Changing where your data is stored isn’t enough to deliver sovereignty. You also need to implement the technologies that enforce real control. Local providers are keen to promise alternatives but US ones are making the effort to give customers more options without losing access to the depth of services they offer. Actually turning the promise of sovereign cloud regions into reality means dealing with encryption keys, access workflows and confidential computing, which also means more costs, dependencies, and operational responsibilities.

The obvious concern with using US cloud services is the CLOUD Act, which allows the US government to request access to customer data from a US-owned service, even if it’s held in the EU. Those requests are supposed to go through the criminal court system. “When it lands in Europe it headbutts with GPDR and you’re involved in legal wrangling as to whether or not that data can be released or not,” IDC research director Rahiel Nasir says.

He views the US Foreign Intelligence Surveillance Act (FISA) as more problematic because it doesn’t go through the normal criminal courts. “That’s an executive order,” he adds. “They’ll just take whatever they need.” The increasing number of sovereign public cloud regions promising data residency and local operations can’t help with that.

Controlling encryption keys

Under its EU Data Boundary, Microsoft stores and processes EU customer data and even support logs, at least for core cloud services, inside the EU. AWS has similar commitments for its European Sovereign Cloud, claiming no critical dependencies on infrastructure outside the EU. And like Salesforce, it employs EU-based support staff for its EU operating zone. Google and Oracle have similar dedicated sovereign regions in Europe, and some of the providers plan to offer similar models in other jurisdictions.

For admin and support, for example, most tasks are performed through automated, audited workflows, and Microsoft personnel don’t have standing or unrestricted access to customer content, says Douglas Phillips, president and CTO for Microsoft specialized clouds. When they do need access for a support issue, customers can approve or reject specific access requests to Microsoft 365, Azure, Dynamics 365, and Power Platform data. “Approved access is customer-controlled, limited, time-bound, and audited,” he says.

The new Data Guardian adds the option of having remote access by Microsoft engineers overseen by an EU partner, with EU-based staff. And tamper-evident records of that access, and any actions performed, are stored in a Production Touch Ledger, which is rolling out in the EU and EFTA.

But a US parent company is still subject to the CLOUD Act and can be forced to hand over data if they control the encryption keys rather than the customer. “The hyperscalers have made their key management capabilities easier for organizations to use as a direct result of their sovereign needs,” Nasir says. “Google, AWS, Microsoft, Oracle all say that you’re the data owner and we can tell you who’s accessing your data. Nobody accesses it without your permission. It’s encrypted and you manage the keys and hand them over as and when you’re ready.”

That relies on companies having the resources to manage those encryption keys rather than leaving them up to the cloud provider who could legally be required to use them to make data available. Nasir compares it to the familiar shared responsibility model of the cloud, but it requires investment. “If that’s important to you and you want to have that control, then you’re going to recruit the staff who can manage that task for you,” he says. “It’s down to the organization having the skill level to be able to do that.”

Private cloud on your own infrastructure, at the edge, or in data centers, might be part of the mix, too, if you want more control over operations and data handling, and Azure and AWS have options for running public cloud services locally in an intermittently connected or even fully disconnected fashion.

But running your own local infrastructure, especially with hardware security modules for encryption key storage, is even more demanding than managing cloud keys, Kiteworks EMEA GM Dario Perfettibile says.

“A government agency, defence contractor, or large, highly-regulated enterprises like financial services have their own security and infrastructure teams, and can afford those costs because it’s not a one-time project,” he says. “There are ongoing costs.”

What most companies need instead is the ability to control and revoke access to their most sensitive data independent of a cloud provider’s or vendor’s own staff,” Scality CMO Paul Speciale adds.

Getting more confidential

Even where data is encrypted, platform metadata usually isn’t because that’s operational information for the provider, and it might reveal details about your organization or operations, if not your customers.

The added cost and complexity of confidential computing, which protects data in use, has limited usage, but Gartner predicts that by 2029, more than 75% of operations on this kind of untrusted infrastructure will use it for security. Azure, AWS, Google, and IBM offer various levels of confidential computing, including VMs, application enclaves, and always-encrypted database services. And VAST has just launched a secure container runtime and attestation service for running AI workloads.

It’s an obvious fit for data sovereignty. “Confidential computing isolates data in use, while attestation lets customers verify approved code and environments before releasing sensitive data or secrets,” Phillips says.

Similarly, AWS Nitro Enclaves offer isolated compute in EC2. “AWS is powered by the Nitro System, which enforces access restrictions so nobody, including our own employees, can access customer data running in Amazon EC2,” AWS head of corporate comms Harry Staight says.

Getting too local

The downside of rigorous data sovereignty is the cost and the potential impact on productivity, especially for multinationals. “Sovereignty shouldn’t become so rigid that it creates unnecessary operational complexity or introduces new risks through systems difficult to manage,” says Kim Larsen, Group CISO at data recovery platform Keepit.

The most extreme approaches to sovereignty highlight how much flexibility you might lose. “The biggest use case of sovereign data in the world is FedRAMP,” says Artur Bergman, CTO at edge computing company Fastly. “To operate it, you have to be a US person on US soil.” The cost of that is up to a hundred times higher than similar commercial cloud services, and connectivity is extremely restricted. And while the Amazon CloudFront CDN has hundreds of points of presence globally, only two can be used for FedRAMP.

Few organizations will need such extreme restrictions but for an acceptable level of data sovereignty that strictly manages access to data by staff location, private companies will still pay a lot, which may not always make sense, says Bergman. Round-the-clock operation is common, and partly based on having staff in multiple locations. But the cost of delivering that with on-call staff significantly increases in places with heavily regulated working hours like Germany, or Sweden where shifts from midnight to 5am are banned unless the service is deemed essential to society, or union agreed.

This will be hard for most enterprises because they operate in all these jurisdictions, and they need to be able to talk about things internally.

“Restrictive models provide greater control and isolation, but shift responsibility for security, identity, resilience, maintenance, and lifecycle management to the customer,” Phillips says. “In some cases, highly restrictive approaches can complicate global collaboration, mobile workforces, or cross-border operations.”

Practical not political

The situation is unlikely to get simpler as more countries pass their own data residency laws. The EU is planning to implement the Cloud and AI Development Act (CADA), after concerns about not just the CLOUD Act but incidents like a Canadian court ordering OVHcloud to produce customer data held on servers in France. That’ll cover different levels of sovereignty, with more rigorous ones for defense and government services.

There are also questions about whether the EU will decide to annul the EU US Data Privacy Framework, which covers data transfers to the US without requiring every EU organization using US providers to make their own data protection impact assessments. But court decisions about that are likely to take months if not years. The framework has remained in effect despite being challenged many times, and Kiteworks’ Perfettibile cautions against waiting for any decision. “You have to build on what you have today, not think about what’s happening tomorrow, because security won’t wait until tomorrow.”

Nasir adds that what we need is real-world practical advice, not politics and emotions. The realistic approach starts with regulatory, operational, and risk requirements of each workload, identifying the threat model rather than applying the most restrictive model everywhere, and sacrificing agility and resilience, Phillips says. Rather than maximum isolation, organizations look for the right balance of control, security, compliance, operational effectiveness, and innovation.

Similarly, AWS says customers want control over the physical location of their data, granular restrictions on who can access it, the ability to encrypt it under their own keys, and resilience to sustain operations through disruption.

Making that work means understanding what data you have, where it is and how it flows across your organization — something that’s often left to individual users marking data as sensitive or non-sensitive. Tagging and metadata, which are now more routine for AI, are what make governance possible: you can’t control who accesses something you haven’t classified. After years of hoarding data, many companies have petabytes of storage with no clear idea what’s in it, who’s touching it, or if it’s still relevant. That’s a data management problem, not a location or sovereignty issue. But tackling it will help.

By 2027, competitive advantage may depend less on which AI model a company uses and more on how effectively it redesigns its business around AI agents.

The software engineer starts his day by going through the changes made by a team of agents for coding using AI. The finance executive gets a report that contains exceptions in different financial systems and supporting information along with corrective suggestions. The procurement manager reviews supplier risks and recommendations regarding contract renewal for those suppliers after an analysis performed by the AI agents of pricing, deliveries and contracts.

For years, enterprise AI competition focused on model intelligence, including reasoning, coding, context windows and content generation. These capabilities remain important, but the next phase will depend on whether AI can perform substantial parts of business processes rather than simply assist employees with individual tasks.

As OpenAI, Anthropic and other frontier AI companies advance agentic capabilities, enterprises face a strategic decision. Should they use AI to make existing processes marginally faster, or should they redesign those processes around a new relationship between human judgment and machine execution?

By 2027, that distinction could separate companies that experiment with AI from those that translate it into a durable economic advantage.

Software engineering becomes an orchestration problem

Software development provides one of the earliest examples of this kind of evolution.

AI coding assistants have evolved from generating snippets and explaining code to working across repositories, proposing changes, running tests and supporting refactoring. Anthropic’s 2026 agentic coding research describes the progression toward more collaborative and autonomous development workflows.

From my firsthand experience working with Claude Sonnet to facilitate application modernization, I gained a realistic viewpoint on this transition. The process of modernizing a legacy application requires more than just converting old code to a new environment. It means comprehending the current business logic, pinpointing all the existing dependencies, maintaining the previous behavior and ensuring that suggested changes are valid for the entire application. I used Claude Sonnet to help with the modernization and explore approaches for implementing it and to accelerate the code-related work, but kept all the technical decision-making and validation under human control.

This experience once again emphasizes an essential point – AI can speed up some parts of modernization, but it cannot substitute engineering judgment completely.

An attainable example of an enterprise use case by 2027 may be that of a software development team using various specialized agents to implement a business function. The different agents would be responsible for requirements analysis, proposing implementation modifications, generating tests, reviewing dependencies and finding security vulnerabilities.

The responsibility of the engineer does not vanish but rather moves into architecture, system boundaries, engineering judgment and production results.

Companies must, therefore, begin measuring something more than lines of code or the number of pull requests created by artificial intelligence. These measures include defects in production, how often new versions are delivered, recovery time, security discoveries and total costs of delivering a reliable change.

This competitive edge will belong to companies using agents plus sound engineering practices, not companies creating code only.

Enterprise software moves from screens to outcomes

A second paradigm shift relates to the enterprise software paradigm itself.

Almost all corporate applications are built on screen navigation, forms, dashboards and workflows that humans interact with manually. Even where different systems are tightly integrated, humans typically form the glue that connects them by transferring data, assessing conditions, seeking approval and updating records.

AI agents can potentially transform this paradigm.

Consider the sales operations agent that spots a customer account at risk, analyzes its service history and contract terms, develops a retention strategy and creates a series of follow-up actions within the customer relationship management system. The human account manager evaluates the proposal and commits the company to the plan.

OpenAI’s enterprise agent initiatives reflect the industry’s movement toward agents connected to enterprise context, business applications and governed execution.

But should this approach reach maturity, the worth of enterprise applications might shift from what users can achieve using them to how effectively users can use their interface.

Systems of record—including accounting ledgers, customer databases and transactional applications—will remain essential for data management and business controls. Agents may become an execution layer above them, retrieving information and coordinating activities while underlying platforms preserve data consistency and enforce business rules.

It would be essential for software vendors to develop reliable application programming interfaces, agent-enabled interfaces, fine-grained permissions and auditable actions. Enterprises would have to consider whether their applications are automation-friendly or too dependent on human interventions.

The larger commercial question is whether value remains concentrated in software licenses and user seats or increasingly shifts toward outcomes, completed workflows and measurable business results.

AI agents at work: finance

Financial activities provide examples of how AI can be applied in the field of processes that have financial and regulatory implications.

Specific examples exist in the banking domain, where AI is being used to classify and route numerous client inquiries and assist humans in accessing pertinent data. In this way, AI is assisting financial activities and the decision-making process at the same time.

In the same way, AI agents could be used to match transactions, identify financial differences, analyze effects on cash flow and create management reports. People would take care of exceptions and make the decisions themselves.

This limited autonomy system gives an idea of how AI can be useful in finance.

Reference: How a global bank scales Claude across its operations — Anthropic

The new operating model: humans supervise execution

With increased responsibilities assigned to agents, the way teams are organized and managed would have to change.

In a typical company, accountability is distributed among various positions, departments, levels of approval and applications. People do the job, managers manage and controls are used to decide whose decision is required at each step of the work.

A new actor appears with agent-technology: the software which is able to plan and perform some tasks of the work but not necessarily to make independent business judgments or be accountable for the process.

This presents a completely new problem for managers. Whose responsibility is the result of the work when there are several agents involved? Whose fault is the mistake in the decision based on old information?

By 2027, businesses may come up with ways to clearly define ownership for work done by agents. The outcomes and risk tolerance will be defined by management; technology staff will be responsible for integration and reliability; risk and compliance teams will set the controls; while the rest will handle exceptions and critical decisions.

Management must measure agents by business outcomes—not deployment counts—including processing time, accuracy, rework, productivity and customer impact.

They have to think about the total cost of running a workflow, which includes not only model use but integration, monitoring, security, human verification and remediation.

A process that looks cheap because of automation may be expensive if there is a lot of verification needed or it keeps failing at handling exceptional cases.

Trust and data quality become competitive infrastructure

More advanced agents will not solve the historical problems associated with enterprise data. Some may even make them worse.

An agent analyzing a supplier, approving a transaction or proposing a financial correction will have the need for accurate information, appropriate rights and an understanding of the corresponding business rules.

If the client data is inconsistent across systems, the contract clauses are obsolete or the necessary data lacks proper context, the agent may come up with a compelling conclusion based on an incomplete set of facts.

Therefore, enterprises must include data quality, application integration, identity management and observability as key elements of their AI strategy.

Enterprises need input validation, access controls, audit trails, workflow testing and clear approval limits. Summarizing a report is different from changing a production system, just as preparing a payment is different from releasing funds. Appropriate autonomy depends on risk, reversibility and the ability to detect and correct errors.

This infrastructure may not attract the same attention as a new frontier model, but it could determine which enterprises can deploy agents reliably at scale.

The real competition begins after the model is selected

The frontier AI race will remain important. Innovation by OpenAI, Anthropic and other model makers may make reasoning, programming, tool usage and task completion more effective.

However, corporations need not rely solely on picking the right model for their AI.

Results will depend on data quality, application access, workflow design and controls. Organizations should start with a valuable, clearly owned process, establish a baseline, introduce agents at selected steps and expand autonomy only when measured results justify it.

Strong integration and clear workflows will let organizations adopt improved models without redesigning operations around a single provider.

Organizations with disparate AI experiments, on the contrary, may find it hard to transform pilot projects into corporate success.

The key strategic challenge is to create an organization able to absorb the advances of frontier AI consistently.

The enterprise advantage of 2027

The future stage of AI evolution will not be defined just by intelligence. Rather, it will be defined by the interaction of intelligence, execution and organizational design.

The companies most likely to succeed in 2027 will not necessarily be the companies with the biggest budgets or early access to frontier models. They will be the companies that understand what tasks are fit to be automated, what decisions should stay human and how to link AI execution to their business systems.

In this light, the critical question that the modern entrepreneur faces is not merely: “What kind of AI technology should I use?”

The critical question is: “Given the fact that AI technology can do more of the work, how can I organize my business to add value?”

Museum IT departments have traditionally served as support functions to manage security and systems. But the National Museum of Korea goes further, identifying and pursuing AI initiatives to preserve cultural heritage, broaden its use, and improve the visitor experience.

The National Museum of Korea uses technology to expand the possibilities to preserve and display physical artifacts, and its digital museum division (DMD) plans and oversees that transformation. A dedicated team responsible for digital strategy and content took shape in 2019, and in 2020, the museum informatics division adopted its current name.

“The director at the time placed great importance on investing in technology and felt we needed a department that could bring a strategic direction to work that had been carried out separately,” says Choi Seungae, former DMD head. “The digital museum division was created as a way to prepare for the next generation.”

A cultural transformation

In just over five years, the DMD has delivered a range of services, including AI guide robots, smart kiosks, and multilingual and sign language services. It’s also developed immersive experiences that use large-scale imagery and sound to recreate cultural heritage.

More recently, its focus has shifted toward data. The aim is to move beyond storage and preservation, making data previously confined to the museum available for wider use. Physical artifacts face restrictions on movement and display because of security concerns and risk of damage. Digital data can help overcome those limitations.

