Key Takeaways
- →In McKinsey's 2025 survey, 88% of organizations used AI regularly somewhere in the business, and 7% of those had fully scaled it.
- →Pilots are built to win approval, with curated data, a champion and a friendly KPI. Production has to survive real data, real owners and real regulators.
- →Scale needs three layers fixed in order: AI-ready data, then governance that names who owns each AI decision, then culture.
- →McKinsey's AI high performers are nearly three times as likely as others to have fundamentally redesigned their workflows: 55% against 20%.
- →Run fewer pilots, chosen against explicit criteria. Johnson & Johnson found that 10 to 15 percent of its AI use cases drove about 80 percent of the value.
Enterprise AI stalls after the pilot because organizations fix the wrong layer first. Scale needs AI-ready data, then a named owner for every AI decision, and only then a culture program, and in my experience most companies run that sequence in reverse.
Start with the numbers. In McKinsey's 2025 State of AI survey of 1,993 participants in 105 nations, 88 percent reported regular AI use in at least one business function. Among the organizations using AI, only 7 percent said it was fully deployed and integrated across the organization. Most were still experimenting or piloting, and about a third had begun to scale.
Budgets have been allocated and pilots declared successful. The step from a working pilot to a system the whole company depends on is where most programs stop.
The usual instinct treats this as a technology problem: better models, more compute, cleaner APIs. I have spent years working with enterprises on this gap, and I think that instinct is wrong. The harder diagnosis is organizational, and it is also the more useful one, because it tells you what to fix first.
Pilots Are Built to Win Approval
Every enterprise AI pilot I have seen is optimized for one outcome: approval. It gets carefully curated data, a motivated internal champion, executive visibility and a KPI chosen to make the return look obvious before the steering committee meets.
Then comes the real question. Can this survive contact with the rest of the organization?
In July 2025, MIT's NANDA initiative published "The GenAI Divide", built partly on a review of more than 300 public AI initiatives. Its headline finding was that 95 percent of organizations were getting zero return from generative AI. Just 5 percent of integrated pilots were extracting millions in value, and the vast majority showed no measurable effect on profit and loss. The authors did not blame the models. The divide, they wrote, "does not seem to be driven by model quality or regulation, but seems to be determined by approach." Fortune's account of the report points to generic tools that do not learn from or adapt to the way work is done. My reading is that the problem starts earlier, with how the pilot is designed.
Abandonment has risen with adoption. In S&P Global Market Intelligence's survey of 1,006 respondents, fielded in late 2024, the share abandoning most of their AI initiatives before production rose from 17 percent to 42 percent in a year, and the average organization scrapped 46 percent of its proofs of concept.
So why do organizations keep designing pilots that hide the implementation problem until it is too late to fix cheaply?
The AI Readiness Stack: What Blocks Scale
After working through this pattern across many organizations and industries, I see the scaling failure as structural: three deficits that compound, and that have to be resolved in sequence. I call it the AI Readiness Stack.
Most organizations try to fix Layer 3 (culture, mindset, change management) while Layers 1 and 2 stay untouched. That is why the same barriers turn up in post-mortems year after year. A culture program cannot rescue a model whose data feed is unreliable and whose decisions nobody owns. You will just run the same pilot twice.
Layer 1: The Data Foundation Nobody Wants to Audit
Gartner predicts that through 2026, organizations will abandon 60 percent of AI projects unsupported by AI-ready data. For most enterprises building AI programs today, that is the default outcome.
The pattern is easy to recognize. A fraud model is piloted on a year of transaction data that someone cleaned and labeled by hand, and the accuracy gain looks impressive. Then operations asks where the live transaction feed will come from. The answer is several legacy systems, with schemas that do not match and at least one source nobody has ever audited for completeness.
The pilot looked like an AI problem. It was a data infrastructure problem that the pilot had been carefully designed to avoid.
Organizations that scale invert the usual investment ratio. My rule of thumb, drawn from programs I have watched succeed rather than from any survey, is that half or more of the timeline goes on data readiness before a model touches production: extraction pipelines, schema normalization, quality monitoring, and governance metadata an auditor can follow. It is unglamorous work and it rarely makes the case study. It is also the difference between a pilot and a platform.
Layer 2: Governance, the Missing Middle
McKinsey's early-2024 survey found that just 18 percent of organizations had an enterprise-wide council or board with the authority to make decisions on responsible AI governance. Without that structure, each deployment becomes an island, owned by one team and cut off from the functions around it.
Governance sounds bureaucratic. In practice it answers the question every scaling effort eventually hits: who decides?
