potential of Generative AI: The Next Productivity Frontier. Reports 20–30% reductions in time-to-market for content generation and prototyping workflows; notes upfront investment in training, prompt libraries, and process change is required to realise those gains. https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/the-economic-potential-of-generative-ai-the-next-productivity-frontier - UK Government (2023). AI and Intellectual Property: Government Response to Call for Views. Confirms copyright subsists only in works with human authorship; AI-generated artefacts without human creative involvement may not be protectable under current UK law. https://www.gov.uk/government/consultations/artificial-intelligence-and-intellectual-property-call-for-views/outcome/government-response-to-artificial-intelligence-and-intellectual-property-call-for-views

Frequently asked questions

Can I use real customer data in a design thinking sprint if I'm using AI tools?

You can, but the UK ICO's guidance requires a lawful basis for processing personal data in AI systems, data minimisation, and a data protection impact assessment if the processing poses a high risk to individuals. In practice, for owner-managed businesses running internal design sprints, the safest approach is to anonymise data before it enters any AI tool, removing names, contact details, and identifiable references before the session begins.

Which phases of design thinking benefit most from AI assistance?

Research from the Hasso Plattner Institute at Hochschule Stralsund and IBM case studies consistently identify two phases where AI delivers the clearest gains: Ideate, generating large numbers of concept variants quickly, and Prototype, drafting mock-ups, interface copy, and test scripts. The Empathise phase also benefits from AI-assisted transcript clustering. The Define and Test phases are where human judgement is most decisive, and AI output can mislead as easily as it helps.

Do I need a DPIA before running an AI-assisted design sprint?

It depends on the data involved. UK GDPR requires a data protection impact assessment when processing is likely to result in high risk to individuals, which the ICO explicitly includes when using innovative technology and profiling. If your sprint uses anonymised, aggregated data, the risk threshold is lower. If you are processing identifiable customer data in AI systems that could influence service design or segmentation, a DPIA is likely required before you begin.

This post is general information and education only, not legal, regulatory, financial, or other professional advice. Regulations evolve, fee benchmarks shift, and every situation is different, so please take qualified professional advice before acting on anything you read here. See the Terms of Use for the full position.

Ready to talk it through?

Book a free 30 minute conversation. No pitch, no pressure, just a useful chat about where AI fits in your business.

Book a conversation

Related reading

If any of this sounds familiar, let's talk.

The next step is a conversation. No pitch, no pressure. Just an honest discussion about where you are and whether I can help.

Book a conversation