One example is an immersive content project featuring the Denny Taegeukgi, Korea’s oldest surviving national flag, undertaken last year to mark the 80th anniversary of Korea’s liberation.

The project displayed images of the 130-year-old flag once held by Owen Denny, a diplomatic adviser during the late Joseon period, on a large outdoor media screen in front of a department store in central Seoul.

At first glance, the project might appear to have involved little more than photographing an artifact and displaying it. But it required highly detailed data since enlarging existing photographs would’ve produced visible pixelation on such a large display.

Therefore, the division created a new, ultra-high-res dataset containing 10.8 billion pixels at a two-meter scale from the original flag, which measures approximately one meter. Precision scanning captured even the fine texture of both sides of the fabric.

Plan of action

Earlier this year, the museum was selected for the government-led K-Science initiative, through which it plans to pursue data projects beginning in 2027. The cross-ministerial R&D program combines Korea’s historical, cultural, and environmental assets with advanced science and technology to create economic, social, and cultural value.

Through the initiative, the museum will digitize over 2.5 million artifacts and develop technologies to expand the commercial potential of Korean cultural assets. The central goal is to connect the entire process, from archaeological exploration and preservation, to digitization and content development.

The resulting technologies are expected to help overcome technical limitations in detailed surveys of ancient tombs, for example. In preservation and collection management, AI could also automatically control temperature, humidity, and lighting in museum storage facilities.

Never a single right answer

Data presents challenges across both private and public sectors. For museums, however, they’re particularly complex because artifact data contains layers of interpretation, facts, and history.

Consider an AI system designed to answer questions about a particular artifact. It needs data to support its responses. But what should it say if records from Baekje and Silla, two ancient Korean kingdoms, offer conflicting accounts of the same event. Ideally, it would adequately represent different perspectives, but that’s not always possible since the same artifact can tell different stories depending on who used it, when, and for what purpose.

Choi says current LLMs don’t adequately account for these layers of context. When users ask for an accessible explanation, models can produce answers that overgeneralize or oversimplify. Reducing an event with multiple interpretations to a single sentence can obscure or distort its context.

But ensuring accuracy is another challenge. According to Choi, historical discrepancies introduced during initial training can prove difficult to correct, even when a model is subsequently asked to revise them.

The DMD is, therefore, concentrating on building data with clearly identifiable sources. The aim is to let users verify if an AI response is based on material from the National Museum of Korea to assess its reliability.

With these characteristics of artifact data in mind, the division is working with external experts to redesign its database structures around both the nature of the artifacts and the purposes for which people use the data.

Upgrade with AI

Where earlier databases focused on registering and managing objects, the new approach seeks to capture their different meanings and relationships while making relevant materials easier to find. Images, 3D data, videos, and related literature previously scattered across separate records are being connected. Metadata describing file sizes, formats, and how the data was created are also being expanded to support reuse so linking different names for the same artifact makes searching easier, for instance.

“Cultural heritage can’t be standardized like manufactured goods,” Choi says. “We need to organize and structure the data and materials we’ve accumulated in ways that reflect the character of our artifacts, while at the same time, identify connections between them. Once that foundation is in place, curators and external users like content creators, researchers, and educators will be able to find and use materials suited to their needs.”

Leaving room for discovery

After nearly two decades spent researching artifacts and developing exhibitions, Choi didn’t expect to find herself working in the DMD. Now director of the Jeju National Museum, she looks back on her digital work where there were many times her previous experience alone couldn’t guide her decisions. Exhibitions have clear opening and closing dates, and experience helps curators judge what further research and preparation will improve outcomes.

Digital projects offer fewer such reference points, however. It can be difficult to assess how far an initiative has progressed, or anticipate how emerging technologies will affect work already underway. Even so, her expertise provides a foundation to decide where change should lead, and help propose ideas to assess what new tech serves the museum’s purpose.

“Whether it’s curatorial or digital work, I hope the many things we do at museums can make a small contribution to help visitors think for themselves and arrive at their own insights,” she says.

Every platform leader I know is being asked the same question: How do you deliver more with less?

The usual answers are familiar: hire more people, add more process or ask the existing team to move faster.

All three miss the underlying constraint. Headcount is an input. Throughput is an outcome. Organizational complexity is a cost.

Adding people can increase capacity, but it also adds communication paths, onboarding, coordination and decision overhead. Adding process can create consistency, but it can also slow the decisions it was meant to improve. Asking a team to work harder eventually consumes the very capacity you are trying to increase.

There is another answer: design the organization so ownership scales faster than headcount. That means deliberately small pods with sharp charters, end-to-end ownership and aggressive use of automation, platforms and AI.

I spent more than a decade running provisioning and lifecycle for very large infrastructure fleets at VMware, where small teams operated systems at a scale that looked impossible on paper. Today I lead an engineering organization of three teams at Stripe, built from a half dozen pods, each with its own charter and a large scope that nests into the team and organization charters above it. The lesson has held in both environments: the unit of scale isn’t headcount. It’s ownership.

Small pods work because they concentrate ownership, reduce coordination and make leverage compound.

The headcount trap

When a leader says they need more people, they usually mean they need more throughput. The two are not the same.

Brooks made this point in The Mythical Man-Month: adding people to a late project can make it later because communication paths grow faster than headcount. The tax does not stop at communication. Every additional person can add onboarding, alignment, decision-making, context sharing and ownership ambiguity. As organizations grow, nobody can hold the entire problem in their head. The organization compensates with meetings, documentation, processes and coordination roles.

You haven’t necessarily bought capacity. You may have bought complexity.

This does not mean hiring is bad. Growing teams and increasing scope often require more people. The mistake is treating headcount as the default answer to every capacity problem.

Before adding people, ask a harder question: What is preventing the existing people from owning more?

Sometimes the answer is genuinely capacity. Often, it is handoffs, fragmented ownership, repetitive work, unclear boundaries or systems that nobody has permission to retire. Those are organizational design problems.

The squeeze-harder response fails differently but just as predictably. The engineers who absorb extra load quietly are usually your strongest ones. They are also the ones with the most options elsewhere. You won’t see the organizational cost immediately. You’ll see it when they leave.

Design for ownership

A pod is a small group of engineers with one clear charter and ownership of a meaningful scope from end to end: building it, operating it and eventually retiring it.

The exact number matters less than the principle. The group should be small enough that its members can understand the problem, make decisions without extensive coordination, and maintain unambiguous ownership. The goal isn’t to hit a magic headcount. It is to keep the cognitive and coordination load low enough that ownership remains clear.

The charter is what makes that possible. A good charter is one sentence that names what the pod owns and, just as importantly, what it does not.

“Own the lifecycle of this fleet, end to end” is a charter.
 “Help with infrastructure” is a wish.

In my organization, each pod’s charter is large in scope but sharp at the edges. Pod charters roll up into team charters, and team charters roll up into the organization charter. That hierarchy creates something more valuable than organizational neatness: decision rights.

When a request arrives that fits no charter, it becomes a visible leadership decision. Should we create a new pod? Change an existing charter? Stop doing something else? Or explicitly decline the work?

Without clear boundaries, the same request usually finds the most helpful engineer and becomes someone’s spare-time responsibility. That is how organizational entropy starts.

End-to-end ownership is the real multiplier. When the same people who build a system operate it and eventually decommission it, handoffs disappear. Waiting disappears with them. Quality improves because the people creating the system are also responsible for living with its consequences. Decisions get faster because there is no ambiguity about who gets to make them.

Ownership compresses organizational latency.

The leverage stack

Small pods only outperform if human effort is multiplied. A three-person pod delivering ten-person impact isn’t doing ten people’s work through heroics. It is using leverage.

I think about that leverage in three forms: automation, shared platforms and AI.

Automation

The first form is automation. I have run one rule for years: a repeated task is a bug in the system, not a job description.

If a pod does something twice by hand, the third time it should become code, a pipeline or a paved path that makes the right way the easy way. The system should do the repetitive work. Humans should do the judgment work.

Platforms

The second form is organizational leverage. Shared platforms, paved roads, reusable infrastructure and common capabilities allow every pod to build on work that someone else has already done. A pod that can consume a reliable internal platform ships like a team much larger than itself. A pod that has to build its own foundations is a small team doing a large team’s plumbing.

The best platform work therefore does more than improve one team’s productivity. It multiplies the capacity of every team that depends on it.

AI

The third form is increasingly AI. The interesting question isn’t whether an engineer can write code faster with AI. The more important question is whether AI allows a pod to absorb more scope without adding people by reducing the cost of cognitive work.

AI can help pods investigate unfamiliar systems, generate and analyze code, create tests and documentation, accelerate onboarding and absorb routine operational work. That creates a new kind of leverage: compressing work that previously consumed significant engineering time.

But AI does not fix organizational ambiguity. It amplifies the structure it lands in. A pod with a sharp charter, clean interfaces and strong ownership can turn AI into leverage. A vague organization with an AI assistant can simply produce ambiguity faster.

The goal isn’t AI-powered productivity for its own sake. The goal is increasing the scope a team can responsibly own.

The hardest decision is what not to do

None of this is free. Staying small requires decisions that often feel wrong in the moment.

The first is choosing what not to staff. Every planning cycle produces more good ideas than the organization has capacity to pursue. The design only holds if you let some of those ideas die on the table. A pod at 120% of its charter is not a success story. It is a slow failure with good PR.

The second is allowing pods to kill their own systems. End-to-end ownership includes the end. A pod that cannot retire its own work accumulates systems faster than it can eliminate them. Eventually, engineers spend more capacity feeding old systems than creating new value. Some of the highest leverage work my teams have done has been turning things off.

The third is saying no to good ideas because the pod is full. Not “not yet.” Not “let’s find a way.” No. The charter is the reason. It feels harsh. What is actually harsh is saying yes and allowing the pod to discover the cost at 2 a.m.

The hardest part of small-pod design is not deciding what each pod should do. It is deciding what the organization will deliberately not do. That is a leadership responsibility.

Defend the boundary

The biggest threat to a small pod isn’t failure. It is success.

Successful teams attract scope. A team solves one problem, so someone asks it to solve the adjacent problem. Another stakeholder has a one-off request. A system loses its owner and suddenly the successful team becomes the obvious new home for it.

None of these requests is unreasonable individually. Together, they create organizational entropy. A successful pod can quietly become the large, overloaded team it was designed to replace.

Defending small is therefore active work.

The charter is the first line of defense. Requests outside it get a visible decision, not quiet absorption.

The second is regularly reviewing what each pod is actually carrying against what its charter says. Scope drift is much easier to see on paper than in someone’s calendar.

The third is recognizing when a pod has genuinely outgrown its design. When a pod’s scope has legitimately doubled and stayed there, the answer isn’t to quietly double the size of the pod. Split the scope. Create two pods with two clear charters.

Scale the ownership boundary, not the coordination burden.

When small pods don’t work

Small pods are not a universal answer.

Some problems genuinely require larger groups or tightly coupled expertise. Some domains have operational, security, regulatory or reliability requirements that make a very small team impractical. Some work is inherently exploratory and doesn’t yet have a stable boundary that can become a pod charter.

The principle isn’t “make every team smaller.” It is: make ownership as small and as clear as the problem allows.

If a problem cannot be cleanly separated, don’t force an artificial boundary. But if a problem can be owned end to end by a small group, don’t add organizational complexity simply because more people are available.

Measure leverage, not activity

Traditional engineering metrics often measure activity: tickets completed, projects delivered, story points, utilization. Small pods need measures that make their leverage visible to the business.

I look for three categories.

Capacity

• Scope owned per engineer
• System scale supported per engineer
• Operational load per engineer
  
  

These numbers reveal how much meaningful scope the organization can sustainably own.

Velocity

• Lead time from request to production
• Decision latency
• Time spent waiting on another team

These show whether ownership is actually reducing organizational friction.

Leverage

• Toil eliminated
• Manual workflows automated
• Systems retired
• Capacity reclaimed
• Recurring operational work eliminated
  

These capture the work that no longer requires human effort.

These are signals, not quotas. The goal is not to maximize scope per engineer, but to understand whether organizational leverage is increasing sustainably.

A small pod’s most valuable work is often invisible: an incident that never happened, a system that no longer exists, a manual process that no longer requires an engineer, a dependency that disappeared, a class of requests that became self-service.

If you don’t count those outcomes, the organization’s highest-leverage work becomes invisible. And invisible work does not survive budget season.

The real trade

None of this is a shortcut. Small pods demand sharper charters, stronger technical foundations, more discipline about leverage, and harder leadership decisions than large teams do.

That is the trade. You exchange the comfort of headcount for the compounding leverage of a few people who own something completely and multiply themselves through automation, platforms, AI and organizational clarity.

The goal isn’t fewer engineers. It is less organizational complexity per engineer.

The organizations that consistently deliver more aren’t necessarily the ones with the most people. They are the ones where small groups can own increasingly large scopes because the organization systematically removes coordination, toil and work that doesn’t require human judgment.

Scale the scope, not the team.

AI is writing more code than ever. Software specialist Sonar’s 2026 State of Code Developer Survey, based on more than 1,100 professional developers, found that 72% of those who’ve tried AI coding tools now use them every day, and that today, AI now accounts for 42% of committed code, a number that’s expected to reach 65% by next year.

But while developers embrace AI-enabled coding services, many professionals are uncertain about how their businesses will cope with this influx of AI-generated code. Sonar’s research additionally discovered that 96% of developers don’t fully trust it, and only 48% always verify it before committing.

In fact, 38% of developers told the researchers that reviewing AI code requires more effort than analyzing code written by human colleagues. That’s a pattern recognized by Tim Chilton, a managing geospatial consultant at UK mapping agency Ordnance Survey (OS). “There’s truth in the headlines that AI can get carried away, and developers spend more time fixing the code that’s been created than not,” he says.

While that’s not a pattern he sees at the OS, Chilton says his organization is cautious about how developers use AI coding tools, and conversations with other digital leaders suggest a similar approach. AI-enabled coding is indeed almost ubiquitous, and it can allow developers to reach new, higher levels of productivity, but more doesn’t necessarily mean better code.

To ensure that such coding services produce business benefits, CIOs must take control of the development process. They should exploit agents carefully, set professional responsibilities, and establish guidelines, policies, and organization-wide training.

Exploiting the agents

Snowflake co-founder and president Benoît Dageville suggests there are two ways to view AI-powered coding. One is the scary way, where AI takes over your tasks without human input. The second is the efficient way, where AI helps you do the same things as before, but at a fraction of the cost. He’s a big believer in the latter, both for himself and his teams.

“The route depends on the organization; their application of AI coding depends on their priorities,” he says. “However, I hope that overall, AI will have a positive effect on humans. I’m using AI every day to code, and if I compare myself to one or two years ago versus now, I’m more efficient and productive, but I’m also writing five times more code.”

Steve Lucas, CEO of integration technology specialist Boomi, also notes the increase in output. He quotes research that suggests 4% of GitHub public commits are already being authored by Claude Code. That proportion is expected to rise to 20% of all daily commits by the end of this year. Staff at Boomi already use AI tools to produce more code.

“We’re writing 10 times the amount today than we did two years ago,” says Lucas. The increase in AI-enabled coding is so significant that he’s spoken with Boomi chief product and technology officer Ed Macosky about goals for the proportion of self-modifying code.

“I believe AI should recursively modify 80% of a software organization’s code,” Macosky says. “Infinite improvement is demanded. If AI is extraordinarily good at breaking security protocols, the only way to keep up isn’t the kind of accordion model of human code design. AI use must be linear in scale and continuous.”

Crucially, Lucas suggests using AI to check and modify that AI doesn’t mean coders go away. “In fact, I think we’ll need more engineers, not fewer,” he says. “We need these professional experts to ensure the quality of the code that’s written.”

At OS, Chilton uses Coco, Snowflake’s coding agent. The tool does as much as 90% of a development task that he would otherwise complete from scratch. “It’s taken an hour to finish, instead of weeks or never,” he says, reflecting on the power of AI coding services.

However, the tool’s influence is carefully constrained. The agent doesn’t work in isolation, and Chilton checks its output in detail. He says all organizations need a similar process and should value experienced professionals who can use AI coding tools effectively.