Here is a pattern I meet in financial services. A credit model with full explainability outperforms experienced underwriters in testing, yet approvals keep routing back to managers for sign-off. The managers do not distrust the model. Nobody has decided who is accountable when its recommendation proves wrong, so the hierarchy reasserts itself one approval at a time. Settling accountability does not mean removing human review, which a lending decision should keep. It means deciding who reviews what, and who answers when the model is wrong.
Building governance means answering three questions most organizations have deferred. First, who owns the AI output when it is wrong? That should be the business owner accountable for the decision, rather than the model team or the vendor. Second, how does the organization classify AI risk, so that governance effort matches actual exposure instead of being spread so evenly that it is thin everywhere? Third, how will anyone know when a model has drifted far enough that yesterday's calibration has become today's liability?
In Europe that third question now carries legal weight. Under the EU AI Act, high-risk obligations apply from 2 December 2027 for Annex III uses such as hiring, credit scoring and critical infrastructure, and from 2 August 2028 for AI built into regulated products such as medical devices. Both dates were deferred by the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. Breaching those obligations can bring fines of up to €15 million or 3 percent of worldwide annual turnover under Article 99(4), whichever is higher for most companies. For any organization operating in or selling to Europe, governance has become a requirement with a date on it.
Europe is not alone: the OECD's policy navigator gathers AI policy from more than 80 jurisdictions and organizations. The Omnibus pushed some dates back, and later deadlines still arrive.
Layer 3: Culture Comes Third
BCG's 2024 survey of 1,000 executives traced around 70 percent of the challenges in AI programs to people and process, against 20 percent for technology and 10 percent for algorithms. Organizations respond with workshops and communication programs, then wonder why the culture stays where it was.
Culture changes when incentive structures, decision rights and accountability change underneath it. A better communication plan will not do that on its own. This is why governance (Layer 2) has to come before culture work (Layer 3): people cannot change how they behave around AI until someone has defined what accountable behavior looks like.
The shift that matters most is moving ownership of AI outcomes from the AI team to the business function that runs on the outputs. When the data science team owns the fraud model, operations has no stake in its success. When operations owns the model's production performance and the technical team supports it, the organization is aligned in a way that can scale.
McKinsey's 2025 data does not test the order, but it points at decision rights and workflows more than structure. Its AI high performers, about 6 percent of respondents, are nearly three times as likely as others to say their organizations have fundamentally redesigned individual workflows: 55 percent against 20 percent. They also spend more. Over a third of high performers commit more than 20 percent of their digital budgets to AI, against 7 percent of everyone else. Adding AI to an existing process buys a small efficiency gain; redesigning the process around AI is where, I think, the gains compound.
The smallest gap in that chart is the one I would have expected to be largest. A central team that coordinates AI work is almost as common among other organizations (38 percent) as among high performers (46 percent). Structure on its own does not separate them. Authority over decisions and workflows does.
Deloitte's research adds a multiplier: organizations that invest in change management are 1.6 times as likely to report that AI initiatives exceed expectations. Deloitte does not say what that work rested on; my argument is that it pays off most when data and governance can carry it.
The Skills Deficit Is Real, but Misdiagnosed
Most talk of the skills gap, data scientists who cannot explain business context, understates the problem. The capability that most constrains scale is interpretive: the ability to question what an AI system produces.
Organizations need leaders who can interrogate AI outputs rather than simply receive them. What does this recommendation assume? Under what conditions does this model fail? What data would change this output? Those questions separate organizations that use AI from organizations that hold it to account.
A common version of the problem is the center of excellence that produces sound models no business leader can evaluate. The models work, and they still do not scale, because the people whose decisions they were meant to improve cannot judge whether to trust them.
What Scale Actually Requires
So what separates the few who scale from the rest? Money plays a part, as McKinsey's budget figures show, and the technology is available to almost everyone. What most organizations have not done is make three disciplines routine.
First, classify before you deploy. Every AI use case is assessed against a risk and value framework before development starts. Johnson & Johnson ran as many as 900 generative AI experiments under a central board, found that 10 to 15 percent of use cases drove about 80 percent of the value, and handed responsibility for AI projects to the business departments. BCG found the same habit across companies: AI leaders pursue about half as many opportunities as their less advanced peers. The organizations that scale run fewer pilots, chosen against explicit criteria.
Second, treat data infrastructure as the product rather than a prerequisite. At its operational core, scaling AI is a data engineering job. The successful ones build data platforms (unified schemas, governance metadata, quality monitoring) that make each new deployment cheaper and faster than the last instead of more complex.