“If you’re giving a tool to someone who isn’t capable of checking an agent’s work, as a digital leader, you run the risk of putting too much faith in AI just running with its output,” he says. “I think that’s a big risk, so there’s still a need for experienced developers.” 

Setting clear responsibilities

While placing humans in the loop can help ensure AI-enabled code is safe and effective, developers shouldn’t be weighed down by their new management responsibilities.

Gill Haus, CIO at Chase, the consumer banking arm of JPMorgan Chase & Co, says AI coding benefits can only be realized when agents are introduced with a strong focus on automating supporting technology and processes, which reduces the need for too much human input.

“If you have 12,000 engineers, they can write 12,000 engineers’ worth of code in a day,” he says. “If those 12,000 engineers have agentic technology, they can write much more. But if you don’t have automation left to right with confidence, you create more manual processes. You can’t move as quickly since there are only so many humans you can put in the middle.”

Haus says Chase never releases services in production that don’t pass its high bar for quality and security. Strong engineering practices, pipelines, and architecture, plus a tried-and-tested approach to automation, can help ensure AI coding produces solid outputs without a burdensome amount of human intervention.

“We’re focused on effective automation so we’re able to unleash this technology safely and effectively,” he says. “This is something many other companies should be focused on if they aren’t already, because otherwise you can’t keep up with the pace of change.”

François-Xavier Pierrel, group chief data and ad tech officer at French TV network TF1, is another digital leader who says maintaining control as AI writes more code means keeping the human in the loop in a clearly defined manner. His team documents agentic processes using Atlassian project management and collaboration tools, such as Confluence.

Pierrel says policy management is crucial as the agentic transformation gathers pace.  One key step is ensuring professionals who use agents conform to internal standards. Smart businesses set policies that state clearly when staff can explore an agent, delegate work to it, or release it in production.

“We don’t have hundreds of agents deployed yet,” he says. “But the moment you reach a certain level of volume, if you don’t have compliance and policies in place, AI becomes a critical mess, and then it can be disruptive in a negative way.”

Building strong foundations

Kirsty Roth, chief operating officer at content and technology specialist Thomson Reuters, agrees digital leaders must be proactive. Her firm’s explorations with models and agents suggest that AI can help with time-intensive coding processes, such as writing. This capability means her organization carefully considers the roles people fulfil.

“In the last 12 months, we’ve put lots of thought into where we’re seeing benefits,” she says. “It’s great AI can do some of the coding work, but what does that mean for people’s jobs? We used to have thousands of engineers. Do we now need more architects or product people?”

Roth refers to security. While cyber is always a priority for Thomson Reuters, the firm dedicates significant resources to controlling threats in the AI age. Developing high-level development and security skills requires a concerted effort. Yet Roth says ensuring people have the right skills to manage AI is in many ways a familiar IT trend.

“All this effort is no different than digital, cloud, mobile, social, or other big tech trends,” she says. “They all take several years to have an impact as the initial hype comes, and then you’ve got to work through the reality and think about how you upskill people for the new world.”

Crucially, coding is no longer the sole preserve of the software developer. AI coding tools make it much easier for non-IT professionals to vibe code applications. Tal Carmi, CIO at technology specialist WalkMe, says non-developers can create useful tools. However, effective outputs rely on a careful balance between enablement and guidance.

He adds that most of these employees don’t need in-depth capabilities, such as a database or a content delivery network. Instead, non-IT staff require a dedicated place to upload their products. WalkMe’s engineering specialists ask key questions to ensure their outputs are safe, considering credentials and potentially problematic packages.

“You need to add guardrails,” he says. “A lot of the work for in-house engineers is shifting from building to testing. The people who aren’t coders don’t necessarily have security in mind.”

The key takeaway, suggests Emmanuel Frenehard, chief digital officer at biopharmaceutical giant Sanofi, is that digital leaders must help professionals feel comfortable. Successful digital leaders ensure the business generates value from agents, and his firm is helping its staff, particularly its developers, to embrace these tools.

“I genuinely worry for professionals who don’t use AI to code, because in five years, they may not have jobs,” he says. “So we’re guiding, coaching, and training them, but people must take the journey. The train has left the station. You can decide to be on it, or just look at it.”

Over many years of working through successive waves of enterprise technology and IT architecture, including fast-moving AI, I’ve heard the same question in different forms: “How can I build my business with AI while avoiding lock-in and tech debt?”

It came up again during a recent conversation about a major technology investment, when a CIO asked, “Should we really be making this commitment if the technology is changing constantly?” That resonated with me because it reflects a pattern I have seen across technology waves: the architecture must provide stability even as the capabilities around it continue to evolve.

For decades, the goal has been to build a technology foundation that serves the enterprise for five, seven or even 10 years. With the emergence of AI, some technologies become outdated before implementation is complete.

If shorter technology lifecycles are the challenge, adaptability is the answer. Instead of asking, “What will serve us for the next decade?” CIOs should ask, “How can we remain flexible as technology changes?” That requires being deliberate about what must remain durable and where the enterprise must be ready to adapt.

Think of it like a house. The foundation, walls and furnace are built to last, while paint, furniture and bathrooms change as needs and styles evolve. Enterprise architecture increasingly works the same way.

AI is separating the experience of work from the systems behind it

I recently heard about a company that now gives new employees a single onboarding tool: ChatGPT, connected to the enterprise systems and key data sources behind it. Instead of learning multiple applications, employees simply ask for the information or support they need, without knowing which underlying system provides it.

Of course, a single interface doesn’t mean blanket access to enterprise systems. This model requires security measures that ensure employees can access only the information and capabilities they’re authorized to use: carrying each employee’s identity and existing permissions through every request, limiting access to what’s necessary, tracking where information comes from, and logging retrievals and actions. Changes with significant business consequences should also require review.

This does change how we think about work and the technology that supports it. If agents are becoming the primary interface, the central question shifts from “Which application should employees use?” to “Can our data be accessed, understood and used securely by the interfaces and agents we adopt next?”

Adaptability means running at two speeds

Some technology capabilities should endure; others should evolve quickly. The mistake is treating everything as having the same lifecycle.

The durable layer includes ERP, HCM and other core systems, along with data, security and foundational architecture. These investments remain essential, but CIOs should design them around future business possibilities rather than solely around today’s processes.

The fast-moving layer comprises agents, interfaces, analytics, workflows, AI models and tools, experiments and business-specific solutions. The CIO’s role is to distinguish this layer from the durable core and ensure that rapidly evolving capabilities can be replaced without destabilizing the durable foundation.

CIOs need practical ways to change the underlying technology without disrupting the applications the business relies on. That starts with clear, consistent rules for how systems exchange data and interact with APIs, MCP connections and AI agents, keeping the implementation choices behind those boundaries. Before changing a model, agent or application, teams should confirm existing data and integrations will keep working, test security and expected behavior, and introduce changes in stages with a rollback plan if something goes wrong.

This two-speed model is a substantial departure from traditional enterprise IT management and from the way we did things when I was coming up in the tech world. It changes how CIOs plan investments, organize technology functions, structure vendor relationships and govern the connections between durable and fast-moving capabilities.

Invest thoughtfully for both durability and adaptability

In the pre-AI era, CIOs prioritized technologies with decade-long relevance. Today, they should avoid overspending on solutions prone to rapid obsolescence and invest in business outcomes and a durable foundation for intelligence.

Projects lasting more than six months warrant scrutiny: Will the solution remain relevant, or are we embedding processes that AI may soon handle; perhaps with a single prompt?

Durability extends beyond core systems to include the organization’s capacity to understand, evaluate and adopt new technology.

Today, most companies critically underinvest in skills. Knowing how to operate ChatGPT or Claude is not the same as working effectively with AI. OpenAI’s study found that AI power users outperform average users by sixfold. Upskilling gives CIOs leverage by helping employees redesign work and use AI effectively, while stronger leadership fluency facilitates new business models rather than merely supporting existing operations.

Most companies are also underinvesting in the data foundation. In West Monroe’s recent survey of 417 business leaders, AI governance, risk and compliance ranked as the lowest investment priority for the next 12 months. Traditionally, IT addressed data operations to ensure successful ERP implementation. Now, because data quality directly impacts AI value, investing in governance and accessibility is imperative.

CIOs need practices that preserve data meaning and reliability as platforms change. Those include assigning clear ownership, establishing authoritative sources and shared definitions, tracking data lineage and setting standards for quality and access. Definitions and rules should be maintained in portable documentation and data contracts, rather than embedding them in a single AI model or vendor platform, so they carry forward as technology evolves.

Break down IT silos to encourage adaptive architecture

Typically, CIOs organize operations around disciplines such as infrastructure, data, applications and security, with IT teams choosing an application and then defining processes and architecture around it. But as future architecture becomes less certain, CIOs must instead envision future business capabilities and design for change, bringing AI and data into architectural thinking alongside traditional cloud and application expertise.

Consider a reporting process that today moves from data analysis to Excel to PowerPoint to human review before a decision is made. An adaptive architecture focuses less on preserving each of those steps and more on the outcome: turning data into intelligence that informs a decision or action. Excel and PowerPoint may still have a role, but they no longer need to be hardwired into the process.

CIOs also need to break down silos. Teams often define architecture around a single suite, such as Salesforce or SAP, without considering alternatives. While working with an energy company recently, I saw how bringing analytics teams into the discussion shifted the focus from the ERP itself to how data should be accessed and used. Small, cross-functional teams can help create that broader view and design around business needs rather than individual platforms.

Build partnerships around future business outcomes

The most effective CIOs I work with are shifting their focus from simply controlling costs to driving value, actively partnering with the business, and reimagining how functions can evolve with AI, data and IT.

As vendor offerings expand across applications, analytics, agents and interfaces, CIOs need to balance integrated ecosystems with the flexibility to combine providers. Prioritizing open standards, multi-cloud support, data portability, interoperability and adaptable contracts can help organizations use the strongest elements of core systems while integrating agents and data across systems to adapt faster as needs evolve.

CIOs should build flexibility into vendor contracts, so changing providers doesn’t mean losing access to valuable data, context or governance rules. Contracts should provide for usable exports of data and metadata, documented interfaces that vendors keep current, advance notice of discontinued features, and support for testing portability and transitioning to another provider. They should also specify security and audit obligations throughout the relationship and during the transition.

The bottom line: buy with the future in mind. Don’t just ask if an application meets current requirements. Instead, envision what future business functions should look like, then derive technology needs from that vision. Shift the mindset from using HCM checklists to driving workforce optimization, from CRM checklists to revenue management, and from ERP checklists to enterprise data and intelligence.

Find the signal in the noise

As AI gets smarter and cheaper, the challenge will shift from affording it to connecting it to business outcomes. I believe the defining constraint in 2027 will be focus, not cost: CIOs must identify the few high-leverage priorities their organizations can absorb and execute well. That’s easier said than done.

There’s no established playbook for the AI era: we’re all experiencing it for the first time. CIOs face a flood of startups, models, architectural approaches, evolving standards, vendor claims and internal requests. The task becomes curation: deciding what deserves attention. Distinguishing signal from noise is becoming an essential leadership skill.

The new long game for CIOs

I believe CIOs are at a pivotal moment. They can remain excellent IT leaders or help the business rethink work through intelligence. In that sense, the role could evolve into what I call the chief intelligence officer: the leader who helps the enterprise turn fast-changing technology into durable business value.

CIOs have always felt pressure to deploy emerging technologies rapidly. Implementation brings challenges, including calculating and measuring upfront investment costs. Deploy too quickly, and when the hype fades, many IT departments are left with a costly architecture to support, security gaps, and operational issues.

The same trend is happening with AI. Many CIOs procured enterprise-wide AI model licenses and empowered employees to experiment with language models and develop AI agents. Others asked DevOps teams to accelerate AI code generation and vibe coding. The shift from rapid experimentation to deploying more AI capabilities to production can leave CIOs with mounting AI debt and AI FinOps gaps.

CIOs’ near-term concern is managing budgets amid consumption-based AI pricing models. Even as AI token costs decrease, more employees are using AI, and agents are given more challenging, expensive assignments. Here are seven common mistakes IT leaders make that result in blown AI budgets.

Defining an AI strategy without measurable business outcomes

Most CIOs and CAIOs recognize the need to establish AI strategies focused on areas where AI can provide lasting business value. But many fail to quantify targeted business outcomes, leaving employees to use adoption metrics as the primary objective.

“Every token spent on a pilot that never proves its value is money leaders can’t get back and lost opportunity cost, which is a governance failure more than a technology one,” says Rob Scudiere, CTO at Verint. “Every agent and workflow should have to earn its budget by showing results that achieve the desired business outcome, or lose it.”

Kris Beevers, CEO and cofounder of Netbox Labs, says to use existing business metrics to see whether the areas adopting AI are improving them faster. “If adoption is climbing but the outcomes aren’t moving with it, that’s a pretty good signal to rethink where you’re spending,” Beevers says.

Recommendation: Financial impacts may be hard to target during experimental phases, but employees should set financial objectives before moving AI agents into development and deployment phases.

Experimenting without AI governance

CIOs may find they have a real mess on their hands when a few pilot AI agents quickly scale to thousands running in production. Much of AI governance focuses on identifying owners, setting data-access rules, defining target business outcomes, and establishing accuracy guidelines. CIOs must also educate employees on underlying cost factors, including model selection and platform standardization.

“Delayed AI governance gets framed as a compliance risk, but it’s just as much a budgetary concern,” says Guy Bourgault, head of agentic systems at Concentrix. “The longer organizations wait to define ownership, standards, and controls, the more they end up funding inefficiency, rather than progress.”

Varun Goswami, global head of product and AI at Newgen, says AI budgets are wasted on scattered pilots, duplicated integrations, and agents that run quietly without ever proving value. “Build on one governed platform rather than a dozen parallel stacks, reuse templates and connectors instead of custom-building each use case, and match the model to the job rather than routing everything to the priciest foundation model,” Goswami recommends.

Data quality is a third concern, according to Collibra and The Harris Poll, with 96% of IT leaders saying project failure almost always traces back to poor data foundations, and 51% reporting significant staff hours spent manually correcting autonomous AI agent outputs. CIOs should set data quality metrics and establish data products to build a trustworthy AI context layer.

Recommendation: CIOs should update and communicate their AI governance policies monthly, as AI cost, capabilities, compliance, and security considerations evolve rapidly.

Focusing tokenomics on model costs and not business value

Much of the discussion around AI token economics, or tokenomics, focuses on the costs of using different AI models. But the FinOps Foundation defines tokenomics as “the study of how the production, distribution, and consumption of tokens generate business outcomes and AI value within an organization.”

Because many organizations use multiple models, SaaS with AI agents, and internally developed AI agents, CIOs should partner with the CFO to measure total impact, including AI’s direct token costs, employee efforts, ongoing inference costs, and the value delivered.

“Companies can quickly overspend on AI when they focus too narrowly on token consumption, and the starting point should always be the business outcome,” says Prakash Kota, CIO at UKG. “I use the Three T’s: does the work require talent for judgment or expertise, can existing tools solve it efficiently, or do tokens create enough value to justify the investment?”

CIOs should then set AI budgets at the employee, department, and workflow levels. Each group’s budget should be reviewed and adjusted regularly based on outcomes. This discipline promotes fiscally smart decisions about when and how to use AI capabilities and can drive a top-down culture change.

“The same tokens can go to a skilled engineer shipping a product faster, or to a non-expert generating 10 versions of the same slide deck,” says Tom Shea, CEO and cofounder at OneStream. “The line item in the budget looks identical either way, and true token efficacy requires governance to ensure those tokens are empowering experts to accelerate output, rather than fueling a massive cost explosion.”

Recommendation: Setting AI budgets too soon may curtail employees’ enthusiasm in learning and experimenting with AI. Establish financial targets based on a maturity curve to encourage experimentation first, then fiscal discipline when AI agents are deployed to production.

Developing AI agents without standards

CIOs should communicate these two cost considerations to DevOps teams using AI code generators.

First, according to Stack Overflow’s 2026 Developer Survey, 73% of developers use AI coding assistants and agents daily, but developers care more about quality (75%) over cost (38%) when shaping prompts and picking models. CIOs should set guidelines for balancing cost and quality tradeoffs, establish DevOps non-negotiables, and require code analysis in deployment pipelines.

“Coding is no longer a constraint, and the bottleneck has moved to how we ensure the correctness of code,” says Anurag Dhingra, SVP and GM of networking and collaboration at Cisco. “There’s just no humanly possible way to review every piece of code that is written by AI.”

The problem is that 96% of developers don’t fully trust AI-generated code and 48% always check their AI-assisted code before committing, according to Sonar’s State of Code Developer Survey. As large organizations may use several AI code-generating tools, they need to benchmark quality, cost, and developer satisfaction.

“Teams need clear guardrails and engineering standards, especially as AI agents accelerate development and can introduce costly rework,” says Andrea Malagodi, CTO at Sonar. “Having live data aggregated from your one or many providers, to enable you to see the cost per PR [pull request], is a good governance mechanism.”

Recommendation: While AI code generation is a remarkable breakthrough, it also brings new costs and quality considerations CIOs should track.

Using frontier models for all AI needs

Another cost consideration comes as organizations deploy hundreds of AI agents and provide developers several AI models to choose from. Developers may choose models based on preferences rather than performance and cost considerations.

Craig Wiley, VP of AI at Databricks, says 77% of companies now juggle multiple model families because the best model for one task is rarely the best for another. “The flexibility comes at a cost of managing shifting prices, scattered vendors, and zero visibility into where your budget’s actually going. The fix is real-time budgets and smart routing that automatically sends queries to the most cost-effective model,” Wiley says.

Recommendation: Josh Fecteau, chief data and AI officer and CIO at Teradata, says that frontier models are expensive and not necessary for every task. “Diversify your model strategy with cheaper small language models, custom models, and industry-specific models,” Fecteau recommends.

Deploying AI agents without monitoring cost spikes and inefficiencies

A key challenge with AI agents is their variable costs, especially when they are given tasks of varying complexities. While some AI providers are moving to outcome-based pricing models, many still use a license model with a fixed number of tokens, plus consumption-based pricing for overages. This means CIOs must monitor costs, set AI observability standards, and define rules for handling performance variances in AI agents.

“I spent 25 years in telephony where every minute had a price, and agentic AI is the first software I’ve seen that bills like a phone call and gets budgeted like a license,” says CJ Combs, AI strategy executive at Columbus. “AI costs stop being predictable the moment an agent can loop, because it keeps pulling in context, retrying, and calling tools in ways nobody budgeted for.”

Experts suggest several implementation cost inefficiencies to review. Babak Pahlavan, founder, CEO, and CPO at NinjaTech AI, says that AI agent processing duration is an easy indicator. “A single autonomous agent running a multi-hour task can burn a month’s allocation in an afternoon because every tool call, every retry, every piece of context it re-reads gets billed,” Pahlavan says.

Other cost factors require experts to review an AI agent’s decision logs to determine optimization. Adi Elimelech, CTO and cofounder of Jedify, says, “If every query drags an entire database schema back to the LLM, token costs scale with the size of your environment rather than the complexity of the question. The cost compounds, since the model often doesn’t get it right on the first pass and loops back for another round trip before landing on the correct answer.”

Recommendation: CIOs will need to mature several AgenticOps and site reliability engineering practices to monitor AI agents and respond to cost, security, quality, performance, and other incident types.

Building agents without a change management plan

One of the biggest gaps in deploying AI agents is that deployment is just one step in a change management process. AI governance requires identifying agent owners who are accountable for decisions and responsible for outcomes. These owners should also sponsor the underlying change management process.

“The biggest AI cost overruns rarely come from technology,” says Abhijit Kakhandiki, SVP and GM of digital business automation at BMC Software. “They come from organizations deploying AI without redesigning processes, ownership models, and governance.”

Part of the change process requires identifying human-in-the-middle responsibilities to review the agent’s recommendations. The review process builds trust and lets owners switch to autonomous decision-making for low-risk, high-volume, trusted recommendations.

“It’s not going to be a binary switch where, from day one, you’re going to trust AI agents to run tasks autonomously,” says Joel Hellermark, chief AI officer at Workday. “Progressively, they’re going to earn the right to run those workflows autonomously. If it’s your fiftieth time approving an expense below $50 for one of your direct reports that looks exactly on policy, you can trust the agent to run it for you.”

Recommendation: Growing adoption isn’t the end game, but it’s a key step toward delivering business value. Metrics to track adoption include AI response quality, trust scores, repeat usage, and value delivered to adopters.

A simple rule is that you can’t manage what you don’t measure. CIOs should set budgets, track costs, and measure outcomes, especially as more agents move into production.

With 2027 quickly looming, IT leaders should soon be finalizing their objectives for the new year, one certain to be rife with many unknowns if 2026 is any indication.

This year began with the call for a pivot from AI pilots to AI ROI, but questions around AI governance and accountability quickly took center stage as agentic AI made further inroads in the enterprise and high-profile incidents showed the risks of AI gone awry and the value of security-first approaches to AI agents.

Now, CIOs must anticipate how AI will evolve in 2027, how they’ll get their enterprises ready for all the risks and opportunities of that evolution, whether their teams will have the skills to seize on technology advances, and more.

To get a glimpse of how CIOs are approaching next year’s IT agenda, we asked IT leaders to share the key questions they are asking to shape their strategies for 2027. Here’s what they shared.

How do we ensure our AI investments provide tangible value as the cost calculus changes?

The big question as CIOs plot their IT agendas for 2027 still centers on providing verifiable business value, as 98% of CIOs report that board pressure to demonstrate measurable AI ROI has increased since 2024, according to a 2026 report based on a Dataiku/Harris Poll survey of 600 enterprise CIOs worldwide.

Doug Gilbert, CIO and chief digital officer at Sutherland, a digital transformation services company, is among those IT execs pondering this question as he executes his fiscal 2027 budget, which started in July.

“When I’m out speaking to people and they say, ‘It would be great if AI could do that,’ I say, ‘Yes, but would it provide value? Are we building value or are we just burning tokens?’” Gilbert says. He notes that he and his CIO peers are being increasingly judged on the outcomes they deliver for their organizations, meaning they have more incentive than ever to ensure the technology initiatives they undertake deliver ROI.

But the calculus on that is getting trickier than it was at the beginning of 2026 — in part because AI total cost of ownership (TCO) is challenging to calculate, but also because an AI pricing reset is on the horizon. So, to that end, CIOs such as Gilbert are now thinking about what level of ROI is high enough to justify the investment.

That’s a key question to ask now and into 2027, Gilbert says, particularly as the cost of tokens continues to rise. An AI use case that provides marginal ROI could stop producing any value in the near future if tokens increase even slightly, he notes.

As a result, Gilbert is working to factor in those dynamics when he and his team work with the business to identify which AI use cases to pursue — and he expects to do so even more moving forward. “I plan to pay a tremendous amount of time thinking about whether [a proposed project] is the right one to pursue,” he says, to ensure “when you put math on paper there is value with the project.”

How do we ensure observability and auditability of our AI systems?

According to a 2026 survey from OneStream, 47% of senior finance and IT executives say they have made a material business decision based on inaccurate, incomplete, or outdated financial data in the past 12 months.

Citing that statistic, Gilbert says he’s also asking critical questions about the observability and auditability of all of Sutherland’s AI uses cases. He wants to be sure he, other executives, and users are confident the company’s AI systems always have high-quality data — and thus accurate outputs. And he wants IT to achieve that observability and auditability so that the company can accurately track, measure, and improve its AI deployments over time.

“We will not deploy any AI that we can’t observe,” he says, a policy that he put in place about a year ago and will continue in 2027.

A wide range of tools under the moniker “AgentOps” are emerging to help IT leaders monitor AI activity, tools, and costs, starting with observability.

How do we move to more autonomous agentic processes?

“The challenge most technology executives are grappling with at the moment is how you move AI from human-assisted agentic to much more autonomous agentic processes with minimal human intervention or supervision,” says Jody Fullman, CIO of Reconomy and recently recognized as one of the UK’s top 100 CIOs in the CIO 100 UK Awards 2026.

Moreover, how do you achieve that securely and in a way that’s economically viable? he asks.

Fullman is implementing strategies to address this challenge. He is strengthening IT’s agentic controls by aligning Reconomy’s governance program to an industry-recognized framework. He is also implementing tools to monitor and manage tokens. And he’s moving some AI workloads to lower-costs models.

All that, he says, will set up the organization to develop and deliver more autonomous agentic capabilities ahead, noting that he and his team have been transitioning successful proof-of-concept agentic initiatives into MVPs to put the company on the path to more autonomous agentic processes.

How should OpenAI’s Hugging Face incident shape my security strategy?

Security has been a central factor in IT agendas for years. But Jeff Stovall, CIO for Dallas, Texas, says the 2026 Hugging Face incident, in which autonomous AI agents built by OpenAI escaped their sandbox testing environment and hacked into the infrastructure of AI open platform company Hugging Face, has him adjusting his plans for 2027.

“Hugging Face demonstrated that there was a lot more peril in the world of AI as it relates to cybersecurity than what we were ramping up for,” he says. “There’s now this notion that AI may have more downside for us than upside for us in the near future,” he adds, explaining that AI-fueled threats to the organization are more significant than the positives its use brings.

“In the upcoming six months to a year, what I see is that we have to take a hard turn in thinking about how AI poses a significant malevolent threat to our organization when wielded by actors seeking to do harm,” Stovall says. He points specifically to hackers’ ability to use AI to create swarms of bots that can autonomously collaborate and exploit all vulnerabilities nearly instantaneously and all at once. “That’s a dramatic acceleration and amplification to the threats we face.”

In response, Stovall says he’s shifting more resources to maturing his security program in 2027 than he initially budgeted — drawing funds away from internal AI deployments to “shore up the walls even further” by adding more AI automation and agents to have “much more machine speed in security response.”

How do we use AI to transform?

Marco Bill, SVP and CIO at Red Hat, believes using AI for productivity gains is now table stakes. So as he develops his plans for IT for 2027, he’s looking to push that notion even further, asking how the company can use AI to transform processes as a whole.

“This question helps me to keep reminding ourselves that we’re not just here to do IT. It’s more of a guiding principle,” he says.

And that in turn is underscoring the importance of transforming the IT organization into a more collaborative and business-centric one.

As an example of what’s brewing at Red Hat, Bill points to the work his IT team is doing with the company’s sales team to devise ways to use AI to enable account managers to have better conversations with customers to close deals faster. IT is also working with the marketing department to make go-to-market process more powerful, and his teams are adding agentic AI to their own IT operations to create fully autonomous workflows that cost less to run and manage.

All told, Bill and the IT team at Red Hat are building further on the work many CIOs began in 2026 by helping to reimagine business processes to reap AI benefits and bringing AI transformation home to IT workflows.

How do we empower users to transform their work with AI?

“Citizen AI” is a rising trend in the enterprise, and this is something Reconomy’s Fullman will continue to address in 2027, explaining that his company has found that much of its “success with AI was not by being a tech project but by empowering our users and business colleagues to transform their work and processes with AI.”

Fuller believes that his company will see more AI-enabled transformation, and see that transformation faster, by continuing to put more AI in the hands of users throughout the organization instead of expecting IT workers to become experts in all the processes that could be transformed by AI.

As such, Fuller says the upcoming year’s IT plans will continue to put AI tools in the hands of the users, and do so with governance, security, and transparency in place. He’ll also leverage the skills of workers in process transformation roles, which were recently created and installed in Reconomy’s business units but still work closely with IT architecture and data teams.

“They’re plugged into tech and the business to make sure we’re prioritizing the right things and doing things the right way as we drive transformation,” he explains.

How do we prevent our AI governance council from becoming a bottleneck?

Company leaders at intelligent automation platform provider Celigo want every team to build with AI, something CIO Amy Farrow knows makes security and controls critical. But Farrow also wants to make sure she enables speed and doesn’t unnecessarily slow down innovation, noting that barriers could lead to shadow AI.

“If [teams] all have to wait too long, they’ll find a way around the process,” she says.

To ensure that governance isn’t a bottleneck, Farrow explains that her “governance council doesn’t approve projects. It sets the rules: risk tiers, design criteria, a checklist every agent has to pass.”

She adds: “The teams approve their own work against those rules, and we audit. My team owns the integrations, access controls, and observability. My job is making it faster to build the right way.”

What controls do we need to put in place for AI agents?

As AI agents increasingly enter enterprise workflows, IT leaders will need to the level of permissions agents should be granted relative to the people on whose behalf those agents will be operating.

Farrow, who previously served as global CIO at Infoblox and Lyft, believes agents should resolutely have fewer permissions than the people whose tasks they will be performing.

“Someone in finance can issue a credit or update our ERP because we trust their judgment. An agent doesn’t get that by default,” she explains. “We start every agent with the least autonomy required to achieve the outcome. It can interpret a request or recommend an action. Changes to records go through checks the model can’t override, and bigger changes need a person to sign off.”

This approach also has a fiscal benefit, she says, noting, “Less autonomy means fewer model calls, which keeps costs in check.”

As AI increasingly goes agentic, CIOs will increasingly need to plan for ways to address this issue in the year ahead.

What happens when vendor agents start acting inside our systems?

“Many of our SaaS vendors are shipping agents, and some can make changes to our data by default,” Farrow says of another key security- and governance-related question many CIOs are facing. “For 2027, I want vendor agents held to the same standard as any other integration.”

Farrow has other questions related to the rapid rise in vendor agents, asking, “What can they touch? Can we see what they did?”

IT leaders need to ensure they can answer those types of questions, noting that California’s and Colorado’s new rules on automated decisions start in January. She wants to be able to give strong answers to those questions, stressing that “‘the vendor’s agent did it’ is not a defensible answer.”

How do we meet immediate business needs while building a foundation for growth?

Mieko Shibata, CIO at R&T Deposit Solutions, sees this as “the overarching question” for him as CIO.

“That question guides our investment decisions and how we allocate our team’s time,” she explains. “Our strategic direction is consistent, but each year’s agenda must balance immediate business priorities with progress toward our longer-term technology foundation. We consider both the value each investment delivers and how it contributes to the environment we are building.”

Shibata is taking a multiprong approach in her response to that overarching question.

First, she’s ensuring technology modernization turns into measurable business value and that modernization initiatives are prioritized based on that value.

She is also considering how IT responds to growth opportunities while keeping its longer-term transformation on track. “Our response is to consider the immediate commercial value alongside the longer-term technology implications. Can we reuse the capability? Will it scale? What will it take to support? Does it help simplify our environment?” she says.

And she’s thinking about how the company prepares for AI’s evolution while maintaining clear accountability for its use. “For 2027, my focus is on building a repeatable approach to evaluating and adopting AI as it evolves, with clear business benefits, appropriate controls, and accountability for the results,” she says.

Is our AI vision ambitious enough?

For Lauren Wilkinson, CIO for financial advisor services at Vanguard, AI ambition is top of mind as she develops her IT strategy for 2027.

AI strategy should accelerate the business strategy and “push leaders to reconsider what outcomes with AI are possible, rather than simply finding ways to make today’s processes faster or more efficient,” she says.

“It helps to start with an aspirational business vision, including what a few big outcomes could look like. Then you can work backward to determine where AI and technology can fundamentally change what is possible,” she explains.

In her work with financial advisors, she’s found that they’re primarily using AI to support administrative tasks such as drafting emails, conducting research, and taking meeting notes. But she sees an opportunity to build on those use cases in the upcoming year to deliver on that objective for a more ambitious AI program.

Like many CIOs, Wilkinson wants to take AI to the next level at her organization and ensuring that ambition is high enough is paramount to achieving that goal.

Do we have the talent to win in an AI-native world?

Wilkinson believes how CIOs address the AI talent question will be critical for organizational success.

“As AI continues to evolve, the skills that differentiate great technologists will also evolve, placing an even greater premium on AI expertise and deep business acumen,” she says. “CIOs should be building teams that understand the business, can identify the highest-value problems, and know how to orchestrate AI-native workflows to solve them at dramatically greater speed. The differentiator won’t simply be who has access to the best AI, but who has the people who know where and how to apply it.”

Most CIOs know this, so it is not surprising that this year’s State of the CIO survey found that AI tops the lists for both most sought-after skills and the hardest to find. As a result, CIOs will have to get creative to build up their teams’ AI know-how in the year ahead.