Third, treat AI governance as strategy as well as compliance. In McKinsey's 2022 digital trust survey of more than 1,300 business leaders, the digital-trust leaders were 1.6 times more likely than the global average to see revenue and EBIT growth of at least 10 percent. That is a correlation, and I would not claim more for it. It does suggest that the governance layer earns its cost in the trust of employees, customers and regulators who now have real enforcement powers.
The Strongest Objection
The best case against this ordering is that it is too tidy. Data work never finishes, so a rule that says "fix data first" can become a reason never to ship. And culture is not purely downstream. A team that distrusts AI will slow the data work and stall the governance decisions before either one starts.
Both points are fair, and there is a sharper one. Data can only be ready for a use case someone has chosen, so an owner has to exist before the data work starts: the sponsor who picks and classifies the use case. Layer 2 settles something later, which is who answers for each decision once the system is live. The sequence says where to put the weight, and in practice the layers overlap. I would still defend the order. A culture program run on top of unreliable data and unowned decisions teaches people that AI does not work, and that lesson is expensive to unlearn. Data readiness here means ready for the specific use case going to production, which is a finite job, rather than a spotless enterprise warehouse.
The Question Most Organizations Haven't Asked
The gap between AI adoption and AI at scale exists because organizations have been solving the wrong problem. The question most have been asking is: "How do we get our people to adopt AI?"
The right question is harder. What has to be true of our data and our decision rights before any AI system can run here at scale? Answering it means reckoning honestly with data debt that has been building for years, and admitting that the structures that ran the last decade of digital transformation may be the wrong ones for AI.
I do not think AI's promise has been oversold. I think the path to it has been underfunded in exactly the places that decide whether it arrives.
To find where your organization sits in the stack, the five-pillar readiness assessment is where I would start. If governance is the gap, Minimum Viable Governance sets out a 90-day start.
Related Reading
The hidden tax on AI speed looks at what happens when velocity outruns governance, the cost that makes Layer 2 hard to skip. The governance playbook turns principles into working practice, and the EU AI Act guide covers what the high-risk dates mean for boards and compliance teams.
Sources and Changes
- McKinsey, "The state of AI in 2025: Agents, innovation, and transformation", 5 November 2025 (online survey of 1,993 participants in 105 nations, 25 June to 29 July 2025), Exhibits 1, 11, 14 and 15.
- McKinsey, "The state of AI in early 2024: Gen AI adoption spikes and starts to generate value", 30 May 2024 (1,363 participants, 22 February to 5 March 2024).
- McKinsey, "Why digital trust truly matters", 12 September 2022.
- MIT NANDA, "The GenAI Divide: State of AI in Business 2025", July 2025, as reported by Fortune, 18 August 2025.
- S&P Global Market Intelligence, "Generative AI shows rapid growth but yields mixed results", 27 October 2025 (Voice of the Enterprise survey of 1,006 respondents, 21 October to 25 November 2024).
- Gartner, "Lack of AI-Ready Data Puts AI Projects at Risk", 26 February 2025.
- BCG, "AI Adoption in 2024: 74% of Companies Struggle to Achieve and Scale Value", press release, 24 October 2024.
- Deloitte, "How to build an AI-ready culture", 18 March 2025.
- DeepLearning.AI, The Batch, "Johnson & Johnson Reveals its Revised AI Strategy", 7 May 2025, summarizing the Wall Street Journal's report of 18 April 2025.
- Regulation (EU) 2024/1689 (AI Act), Article 99(4) and Annexes I and III, as amended by Regulation (EU) 2026/1744, in force 27 July 2026.
- OECD.AI, Policy Navigator, read 6 October 2026.
All sources checked on 6 October 2026.
Changes on 6 October 2026. New headline, summary and takeaways; the closing Canvas box is gone. I re-checked every fact. The "81-point gap" is gone: McKinsey's 88 percent counts all respondents, its 7 percent only those already using AI, so one cannot be subtracted from the other. The high-performer chart now shows McKinsey's actual figures; three of its four earlier pairs are not in the report. MIT's figure now matches the report: 95 percent of organizations were getting zero return. S&P's survey was fielded in late 2024, and its 42 percent counts initiatives abandoned before production. The EU AI Act dates now separate Annex III uses (2 December 2027) from AI in regulated products such as medical devices (2 August 2028). The trust figure is 1.6 times, from McKinsey's 2022 survey. An NTT DATA figure is dropped because it restated other estimates. Two client stories are now told as patterns, without figures I could not source.
Get The Brief
Original thinking on AI strategy and governance. Every other Tuesday.

Senior AI strategist helping leaders make AI real across four continents. Forbes Technology Council member, IEEE Senior Member.
Ajay's views, from 15 years in the field. Not legal or compliance advice. See full disclaimers →
Published by AI Exponent LLC