How should IT be reshaped to maximize value creation?

CIOs, including Shelia Anderson, EVP and chief information and digital officer at Unum Group, are also asking how they should shape IT as an organization to ensure they can deliver value to the business.

“That has been a big focus for us this year and will continue to move down that path in 2027,” she says.

The question has shaped Anderson’s work at Unum Group since she started in her role in May 2025. She has organized her IT department around end-to-end value streams and says that approach has helped her IT staff work more closely with the business and more readily identify where improvements can be made. She also has her IT organization working to better understand business processes, and has been working on building more capabilities to measure and manage AI costs as Unum seeks to transform using AI. And she’s looking at what investments and improvements are needed in IT’s foundation.

All these moves will enable the IT department to get better at value creation, Anderson says.

She plans to augment this work in the coming year by providing AI training and education for IT workers and employees throughout the company “so they know how they can drive value and find opportunities in their everyday use of AI.”

Ensuring she has the right mix of talent — meaning she has the right skills in the right seats to deliver value — will also shape the actions she takes as CIO in 2027, Anderson says.

“In 2025 and 2026 there was a lot of testing and learning, but 2027 will be a year of maturing. You’ll see more formal processes and settling in around how you’re going to leverage the skills in your organization to drive value,” she adds.

In Foundry’s 2026 State of the CIO survey, 83% of CIOs say their role is becoming more of a hybrid to lead both business and tech initiatives, rather than simply manage IT. As the two become more inseparable, the CIOs who see collaboration as a competitive advantage are putting daylight between them and those who see it as a cursory soft skill. And C-suites are responding as they rely more on IT to drive growth and accelerate efficiencies. So the CIOs who deliver the most value will bring collaboration skills to drive change and technical expertise.

Silos between IT and the business are falling

As the World Economic Forum notes, not every tech initiative requires deep collaboration. But as businesses move beyond routine IT investments into cross-functional, innovation-focused transformations, collaboration becomes essential.

For example, how can IT decisions help an organization open new markets faster, or emerging technologies reduce risk in areas like data privacy. It’s no surprise, then, that Deloitte found that 65% of CIOs reported directly to CEOs in 2025, up from 41% in 2015.

Because tech is now part of almost every business decision, it takes everyone’s expertise and insights — from the CIO to the CFO — to see the full picture of how an initiative will affect the company. Shared knowledge leads to better-informed decisions that give tech its biggest impact.

When silos persist, CIOs struggle to get buy-in for their initiatives. Protiviti’s Global Transformation survey found that while 61% of CIOs report being confident in their tech transformation outcomes, only 34% of CEOs and boards feel the same — and the gap is even wider for AI implementations.

That gap is, at its core, a collaboration problem. Without effective collaboration and communication, others can’t see the value of transformation efforts. CIOs who excel in these areas can more easily demonstrate value, win buy-in and keep their organizations at the forefront of technology.

Delivering speed and innovation

Collaboration goes well beyond getting buy-in. While it may be thought to slow IT down, it actually brings in the insights that make change more effective and faster.

As I’ve highlighted in the past, when organizations move away from rigid data ownership, cross-functional teams can share what drives further innovation.

The same holds across the C-suite. Perspectives from outside IT show CIOs how a tech implementation works for the company as a whole, and where new opportunities lie. That lets CIOs test, refine, and reshape solutions faster.

Most importantly, when teams share a common purpose and goals, everyone stays aligned on the best overall outcome for the business. Iteration happens much quicker because everyone is focused on the big picture rather than individual agendas. With increasingly rapid tech cycles, that speed is a competitive advantage in its own right.

Building your collaborative abilities

For CIOs used to the old way of doing things, shifting to a collaborative mindset can be a challenge. But like any capability, it can be developed and improved by applying some fundamental principles.

Earn trust through follow-through. Trust isn’t built at a kickoff meeting or with a mission statement. It’s built when people see you do what you said you would, again and again. For CIOs, that means delivering on commitments or flagging early when you can’t. Clear and consistent communication is one of the most reliable ways to build trust across an organization.

Make transparency the default, especially when news is bad. Transparency means more than status reports. It means being candid about costs, risks, trade-offs, and setbacks before they surprise anyone. When leaders sidestep difficult discussions, trust erodes and goals drift. And in technology programs, small unspoken issues have a way of becoming expensive ones.

Seek cultural fit in how you work, not who you are. Cultural fit isn’t about sameness or shared backgrounds. It’s about compatibility in management philosophy, values, decision-making, and communication. A CIO who values speed and experimentation, and a CFO who prioritizes predictability and control will clash unless both recognize the difference and agree on how to bridge it. The same is true when it comes to finding the best technology providers.

Focus on the what, not the how. Few things undermine collaboration faster than micromanagement. When leaders dictate how a colleague or partner should work, they signal distrust, stifle creativity and innovation, and tie up their own time policing activities instead of driving results. The better approach is to agree on clearly defined, measurable outcomes, and then step back. Letting go of the how isn’t giving up control but building enough trust that everyone gets there together.

This requires adjusting your workflows and skills, but the payoff is valuable insight from your collaborators and wins that lift the entire organization.

The new life of the CIO

The days when the CIO could simply be the tech expert behind the scenes are long gone. With AI and other technologies ingrained in every aspect of the business, the CIO must lead well beyond IT.

By making collaboration a priority, you can gain critical insights across teams to guide your tech strategy, and deliver the greatest value to your organization.

There’s no point building your own agentic AI stack for a non-core function when a vendor already has a product ready to go that meets your needs. For non-tech companies in particular, building from scratch can take time, money, and expertise they don’t have.

Take for example, Fertitta Entertainment, with more than 600 Landry’s restaurants and the Golden Nugget hotel and casino. After the pandemic, the company had problems adequately staffing its call centers, says its director of contact center operations Brian Jeppesen. “The agents didn’t want to come back,” he says.

The virtual assistants didn’t work because the user experience was bad, and with the incoming call volume, 40 to 50% of them were abandoned.

“Everybody wants AI, but nobody wants BS,” Jeppesen says. “I talked to my CFO. This is what we’re abandoning. This is the potential revenue we’re losing. I can’t throw bodies at it anymore.”

Agentic AI has upped their game for the virtual assistants. Instead of only answering simple questions like check-in hours, it allows the company to connect APIs and carry out more complicated tasks, like making reservations.

“My abandonments fell to under 10%,” says Jeppesen. “From waiting 45 minutes to an hour, they can get their questions immediately answered, or immediately transferred and taken care of.”

And turnover went down. Call centers typically see 100% turnover, says Jeppesen. Not because everyone quits, but because the bottom 25% quit and need to be replaced over and over again.

Now that bottom tier doesn’t have to be rehired, while the people who stay are the most knowledgeable. “They give a better experience for my customers,” he says. “And it reduced my attrition by 50%.”

Forrester did a total economic impact study for the specific vendor that Fertitta used, PolyAI, and the ROI came back at 391% over the course of three years, with a payback period of less than six months.

Jeppesen says he reviewed his own numbers and found that the automated reservations system alone brings in 3,000 reservations a month. “That’s $600,000 in revenue a month for us without the need to speak to an agent,” he says.

Next, Fertitta plans to expand it to handle to-go orders and web chats. There are also opportunities for agentic AI on the technical help desk, Jeppesen says.

Agentic AI on the menu

Fogo de Chão, a Brazilian restaurant chain with around 120 locations, is also deploying agentic AI in small, focused use cases, and sees ROI with some of the projects.

For instance, it deployed virtual call center agents from PolyAI, and saw positive ROI from day one since there were no significant up-front costs or usage-based pricing. After several months of testing and small-scale pilots in 2025, the system has been rolled out across the US, with 100% of calls now being answered instead of up to 25% being dropped, and a 10% increase in total bookings that wouldn’t have happened otherwise, says Michael Breed, the chain’s chief marketing officer.

“If we compared it to a media channel, it’d be twice the ROI from other media channels,” he says. “It’s almost like another customer acquisition vehicle.”

The company is also building agentic workflows for its team members.

“We’ve identified jobs that are very repeatable and time-consuming, and we’re training agents to take those tasks,” he says. These are low-risk jobs, like proofing menus or other text, or replacing manual processes, such as pulling data from one system into another that had no automatic integrations.

“The agent does a great job bringing in the data, then the human in the loop can inspect it,” says Breed. “Is it getting classified right? Is it getting to the right places? And when guests are dissatisfied, can we make it better?”

Built for SMBs

For smaller companies in particular, off-the-shelf agents make the most sense. AltaClaro, for example, builds training simulations for lawyers, and counts more than 100 of the top 200 US law firms as customers, all with just 10 employees.

One product is a deposition simulator, says CEO Abdi Shayesteh, a completely agentic, voice-based platform.

“It’s a fully simulated environment that creates the experience of doing the deposition,” he says. “Different agents play the role of the witness, opposing counsel, and the court reporter.”

He says it’s kind of like a Zoom call. The product is built on top of technology from Verbit, a legal tech company with a custom agentic platform.

“They’re taking care of the technical infrastructure and we have the material to ground the AI.”

A different vendor, Credal, provides a secure AI platform that allows AltaClaro to switch between different models. It can obfuscate names and keep other sensitive data from leaking out, Shayesteh says. “It ensures everything is anonymized and does secure calls,” he says. “We standardized on Credal because it’s highly flexible and secure. We serve law firms and we’re as invested in security as they are.”

But security isn’t the only issue that enterprises face when deploying agentic AI.

The hidden costs of buying AI

The temptation to jump into agentic AI is high, says Dana Simberkoff, chief risk, privacy, and information security officer at AvePoint Inc., a data security company. And off-the-shelf agentic AI can be so easy to adopt that companies deploy it before they’re prepared for it.

Enterprise vendors will often add the technology at no extra cost, just to get people using it, and companies turn it on for their employees before truly understanding what it does, and before systems and workflows are ready. “Then it immediately exposes problems that were already there,” she says.

Say, for example, an agent helps with research, normally considered a low-risk task.

“AI will follow sharing links across documents,” she says. “So if you haven’t taught your users how to properly use sharing links, the AI agent is just going to follow that path, and it could expose information that might have been obscured in the past. It’ll gobble up everything it can.”

The result is it could expose HR data, personal information, or proprietary information to people who shouldn’t have access to it. One company she knows had to shut down their AI project immediately and go back, classify, and label all their information, put governance controls in place, and teach people how to apply metadata.

According to Gartner, by next year, 40% of enterprises will demote or decommission autonomous AI agents due to governance problems that only show up after they’ve gone into production.

Token management

Another hidden cost of off-the-shelf AI? Token use. When agentic AI is embedded into a system that a company is already using, then the cost of switching it on can be as low as zero. But someone has to pay for all that token use.

When agentic AI comes out of pilots and goes into production, usage can change dramatically, and token costs can quickly spiral out of control. It doesn’t help that agentic AI use typically requires much more tokens than AI chatbots.

“A lot of the embedded AI should be utilized,” says Doug Vargo, head of the national AI and alliances team at consulting firm CGI. “If big parts of your business processes are living and breathing in ServiceNow, Salesforce, or another application, you should leverage that, but you need to understand the cost.”

This is playing out in the marketplace right now, he adds, as underlying model providers change their token costs.

“That changes the economics of the decisions,” he says. “And six months from now, it’s a different discussion, because they’re going to continue to move the needle.”

The employer’s prerogative

Another hidden cost that companies might miss is they need to put training and support systems in place for employees. Many off-the-shelf agentic AI tools might seem easy to use, but actual adoption still requires change management. CGI did offer training to employees when it rolled out GitHub Copilot, a popular coding platform with agentic functionality. “And we expected them to adopt and leverage it on day one,” says Vargo. But people quickly went back to their old ways of working, he says, and CGI had to pivot its strategy.

“It’s going from training programs to habit formation or transformation programs,” he adds. “And we’ve seen adoption skyrocket.”

The change isn’t in just how individuals adopt AI to improve their own work, though. “You’re now a manager of 10 to 20 specialized agents that are driving that work for you,” he says.

The error is when companies put the technology first. “They fall in love with the tech or a vendor, but they’re not really thinking about how they’re truly integrating these tools and technologies into the business.”

Embracing change

Change management is a particular challenge with agentic AI because the tools are changing at such a fast pace.

“It’s technology that’s constantly changed almost every month, or maybe every week,” says Scott Likens, chief AI engineer at PricewaterhouseCoopers. “The challenge I see is the timescale of change is much faster than what we’re used to.”

We’re still in the early stages of agentic AI, he adds, and waiting isn’t a good strategy. “You have to start, but keep flexibility over longevity in mind,” he says.

For Luis Huerta, group head of gen AI and agentic automation at International Airlines Group (IAG), change management is one of the most complex parts of agentic AI adoption, as it uses agentic AI to improve customer experience, operations, and efficiency.

“The technology is powerful, but the bigger shift is organizational,” he says. So the company isn’t just focusing on building agents, but also on business ownership, adoption, and governance, and helping colleagues understand how these capabilities change the way work gets done and how it can support them, rather than replace them.

Huerta says IAG also uses agentic capabilities embedded in enterprise platforms, but also builds its own agents, too.

They’re not alone. According to Anthropic’s 2026 State of AI Agents report, 47% of organizations take a hybrid approach to AI agents, while 21% rely entirely on pre-built agents, and 20% build their own.

“We take a technology-agnostic approach,” says Huerta. “Our priority is to select the right solution for each use case.”

CIOs are dealing with a lot of change, from the rapid rise of AI and cloud modernization, to cybersecurity and workforce transformation. Many are sharing what they’re learning as they tackle these challenges, including what’s working, what isn’t, and how they’re implementing new technologies in their organizations. Here, a select group of tech leaders reveal the CIOs they follow and why.

Suma Nallapati, chief AI and information officer, City and County of Denver

I follow Suma Nallapati primarily through public technology and AI leadership discussions. She regularly discusses AI adoption, responsible AI, digital transformation, technology strategy, AI governance, human-centered technology, and using AI to improve public services. I find her perspective particularly valuable because she connects AI strategy with practical organizational and citizen outcomes. She also emphasizes responsible and human-centered AI rather than viewing AI simply as a technology implementation exercise. One initiative I found particularly interesting was Denver’s use of AI through its multilingual Sunny chatbot and other city services. Her current role includes scaling AI across areas such as resident engagement, internal automation, permitting, and emergency response while maintaining governance, transparency, and public trust. – Sachin Gupta, senior IT manager, Arrow Electronics

Jennifer Hartsock, chief information and digital officer, Cargill

I follow Jennifer Hartsock through the CIO community, as well as through her thought leadership, interviews, and LinkedIn. I especially enjoy hearing her perspective in longer-form conversations where she talks candidly about the realities of leading technology and transformation in a large, complex organization. Hartsock talks about many of the issues CIOs are navigating right now, including AI, digital transformation, technology operating models, talent, and leadership. A consistent theme in her perspective is connecting tech decisions back to the business, including how tech teams work with the business, and how you create greater ownership closer to the outcomes you’re trying to achieve. – Kathy Kay, EVP and CIO, Principal Financial Group

Fletcher Previn, SVP and CIO, Cisco

Fletcher Previn’s profile shows how a modern technology leader can discuss change without reducing it to a narrative about vendors. He explores AI, culture, talent, and productivity, with an emphasis on conditions that determine whether transformation lasts. The insight worth returning to is his focus on adoption as a leadership responsibility. New technology fails when teams lack learning time, managers lack clarity, and incentives reward behavior that no longer serves the business. CIOs can apply that lens to modernization, security initiatives, and data governance. It encourages an honest definition of progress based on decisions and outcomes rather than launch dates or dashboards. – Sherif Koussa, CEO, Software Secured

Kellie Romack, CDIO, ServiceNow

What makes Kellie Romack’s perspective valuable is she talks about AI from inside a large enterprise IT organization, not the outside. Her posts regularly cover enterprise AI, AI governance, autonomous IT, workforce transformation, cybersecurity, digital transformation, and how the CIO role is changing.

The point that stayed with me was her argument that CIO organizations now have to redesign jobs, teams, and workflows around AI while building new human skills at the same time. That’s a useful distinction. It frames successful AI adoption as an organizational and leadership problem as much as a technology one. Her seat at ServiceNow also gives her a view of what happens after the experiments stop. ServiceNow has reported that its internal AI use cases grew from 15 to more than 200. That makes her worth reading about for any CIO trying to understand what scaling enterprise AI actually looks like. – Tapabrata Biswas, project manager, InfluxIQ Tech Pvt. Ltd.

Mike Blandina, CIO, Snowflake

I follow Mike Blandina for his practical perspective on enterprise AI adoption and the operational realities behind digital transformation. His commentary consistently connects emerging technology with the governance, workforce skills, and measurable outcomes needed to make it useful. One insight that particularly resonates with me comes from this CIO.com article.

He makes the case for building an editing culture rather than a writing culture. As AI increasingly handles first drafts of code, reports, and other work, he argues that the critical human skill becomes evaluating outputs, identifying mistakes, and knowing when to challenge the system. I also appreciate his emphasis on data lineage, access permissions, and measuring actual productivity improvements instead of AI tool logins. Those are the less visible decisions that determine whether enterprise AI adoption delivers lasting value. – Parth Patel, director of operations, Shaligram

Deepa Soni, EVP and CIO, New York Life Insurance Company

Deepa Soni’s insights are particularly valuable because she oversees AI in one of the most critical and regulated sectors of financial services, a Fortune 100 life insurance company where AI decisions have real consequences for policyholders and regulators.

Soni frequently shares in-depth thoughts on what responsible AI adoption truly looks like within a large financial institution. She discusses the delicate balance between the speed of innovation and the readiness of governance, as well as how tech leaders can foster cultures that promote both agility and accountability. What sets her apart is that her approach to AI strategy is rooted in operational realities rather than just vendor hype, which is a rare and precious perspective for CIOs facing similar challenges. – Viren Meghani, technical architect and independent researcher in AI governance

Sears Merritt, CIO and head of enterprise technology and experience, MassMutual

I follow Sears Merritt on LinkedIn and through his interviews. He talks about what enterprise AI costs to run and how to keep the option to change your mind. Merritt also discusses why AI vendor contracts should be capped at 12 months to maintain flexibility, how success metrics are defined before AI pilots begin to determine whether they should be scaled, and the data platform he spent three years building before the AI wave arrived. This is useful to other CIOs because he’s one of the few CIOs at a regulated insurer who talks about AI in the language of procurement and measurement rather than vision. – Egiziago Cioffi, IT/enterprise architect and CEO, SynSphere Italia

Ganesh Ariyur, CIO and head of enterprise technology, Gainwell Technologies

I follow Ganesh Ariyur for his insightful views on AI, enterprise architecture, transformation, tech strategy, governance, and ways CIOs can link tech investments to quantifiable business value. What I find particularly helpful is his content extends beyond just talking about new technologies. He continually positions technology choices in relation to business results, operational frameworks, financial discipline, and implementation. This is particularly important for CIOs facing pressure to showcase ROI from AI and modernization efforts.

An example is his work, The 2026 CIO Operating Model: Architecture, AI, and Enterprise Value. His main point is that tech strategy must be viewed more like capital strategy, with CIOs assessing issues like if cloud expenditures enhance unit economics, and if architecture facilitates quicker decision-making. That viewpoint is important as it transitions the dialogue from which technology to implement, to what ways technology should transform the enterprise’s operations and value creation. – Ketan Patel, digital marketing manager, WeDoWebApps

Jim Swanson, EVP and CIO, Johnson & Johnson

I’m interested in how Jim Swanson thinks about the relationship between technology and the business, particularly where innovation carries considerable responsibility. For example, he recently discussed how AI agents are changing the way people interact with enterprise software. What caught my attention was his emphasis on the complexity that comes with that change — the integration, oversight, and accountability required to make it work. Those are questions that deserve as much attention as the technology itself. – Bill Huber, partner, ISG

Kimberly Basile, CIO, Kyndryl

I follow Kim Basile along with her bylined pieces on Kyndryl’s newsroom and interviews in the business press. She discusses enterprise AI adoption, workforce readiness, AI governance, platform modernization, and security leadership, informed by her earlier role as SVP and CISO at Leidos. Basile speaks from inside a transformation few CIOs have experienced, having helped guide Kyndryl’s technology separation from IBM and consolidate its application portfolio. She treats governance and people readiness as part of AI adoption from the start, and she’s candid about what hasn’t worked. In a recent feature on agentic AI, for instance, she said Kyndryl initially focused on counting agents, and the number didn’t tell the true story. Her team pivoted to measure business process flows. She also identified automating a process that hadn’t been properly validated as one of the company’s biggest mistakes. Activity metrics are easy to report, so organizations default to them. Her lesson pushes CIOs to validate a process before automating it.

She matters beyond the technology because women remain underrepresented in IT leadership, and she uses her visibility to lift others. When she was named to Women We Admire’s Top Women CIOs of 2026, her second year on the list, she used her post to congratulate the other honorees by name and highlight how these leaders help employees embrace technology. That generosity matters in a field where women CIOs are still too few. As the co-founder of Girl Power Talk, I pay attention to leaders who open doors for the next generation of women in tech. Basile does that consistently. – Sameer Somal, founder and CEO, Blue Ocean Global Technology

For years, enterprise AI strategy has been dependent on a small set of proprietary, closed model providers, a limitation that has carried cost, lock-in and opacity. Now, open-weight models from Meta, Google and other global competitors are challenging that default. As of July 2026, open-weight models accounted for 36% of Vercel’s AI Gateway token volume, up from 11% in April, while share of spend more than doubled to 8.6%.

Floyd DCosta and Allan Dabre have made compelling cases for greater enterprise control over AI, particularly for strategic and security reasons. I agree, but making the case is easier than moving an organization wholesale to open-weight models. My advice for technology leaders is to stop debating the theory and start experimenting.

From personal to team experimentation

My hands-on experience with open-weight models started with a mentor recommending OpenClaw, an open-source AI agent designed to be a personal assistant. So, I tried running it with my ChatGPT subscription and burned through my quota so fast I could barely use ChatGPT for development, let alone regular chats. Then I found Ollama, which lets you run open-weight models locally and in the cloud. For the same monthly fee, I got significantly more OpenClaw usage because of the lower token cost.

Today, that setup has evolved to Hermes powered by GLM 5.3 Flash on Ollama’s cloud offering.   This configuration powers a personal assistant that helps manage my calendar, coordinate family logistics and surface relevant articles. If it went away, I wouldn’t be doomed, but being able to play with this tool has been unexpectedly useful.

My main takeaway from these experiments is that the performance gap between open-weight and frontier models is narrowing faster than many realize. That honestly surprised me.

So, I’ve now expanded my experiment by encouraging my team to use Gemma, an open-weight model from Google that offers enterprise-grade compliance. Gemma runs locally on a MacBook or in the cloud alongside Gemini models, offering flexibility and customization without full retraining.

Using Gemma for standup reports, issue triage and log monitoring gives my team hands-on experience with how these tools fit into our workflows and collaboration patterns without substantial infrastructure or token costs.

Bringing open-weight AI into the leadership conversation

Preliminary experiments like mine provide helpful insights: what tasks the models handle well, where they fall short, what the cost comparison looks like. That’s enough to start a conversation with your leadership team about where open-weight models fit into your AI strategy.

But how you frame that conversation matters. Don’t assume everyone in the room can parse the differences between open-source, open-weight and closed models. I’ve found it more productive to start with where the organization sits today. Our production environment and internal employee tools run on closed models, and for good reason: compliance coverage, enterprise support and predictable performance.

So, when my team started experimenting with Gemma alongside that stack, I wasn’t trying to replace a closed model vendor. I was trying to answer a specific question: where could an open-weight model take on tasks at lower cost without creating new compliance work? Based on my success streamlining my personal admin burden, having my team do the same made a lot of sense. Now I hope we can scale similar use cases across our organization to help teams spend more time on high-value work, and less time on administrative tasks.

What enterprise agreements bring to the equation

Depending on your business, an enterprise agreement provides more than access to a model;  it provides the infrastructure around it. Whether I’m using Google’s closed model Gemini or open-weight Gemma, I rely on enterprise agreements for compliance. Because my organization handles sensitive data, I’m cautious about using frontier research-tier models that require data retention.

I align my engineering organization to ISO 42001, the international standard for AI management systems. Using Google models off the shelf means Google’s compliance regime drops into my security program.  I’d hesitate to modify an open-weight model for production, even one I trust like Gemma, because my team would then have to manage compliance for the modified model.  If customization was a core concern, adding a RAG database to an agent or an organic workflow may deliver results similar to fine-tuning without modifying the model.

No matter how open or closed the model is, my organization carries the risk that an enterprise contract can help mitigate. I’d need to see outstanding results to justify the hidden costs of customizing models: legal review, audits, documentation, bias assessment — responsibilities that fall outside my engineering team’s core competencies. Those compliance constraints shaped how I think about governance at the organizational level, but the instinct started earlier.

How personal boundaries can inform healthy enterprise governance

When I built out my agent, I had to decide what I was comfortable with letting it access. ChatGPT and Claude can browse the internet by default, while with open-weight models, that’s a capability you have to enable. My open-weight-powered personal assistant wasn’t going to be useful without internet access — so I turned it on. I didn’t give the agent access to my email, but I did let it read my calendar and our family to-do list. Each decision came down to the same question: What’s the worst thing this agent could do with this access, and can I live with that? Internet browsing was worth the risk because the agent is far less useful without it, even though a malicious website could try to feed it bad instructions. Calendar access felt low risk; the worst outcome was a bad reminder. Email was where I drew the line. An agent that can send messages on my behalf can do real damage, and I’m not ready to accept that risk.

That same boundary applies to outputs. Just as I restrict what an agent can do with my data, I restrict what it can generate on my behalf. The model acts as an advisor and a critic, but the final work remains mine. As watermarking advances and scrutiny of synthetic content grows, today’s work will be auditable tomorrow. The inevitable backlash will fall on those who outsourced their critical thinking rather than using the tool to sharpen it. Keeping the model in an advisory role protects both personal integrity and work quality.

Where you should start

The realities of working with open-weight models — the compliance costs, the access decisions, the gap between experimentation and production  — are complex. For most organizations, wholesale switching isn’t realistic,at least not yet. But that doesn’t mean open-weight models aren’t worth exploring for specific use cases.

That’s why I advocate for a measured approach. Carve out some cycles for hands-on experimentation, but do it with eyes wide open about the practical limitations.

Here’s a process I recommend following.

1. Identify a specific use case or problem area where open-weight models could provide value.
2. Start small with a focused experimentation project, perhaps within a single team or department.
3. Engage with your compliance and legal teams early to understand the risks and requirements.
4. Document what you learn and share widely with your organization.
5. Use hands-on insights to inform your broader AI strategy and roadmap.

Open-weight models offer substantial architectural freedom, but that freedom is hollow without explicit operational guardrails. Before expanding these tools across the enterprise, establish clear lines around what data they touch, what they are permitted to generate and who carries the compliance burden when systems fail. Treating the model as an auditable advisor rather than an autonomous actor protects your organization from unnecessary legal exposure while capturing real productivity gains.

AI has a cross-cutting impact on businesses. It’s changing operations, management, and even decision-making processes. But it’s also modifying what they expect from their teams and how they’re organized. This has a direct impact on the decisions of both HR departments and CIOs, who must now consider issues that, until now, have flown somewhat under the radar.

In fact, the desired professional profile is pivoting. Research from Spain’s Open University of Catalonia (UOC) has found that polymath profiles are gaining value in the AI ​​job market based on changing needs and evolving expectations of skills. Now, in addition to understanding and leveraging technology, being creative, capable of critical thinking, and able to grasp the nuances of things, are essential. This is where polymath profiles are experiencing a potential golden age.

It’s important to first clear up the misconception that a polymath is someone who knows a lot about many things. “A polymath is rather someone who possesses relevant knowledge and skills in multiple disciplines,” says Óscar García Gozálvez, senior director of permanent staffing services at Hays Spain. “It’s also someone with broad and cross-disciplinary vision who’s able to make connections in order to problem solve, innovate, and make better decisions.”

Laia Lluch Molins, professor and researcher in education studies at the UOC adds that the difference isn’t in how much a person knows, but what they do with what they know. These types of workers are able to formulate new questions and solve problems that none of those disciplines could on their own. These qualities are what has made them so valuable and attractive to today’s companies.

Knowhow in the age of AI

With AI’s abundance today, simplicity is no longer the norm. “AI is making technical knowledge cheaper and anyone can access the best explanation for almost anything in seconds,” says Molins. “What’s scarce is no longer knowledge itself, but the ability to make informed judgments.” AI isn’t just replacing tasks, Gozálvez adds, it’s breaking down the barriers between disciplines.

Therefore, polymaths don’t simply tick off endless lists of tasks but connect the dots to find keys to success. “They don’t compete with AI in what AI does well, but rather help solve what AI struggles with,” says Molins. This forces a change in how we perceive the ideal profile, as well as pivot on where value can be created. “In the workplace, this translates into a shift in criteria from how much a person knows to how they apply that knowledge to a new problem, situation, or context,” she says. “What’s valuable now is how that knowledge is leveraged and how it’s used to respond to new challenges.”

These new profiles are of interest because they generate more economic and strategic value for the entire company instead of being contained to isolated specialists.

The necessity of change

The corporate culture also has to adjust in consideration of new dynamics put into practice. “Tell me how you evaluate your team, and I’ll tell you what kind of profile you’re developing,” says Molins. There might be a lot of talk about cross-functionality, but if it’s neither respected nor listened to, multi-talented individuals won’t contribute value and will stop sharing new perspectives.

This may be one of the biggest challenges for CIOs, because the IT environment has tended to reward technical depth. “This recognition system doesn’t always know where to place someone whose worth lies precisely in connecting, translating, and asking the questions that others don’t,” Molins says. “The risk isn’t the polymath profile not fitting, but the culture lacking the categories to appreciate it.”

Even so, Molins says this need is already known internally since bottlenecks are mostly due to miscommunication or a lack of alignment with the business, not technical hinderances. “There, the hybrid profile isn’t a foreign body, but rather the missing piece,” she says.

For now, though, IT hiring trends don’t yet show a boom for polymaths. “If we look at the Spanish market, for instance, we’re not seeing a massive demand for generalist profiles,” says García, but adds there’s been an increase in searches for professionals with a strong primary specialty, and a second or third skill that amplifies their impact on the company.

“My feeling is it’ll accelerate over the next three to five years,” he says. Companies are still learning to incorporate AI, and the next phase will be learning how to work in those environments where AI has changed everything.

What the IT team needs

In this new landscape, IT professionals will need to be able to communicate in different languages ​​and understand new fields. The paradigm is shifting, and in addition to advanced degrees, increasingly specialized training programs are recommended.

Regarding polymath profiles and their areas of expertise, the key will be the emergence of three intersections, as Molins calls them. These include business acumen, as something transversal and valuable, communication and collaboration skills to ensure smooth flow and avoid silos, and knowledge of humanities and social sciences, which encompass key issues such as ethics, something that will gain considerable weight in the coming years, according to García.

Until now, he explains, the IT talent career path has been very focused on tech skills, but in the leap to real-world adoption, much more complex questions arise such as biases, data ethics, and responsibilities. “That’s precisely why there’s growing interest in profiles that combine technology, risk, compliance, and AI governance,” García says.

These points of friction will define expectations for what is sought in technology personnel. “The strength of the hybrid IT profile is having a solid technical foundation from which to build bridges with sound judgment,” says Molins. So collaborations are sought after, such as software engineering with AI, data with cloud, cloud with security, or cybersecurity with risk and compliance. And, above all, critical thinking and business acumen — communication skills that have been discussed already for a long time.

There are plenty of individual AI success stories across the enterprise, but scaling AI continues to be a challenge.

Data from McKinsey’s “The state of AI in 2026: On the road to ROI” survey shows that four in five respondents report that AI has improved individual productivity. The survey also found that in organizations with annual revenue of at least $1 billion, 40% are scaling AI agents and 31% are scaling software coding agents. At smaller organizations, 22% are scaling AI agents and 17% are scaling software coding agents. Further, the proportion of AI high performers, those who report significant impact and attribute at least 5% of EBIT to using AI, remains flat at 6% year over year. Still, only 37% report AI making a positive contribution to their company’s EBIT.

In conversations with CIOs and IT executives, scaling AI is a high priority. Based on a synthesis of these various interactions, here are ten guidelines for successfully scaling AI across the enterprise.

1. Learning by experimenting with AI is a high priority

Encourage individual experimentation with AI and share outcomes. Start by exploring alternatives to restrictive control including hub-and-spoke participation, education and self-governance.

For some knowledge workers, experimentation will require changing their view of AI beyond being a powerful search engine.

Assessing progress during the experimental phase comes down to how much AI is used, actual time savings versus perceived savings, and the reported usefulness. It helps to establish baselines and measure whenever possible to avoid the common mistake of employees confusing AI activity with delivering value.

The shared learning is critical to getting employees comfortable using AI as well as applying lessons learned to build a successful AI foundation. With the proper care and feeding, AI moves from being an optional digital assistant to a vital digital colleague.

2. Choose pilots strategically

Select fewer, prioritized pilots in areas of the business that combine high business impact and lower risks. Ideally, these pilots will have access to sufficient data and include stable processes. Success also requires a sufficient workflow volume, integration feasibility and measurable results. The primary goal of such strategic pilots is to determine if and how AI can improve a specific business task.

The viability of the pilot should be evident by the quality of the tasks augmented by AI, the time and costs to develop it, and the ability to integrate the pilot with the overall system.

3. Assign business ownership

Successfully scaling AI across the enterprise requires business ownership, shared business/technology accountability and persistent product teams.

Pilots should be led by a business sponsor to make sure that, beyond a technology experiment and learning opportunity, it’s an application area that will positively impact the business.

The leader should also be accountable for the outcome and the impact of the pilots across lines of business including technology, data, security, legal, risk management, HR and operational partners. Value realization is the finish line, and business outcomes are distinct from technical outcomes.

4. Know when to redesign enterprise workflows

One important signal for enterprise workflow redesign is when the impact of AI on people, systems, controls and decisions reveals broken processes that need to be resolved. The redesigned workflows should be specific about where and when AI can make recommendations and resolve issues through human-AI collaboration, and when AI can make decisions on its own and take actions by automating specific tasks. In general, automation should be reserved for relatively simple, well-understood, low-risk tasks.

When human-AI collaboration is involved, the employee must have the required time, skills and authority to intervene as necessary. Human decisions or interventions should not be reduced to simply checking a box to approve.

5. Make governance part of the workflow

Responsibility and accountability are foundational governance principles.

Think of governance as a decision architecture that defines who is responsible, where the boundaries are and when human judgment adds value, based on a risk assessment. While the AI system can be permitted to recommend decisions and act within defined limits, organizational accountability must remain with people in their authorized roles.

Governance should be in place throughout the workflow process, not only at the end. The governance will include explicit rules for decision rights, permitted data, risk tiers, test criteria, monitoring, auditing, escalation, incident response and retirement of the newly built business products.

Employees should view governance as an enablement framework for safe growth.

6. Shift from tool sprawl into reusable foundations

Scaling workflows demands an architectural shift away from technology and tool sprawl into common platforms and reusable enterprise foundations. It requires identifying which shared services, patterns, data products and domain governance can be quickly redeployed while increasing the value of the portfolio. A lack of shared standards, platform visibility and an architectural playbook will limit the ability to scale.

To ensure that individual teams are not building their own custom stacks, it is critical to have a strategic view of each project, workflow and business product throughout the enterprise.

7. Build in flexibility for continuous improvement

As AI scales, CIOs need to determine how the organization will continue to govern the portfolio and continuously improve the system while supporting ongoing enterprise learning. One strategy is to use open architectures that can evolve as platforms change.

The foundation should be sound enough to scale yet offer flexibility when it is necessary to shift decision rights, standards, feedback loops and employee roles. Strive for the achievable balance between a centralized foundation that supports common platforms and standards to reduce fragmentation while allowing continuous learning and local innovation as AI evolves

8. Measure outcomes

To successfully scale AI, leaders need visible transformation and dashboards, pre-defined business metrics and continued measurements.

According to the McKinsey survey, 80% of respondents report that AI has improved their individual productivity, and 50% report that it helps them make better decisions.

However, achieving these types of results and better ones starts with establishing a pre-AI baseline. From there, include the following metrics for the measurement process: cycle time, throughput, quality, revenue, cost, risks, customer and employee experiences, and enterprise adoption.

Another measurement factor is anecdotal successes. It reflects the organization’s willingness to experiment and share learnings. However, anecdotes should be benchmarked against actual data, when possible, to identify areas that need more attention and resources.

9. Check for signs a pilot is ready to scale

Successful deployments start when AI is connected to roles, data, rules and systems, with strategic use of humans in the loop. Business impact, data readiness, safety, adoption, economics, repeatability and reuse were consistent themes of such readiness.

You will know a pilot is ready for bounded production when ownership is clear, the workflow is redesigned, the integrations run on a live system and success is measured with representative volume. Moving into deployment at scale is possible when the pilot is stable and operating at volume. It becomes reproducible when a second site can adapt the architecture and governance, follow a playbook and prove viability. Finally, pilots can then be expanded into new domains, but it requires different evidence.

10. Anticipate workforce changes

Transformative technologies succeed when innovation is combined with trust, collaboration, entrepreneurship and organizational change. AI adoption will change management practices, employee roles and even career paths. Just as architecture and governance are mapped to support scaling AI, workflow changes will influence roles and activities including executive education, succession planning, job descriptions, training and development, communications and incentives. The needed workforce changes will vary by task, industry and organizational maturity.

Choose the right path for your organization

Every CIO has their own path for scaling and deploying AI in their organization. As we learned during the 2026 MIT Sloan CIO Symposium, there is no one specific or perfect route, and several approaches may be used simultaneously. CIOs will need to look beyond the infrastructure. They will also need to redesign work, establish governance and build AI skills. It will be critical to share lessons learned and best practices to collectively accelerate productive, cost-effective, scalable AI in the enterprise.

Organizations are rapidly implementing AI, but employees often feel left behind about how AI is changing their roles. While AI can help get work done faster, it won’t necessarily help produce better quality work if employees aren’t confident in their AI skills.

In fact, a recent survey from workforce analytics firm Visier reveals that 48% of employees report exaggerating their AI expertise at least some of the time, and 45% said they often feel pressure at work to use AI despite not feeling confident with the tools.

“The risk of underinvesting in training and upskilling is that the alternative can be much more expensive,” says Andrea Derler,  principal researcher at Visier. “Layoffs, rehiring, and competing for top AI talent all come with significant direct and indirect costs. Investing in the workforce organizations already have can be an important part of making AI adoption sustainable.”

When the pace of AI implementation is rushed, however, employees often default to AI compliance, meaning they’ll use AI tools as they’re rolled out, even if they haven’t received the proper guidance or training from their organization to make the most of the investment. So for companies investing millions into an AI future, adds Derler, it’s critical to ensure employee participation is part of the bigger picture to avoid performative AI usage.

Make the most of AI investments with training

Derler acknowledges that AI adoption goals vary widely from company to company. Some will need stronger investment in upskilling and training, while others might need to invest in new resources, talent, or tools to help employees get comfortable with the new pace of work, and to source the right skills for an AI-driven workplace.

Either way, the early stages of AI adoption should involve a basic framework to assist in employee adoption, one that involves open transparency and foundational guidelines for how AI will be implemented moving forward. At bare minimum, employees should be briefed on concepts around general data security, how to spot false outputs from AI tools, and expectations around AI’s impact on their job roles.

“A few foundational skills and concepts every employee should understand include protecting sensitive data and uploading information with the greatest care, understanding the basic capabilities of approved tools available at work, and checking the work before sending AI-generated output to others,” says Derler. “Most importantly, employees need to take full responsibility for the output. The AI isn’t responsible, the person using it is.”

Avoid setting blanket goals as well, where everyone is measured simply by a certain percentage of AI usage per individual or team. This can overlook reality, she says, creating a false narrative around AI usage and adoption, and a focus on quantity rather than quality. Instead, adds Derler, leaders need to strike a balance between mandating adoption and encouraging employees to explore, discuss, and learn together where AI makes sense.  

Embracing transparency around AI

When asked if they felt their organization had a clear plan for how AI affects employees and jobs, 59% in the Visier survey said they didn’t believe or were unsure that their company had a clear plan for AI implementation. And only 28% said they felt leaders in their organizations fully understand how employees use AI today, while 33% thought leaders understand how much training and support employees need.

Overall, employees are eager to embrace AI, but when asked what would boost confidence around using it at work, respondents first ranked AI training and upskilling opportunities as most important, then greater transparency from leadership, more opportunities for career growth and advancement, followed by better communication about how AI will impact employees.

Clarity from the top

Employees have made it clear they want training and transparency from leaders about how AI will affect workflows and processes. This is especially true when it comes to career paths, as AI stands to remove certain skills and expertise deemed irrelevant.

Workers know the future will look different in the wake of AI, but they want to understand exactly what that looks like so they can prepare and shift their own expectations and career goals. Part of keeping employees engaged is ensuring they’re invested in their own future at a company, but that’s difficult if the future is particularly unclear.

“Most organizations are still learning which parts of a workflow AI can take over or augment, so creating opportunities for experimentation and learning is an important step before setting formal adoption goals or metrics,” says Derler. “Many organizations, however, are still piecing together workforce data and don’t have a complete picture of their workforce, making it harder to understand where AI can create meaningful efficiencies.”

Few CIOs are likely to suddenly decide to give an AI agent broad authority over corporate systems. The more likely path to autonomy is far less dramatic. An agent starts with a narrow task. It proves useful, so another system is connected. It then needs more data, so another permission is added. Then human approval becomes a bottleneck, so the organization removes it, and exceptions that once went to people start being handled automatically.

Each decision may be sensible in isolation. Taken together, however, they can leave an agent with considerably more authority than anyone originally envisioned.

That’s the danger of autonomy creep. And as enterprises move from AI systems that recommend actions to agents that execute them, CIOs need to govern not only what those agents were originally designed to do, but what they have gradually become capable of doing.

It starts with small permissions

Jim Taylor, president and chief product and strategy officer at identity security company RSA, sees a familiar pattern. Organizations typically create an agent for a specific purpose and give it the permissions necessary to accomplish the task. Later, the job expands.

“They just give it tasks, permissions; it just sits there and accumulates things,” he says. “Over time, it develops potentially toxic combinations. It gets too much access and can see too much data. It can do too many things.”

Humans accumulate permissions, too, of course, but organizations have developed processes around employees joining, changing roles, and eventually leaving. Agents may not have the same natural lifecycle. “They never give permissions back,” Taylor says.

Nancy Wang, CTO of 1Password, argues that CIOs should treat each expansion in an agent’s responsibilities as something more consequential than another feature. “Every time you expand the scope of the agent’s effective authority, you’re essentially adding a new authorization boundary,” she says.

That distinction between capability and authority is important. An agent may be technically capable of accessing a system, changing data, or executing a transaction, but that doesn’t mean the enterprise should automatically authorize it to do so.

Success can weaken oversight

Ironically, autonomy creep often occurs when AI works well. Paul Dongha, head of responsible AI and AI strategy at NatWest Group, sees that potential at the bank.

NatWest deployed agents in complaint handling, he says. Parts of the workflow that involve retrieving information from systems can be automated relatively easily, while humans continue to make the final decision on whether to uphold or reject a complaint.

If a system consistently produces the correct result, human reviewers may begin treating approval as a formality. The organization may eventually decide that the check is no longer necessary. “The temptation is to give over to the AI because it’s so reliable,” Dongha says.

NatWest sometimes reduces checking when an AI system demonstrates sufficiently high performance, he adds, but the decision is deliberate rather than incremental. It involves stakeholders and risk managers, and the system continues to be monitored afterward.

That’s a critical distinction for CIOs. Removing an approval step doesn’t necessarily represent poor governance. Removing it because everybody has gradually stopped paying attention to it does.

The warning sign is when a human moves from making a meaningful decision to merely rubber-stamping one — and then entirely disappears from the workflow without anyone reassessing the authority the agent has gained.

Put the controls outside the model

As agents acquire more authority, CIOs can’t rely solely on the agent to respect instructions about what it should and shouldn’t do. At 1Password, Wang advocates what she calls verified loops. Before an agent begins work, humans define its task, which tools it may use, what evidence will demonstrate that it completed the task successfully, and which actions it should never perform.

A separate verifier then compares evidence from the agent’s actions against that human-defined policy. “What you want to avoid here is something recursive where you have a fox guarding a henhouse, or the agent looking over its own work,” Wang says.

The principle applies beyond software development. A model might be instructed never to transfer more than a certain amount of money, delete a production environment, or access particular data. But if violating that rule would have serious consequences, the limit should also exist outside the model.

RSA’s Taylor makes the same distinction from the identity and access side. “Model-level guardrails are necessary, but not sufficient,” he says. “The real limits need to sit outside of that in enterprise control.” He argues for layered controls around agents, including identity policies, provisioning rules, lifecycle policies, governance, monitoring, and attestations.

In other words, CIOs shouldn’t ask an AI agent to exercise restraint where the infrastructure could simply prevent the unauthorized action.

Govern access in real time

Traditional access governance often operates on a schedule. A manager might review an employee’s permissions quarterly and determine whether those permissions are still appropriate. Agents may evolve too quickly for that approach. “Agentic identities are dynamic,” Taylor says. “So we need a mechanism that certifies them continuously, rather than performing periodic reviews.”

If an agent suddenly gains access to another database, for example, that event itself could trigger reassessment. Organizations should determine whether the new permission is appropriate or creates a dangerous combination with access the agent already possesses. “Privilege and authority should never be permanent,” Taylor adds. “They should always be reviewed.”

Wang favors an even more granular approach of task-based authorization. Rather than giving agents standing access or long-lived credentials, organizations can make authorization decisions at runtime and provide short-lived credentials only when required for a particular task. “We espouse no standing privileges,” she says. “No long-lived credentials.”

That effectively applies least privilege at agent speed. A change in task becomes an opportunity to reassess whether the agent still needs the access it’s requesting.

Make someone own the agent

Technical controls, however, don’t eliminate the organizational question of accountability. Taylor believes enterprises should be able to associate agents with a responsible identity. If an employee creates an agent, the organization needs to know who’s responsible for it, what its purpose is, and what happens to it if that person changes roles or leaves. “Every agent action needs to be attributed to a responsible identity,” he says.

Ownership also needs a lifecycle. An agent that remains important after its creator leaves should be transferred to another designated owner rather than simply continuing indefinitely.

Dongha makes another distinction. For AI embedded in a business process, he believes the business owner should remain accountable because that person owns the customer relationship, the process, and often the P&L. “It’s the business owner who has the responsibility because their people run it, and they’re responsible for the customer relationship,” he says.

That creates a useful division of roles for CIOs: IT may provide the infrastructure and controls, but the business can’t outsource accountability for the consequences of autonomous decisions.

Multi-agent systems need system-level controls

The challenge becomes more complicated when agents begin working together. An individual agent might remain entirely within its permitted scope while contributing to an overall outcome nobody intended. One agent generates an output. Another accepts it as input and takes an action. A third agent then acts on the result. Again, the individual actions may all appear legitimate.

Dongha says enterprises therefore need to test not only individual agents but the entire network as a system. “You need something overarching on top of a multi-agent system,” he says.

NatWest is working on an AI control tower that would give authorized users visibility into a network of agents, including messages passed among them and the guardrails surrounding those interactions. Dongha considers governance of multi-agent systems an emerging problem that nobody has fully solved yet.

Wang also points to a related challenge that identity becomes more complicated when agents are ephemeral. An organization may spin up a temporary team of agents, tear it down, and recreate it later. If something goes wrong, the enterprise needs to reconstruct which agent made which decision during which session, and how that action propagated through the system.

That makes traceability increasingly important as autonomous systems become less like individual applications and more like networks of interdependent actors.

Set the bar before the agent reaches it

Before an agent goes into production, Taylor says CIOs should be able to answer several basic questions: Who owns it, what can it do, what’s its maximum authority, how will the organization know if that scope changes, and which actions require a human decision.

Other industries don’t need to replicate the governance machinery of a large bank, but they can borrow one important principle: controls should be built into the system from the beginning. “Governance shouldn’t be a check at the end,” Dongha says. “It needs to be embedded when you build an AI system.”

For CIOs, that may be the central lesson of autonomy creep. The question isn’t simply whether an agent can be trusted today but whether the organization has mechanisms to notice when tomorrow’s agent has quietly acquired authority that nobody ever intended to give it.

CIOs bring a lot to their new jobs: decades of leadership, transformation, pattern-recognition, and outcomes. But none of that matters in your new job. During a time of generalized uncertainty, your team — and every stakeholder — needs to trust you more than anything. But how do you build that trust in a new environment, and as quickly as possible? For Cengage CIO Ken Grady, the best approach is an architectural one.

What is a trust architecture, and why did you develop it?

I’ve been a CIO for almost 20 years, and when I joined Cengage six months ago, while I had roughly 7,300 days of evidence that I knew how to do this job, not one person in that building had ever seen any of it. The proof existed on my résumé. The trust did not.

On day one as a new CIO, you have no shared experience with your team, so you have no trust. Your team might have respect for your background, and hope you’ll succeed, but personal trust is something you must build from scratch.

So how do you do that when the currency of trust for your team can shift depending on the situation? Establishing trust with the people in your new business requires an intentional approach, an architecture.

What are the different currencies of trust?

The first is technical currency. My team needs to know that as a new CIO, I’ll respect their technical expertise, have enough of my own to be helpful, and engage in healthy technology discussions. To solve for that, I sat down and led an open conversation early on about whatever was on their minds, and I showed them that their technical expertise is valued.

The second is investment currency. Can I, a technology leader, speak to ROI or NPV? Can I explain why we should invest in this technology, or address this technical debt, or move from this version to that one? My team needs to respect my ability to guide our investments.

The third is human currency, which addresses the questions people are afraid to ask. Why did we move our offices? Why are we incentivized this way and not that way? IT people are people, and they have non-technical questions.

Technical, investment, and human currency get exchanged in a cadence of conversations, and that cadence almost matters more than the content itself. People value leaders who are steady.

How are you using the trust architecture now?

People have questions when a new leader comes on board, and they need a safe place to ask them. That’s why we built a monthly Enterprise Architecture Review, an open meeting with no agenda where technical people talk through hard problems concerning what we’re trying and learning, what’s working, and what isn’t.

We’ve also built a monthly portfolio review called Steps-to-Green. We talk about the yellow and red projects, and how we can help each other move them to green. There’s no punishment in this room, only encouragement. If your product is yellow, that means you’re one step closer to green.

But the fear is wondering if it’s okay to say what you really think, so the senior leadership team holds a monthly anonymous Q&A. Ask us anything, what you’re worried, frustrated, or even angry about. We might not have all the answers, but we’ll try. If you give your team that kind of safety, they’ll use it.

What’s the benefit of this safety?

You get a high-functioning team willing to challenge existing norms and continuously improve. There’s no such thing as a perfect organization, and safety creates an environment where anyone can suggest an improvement, try it, test it, and report back.

What you get with safety is democratic governance. If there’s a quality problem, anyone in IT can hit the big red button to say we’re not doing this release, we have a quality problem. Anyone on the team can know more than I do about this technology, migration, or this HR issue, and hit the button.

It doesn’t mean there’s no bandmaster. I still need to lead the band since that’s my job as CIO. But the trombone player has to trust me enough to tell me we’re not playing it right.

What advice do you have for CIOs building a trust architecture in a generally anxious workforce?

I cure prosciutto in my basement. Every time I start a new one, I remind myself it takes 18 months, regardless of how many years I’ve been doing it. Trust doesn’t care about your résumé. It’s earned, not given. Before your next conversation, ask yourself if you’re building trust in the currency this person accepts, or the currency I’m most comfortable spending.

Empathy should be your lens. With my team, I show up ready to learn something, connect with them, not to perform leadership. With my stakeholders, I understand they don’t care about my migration strategy. They care whether I’m making their life easier. With my board, empathy isn’t warmth. It’s precision on knowing they need confidence from me, not just an update.

Each direction takes a different currency for team, stakeholders, and customers. As a CIO, you can’t be comfortable in one lane and neglect the other two. You must invest in all three.

Enterprise AI is racing toward a consequential shift in how businesses operate. As agents take on work that used to consume the week, projects once dismissed as ‘we don’t have the capacity’ become worth another look. That raises a question worth bringing into the next planning meeting: What would we pursue if our teams had more time to do it?

Most organizations already have an answer. There are customers who deserve more attention, promising ideas waiting for someone to develop them, and services that would be valuable if the economics made sense. These opportunities often stay out of the business plan because the people needed to pursue them are already fully committed.

AI gives leaders a reason to revisit those decisions. As AI becomes more widely adopted, simply deploying agents will not be enough to differentiate one organization from another. The bigger opportunity is to rethink how the business operates, which customer needs it can address and where it can create value that wasn’t previously possible.

The State of Enterprise AI Adoption Report, published by Creatio based on a survey of 608 IT and business decision-makers, shows how widely that possibility is taking shape. Seventy percent of respondents say their organizations have moved beyond AI experimentation. Meanwhile, 78% are already scaling AI agents across departments or use cases, or expect to within a year. As that adoption expands, the opportunity is to connect additional capacity to a more ambitious business plan.

Put the work you postponed back on the agenda

One of the report’s most revealing findings concerns workforce expectations. Eighty-nine percent of respondents expect AI agents to augment teams, expand capacity or create new roles. Only 9% anticipate significant headcount reductions. These expectations do not establish what will ultimately happen to employment, but they show how many organizations are thinking about AI’s potential.

The interesting management decision is what happens to the capacity they expect to gain.

A service team might use it to give complex customer problems more attention. A sales organization might finally have the resources to support accounts that previously received little engagement. An operations team might tackle a persistent backlog while keeping pace with new requests. Each possibility needs a business case, but AI can change the assumptions that made the work difficult to justify.

I would make that discussion part of every significant AI investment. Alongside the estimate of hours saved, ask what those hours could make possible. Give the business owner responsibility for explaining how the team will use the capacity and how customers or employees will benefit. That makes the investment much easier to connect to a growth priority.

A faster task should help the whole business move forward

Additional capacity depends on how well AI fits into the work around it. Consider customer onboarding. An agent might gather information, identify missing documents and prepare an application for review. That can reduce administrative effort considerably. But the customer’s experience also depends on what happens next: whether the application reaches the right person, whether exceptions are resolved promptly and whether the customer has to provide the same information again.

The opportunity is to improve that entire experience. Employees can focus on decisions that require judgment, supported by information the agent has already organized. With a well-designed handoff, the business may be able to onboard more customers while giving each one appropriate attention.

This is why I would treat workflow design as a business leadership responsibility. Technology teams can establish what an agent can do. The people who run the process can explain where that capability would make a meaningful difference. Bringing those perspectives together helps organizations choose useful applications and define how responsibility should pass between people and agents.

Employees should have a voice in that design. They know which exceptions occur every week, where information is unreliable and which seemingly simple tasks require careful judgment. Their experience can make an AI deployment better from the outset. Involving them also creates a practical setting for learning how to direct agents and evaluate their work.

Give teams the confidence to expand

As agents take on more responsibility, clear governance makes expansion easier to manage. The report finds that 71% of respondents with fully established AI governance feel very confident about scaling AI, compared with 17% of those still developing a framework.

That is an association, rather than proof that governance alone creates confidence. Still, it offers a useful perspective on a subject often discussed mainly in terms of restrictions. Clear authority can help people move faster because they understand which decisions they are empowered to make.

The same principle applies to agents. An agent preparing a summary needs different permissions from one making changes to a customer account. Teams should know what each agent can access, which actions require approval and how to intervene when necessary. A business owner should be responsible for reviewing performance as the process evolves.

Once those practices are established, other teams can build on them. Every deployment becomes an opportunity to develop approaches that the next team can reuse, reducing the effort required to expand AI across the organization. Governance becomes part of the organization’s ability to execute consistently.

Make the business case bigger than hours saved

The report also gives leaders a reason to broaden how they evaluate AI’s contribution. Among organizations automating more than half of their workflows with AI, 33% report increased revenue from AI in the previous six months. Among those automating less than 10%, the figure is 14%.

Those percentages describe how many organizations reported a benefit, not how much their revenue increased. Nor do they guarantee that automating more workflows will produce growth. They do, however, suggest that deeper adoption deserves consideration as part of the revenue conversation.

Hours saved are a useful starting point. The more revealing question is what changed for the business.

For a customer service initiative, that could mean resolving more issues successfully while maintaining customer satisfaction. In sales, it could mean increasing the time available for customer engagement and examining whether that contributes to stronger conversion or retention. Connecting operational measures to business outcomes helps leaders decide where to invest next.

There is room to improve that connection. Among respondents pursuing AI to improve customer experience, only 56% measure customer satisfaction. Agreeing on the intended outcome and its measure before deployment would give these organizations a clearer basis for assessing progress. It would also help teams refine their approach as they learn.

Revisit the assumptions behind the plan

Business plans reflect assumptions about what an organization can deliver with the people and resources it has. As AI changes that capacity, those assumptions deserve another look.

Some opportunities will still be constrained by demand, funding or factors that AI cannot resolve. Others may become much more achievable. Leadership teams should be willing to reopen the discussion, particularly around work they postponed because employees lacked the time to pursue it.

That is what makes this stage of enterprise AI so consequential. The opportunity extends beyond freeing up employees’ time or making existing processes more efficient. AI gives organizations a chance to rethink how they operate, how they serve customers and which business opportunities they can pursue.

As AI adoption becomes increasingly widespread, deploying AI agents alone will not create a lasting competitive advantage. What will differentiate organizations is how effectively they use AI to reinvent their business models, redesign processes and deliver better customer experiences.

The competitive advantage of the AI era won’t come from simply adopting AI. It will come from reimagining what’s possible with it.

Technology maturity is generally considered a sign of progress. Organizations modernize their infrastructure and capabilities, introduce advanced analytics, and invest in AI, all with the expectation that these improvements will make the business more capable, efficient, and competitive.

But there’s a paradox emerging in enterprise IT: The more sophisticated an organization’s technology environment becomes, the more difficult it can be to manage. Every new capability may expand what the business can accomplish while also increasing the number of dependencies, decisions, and stakeholders that must be coordinated. At this rate, technological progress can outpace the organization’s ability to manage it.

As technology portfolios expand, so do the dependencies that IT leaders must understand and coordinate. Recent SoftwareOne research illustrates the disconnect. Although 86% of respondents to a recent survey described their organizations as established, advanced, or highly advanced in their transformation efforts, 41% still identified legacy systems and technical debt as a leading obstacle to execution. Clearly, investing in more advanced technology doesn’t automatically eliminate the challenges that make transformation difficult.

Understand when IT modernization adds complexity

Consider an organization that has invested heavily in Microsoft’s technology ecosystem. Azure supports its cloud infrastructure, Fabric brings together data capabilities, Power BI provides analytics, and Microsoft Foundry enables the development of AI applications and agents.

Individually, each capability may represent an important step forward. But realizing their combined potential requires decisions about how data moves between systems, who governs access, how security policies are enforced, and how new capabilities fit existing business processes.

An AI initiative, for example, may depend on data scattered across legacy databases and cloud environments. Introducing a more sophisticated AI platform won’t resolve inconsistent data definitions, fragmented governance, or architectural limitations that prevent information from being used effectively. In fact, it may make those weaknesses more apparent.

“The hidden cost of adding technology is often the complexity it creates across the organization,” says Michele Carvalho, senior director of Product Development & Readiness at SoftwareOne. “An AI initiative may look successful within one team while exposing gaps in data ownership or governance elsewhere. Intentional IT means looking across the environment before declaring any one deployment a success.”

Rethink what technology maturity means for your enterprise

Traditionally, organizations have measured IT maturity through indicators such as cloud adoption, infrastructure modernization, automation, and the sophistication of their technology capabilities. Those measures remain relevant, but they tell only part of the story. An organization can possess advanced technology and still struggle to integrate systems, manage dependencies, or translate investments into improvements in business performance. Meanwhile, a company with a less sophisticated technology environment may be better positioned to deliver results because its systems, processes, and priorities are more closely coordinated.

This suggests that the next stage of technology maturity may have less to do with the sophistication of individual systems and more to do with the organization’s ability to orchestrate them. Mature IT leadership requires understanding not only what each investment enables, but also how decisions across technology domains and business functions influence one another.

SoftwareOne’s approach to Intentional IT reflects this broader definition of maturity. By looking across software, cloud, data, AI, licensing, security, adoption, and managed services, SoftwareOne helps organizations identify dependencies that might otherwise be overlooked and determine how existing and emerging capabilities can work together more effectively.

For CIOs, the next stage of IT maturity isn’t simply about expanding the technology estate. It’s about building an organization that can navigate the consequences of its investments as the environment evolves. That capability becomes increasingly important as new technologies introduce dependencies that no individual team can manage alone.

“I would ask a different question of a mature IT organization: When priorities change or a new capability emerges, can its teams make a coherent decision together without starting from scratch?” says Carvalho. “That ability to respond with shared context and clear accountability is a stronger sign of progress than the number of platforms deployed.”

Learn how SoftwareOne can help your organization navigate technology decisions with greater clarity and connect investments to business outcomes.

For much of the history of enterprise IT, technology itself was a limiting factor. Organizations had to make difficult choices about which systems they could afford and which capabilities were realistic to deploy. Technology leaders built their strategies around those constraints.

Today, the challenge looks different. Cloud platforms, advanced analytics, automation, and AI have made sophisticated capabilities accessible to organizations of nearly every size. Microsoft’s expanding portfolio, from Azure and Fabric to Power Platform and Copilot, illustrates just how quickly the range of available options has grown. But greater access to technology has made the job of the tech leader more complicated.

The scarcest resources in IT today are the attention, organizational context, and judgment required to distinguish meaningful opportunities from distractions. The CIO’s challenge is no longer simply understanding what technology can do, but determining what deserves the organization’s finite capacity to act.

Evaluate new capabilities: When opportunity becomes a distraction

Every new capability creates another potential investment decision. AI offers opportunities to improve productivity and automate workflows. Data platforms promise better insights. Cloud modernization can improve scalability and flexibility. Each opportunity may have merit, but pursuing too many simultaneously can stretch resources, introduce complexity, and distract from more pressing business needs.

The temptation to act is particularly strong when technologies are evolving quickly and competitors are announcing ambitious initiatives. But being first to adopt a capability doesn’t necessarily translate into an advantage. Consider Microsoft Copilot. An organization may already have access to the technology through its Microsoft environment, making deployment seem like an obvious next step. But licensing employees for Copilot accomplishes little if the organization hasn’t identified where it can improve work, whether employees are prepared to use it, or how productivity gains will be evaluated. The technology may be ready long before the organization is.

“One of the most consequential decisions a CIO can make is what not to accelerate,” says Michele Carvalho, senior director of Product Development & Readiness at SoftwareOne. “If the organization cannot explain how a new capability will change the work, who will own the outcome and what must be in place first, speed can become a distraction rather than an advantage.”

Prioritize business needs: The value of knowing what to pursue

When technology was scarce, acquiring new capabilities often represented progress. When capabilities are abundant, adding more technology can just as easily create new obligations, dependencies, and costs. An intentional CIO needs to be willing to question the assumption that every promising innovation deserves immediate attention.

That requires a clear understanding of existing investments, business priorities, and organizational capacity. It also means recognizing that the most valuable next move may involve improving adoption of technology already in place, addressing a governance weakness, or reconsidering an initiative whose expected benefits no longer justify its costs.

This is the premise behind SoftwareOne’s approach to Intentional IT: creating the organizational clarity to distinguish between opportunities worth pursuing, investments that require additional groundwork, and capabilities that can wait. Rather than allowing the availability of new technology to dictate priorities, intentional leaders consider how each decision affects the broader technology environment and the business’s capacity to absorb change.

“Intentional IT is not about slowing innovation down,” says Carvalho. “It’s about being deliberate enough to move decisively where the business is ready, and disciplined enough to build the foundation where it is not. The pace of the market must not become the organization’s strategy.”

Learn how SoftwareOne can help your organization navigate technology decisions with greater clarity and connect investments to business outcomes.