05What to do on Monday

Monday morning

An executive who has read this far knows more about generative AI than most boards and less than most vendors would like. That is the right position to act from. The risk now is not ignorance. It is the familiar gap between understanding a thing and doing something about it, which in most organisations is measured in quarters.

This chapter is deliberately short on argument and long on action. The argument was made in the first four chapters: the technology is real and fallible, the outcomes so far split sharply, the split is explained by organisational discipline rather than by models or vendors, and that discipline can be turned into an operating model. What remains is sequence. What do you do first, what do you have in place a month from now, and what should be true in ninety days if the effort is working?

The plan below assumes an organisation that has not yet run a governed generative AI programme, which describes most of them. Organisations further along will recognise where they are and skip ahead. None of it requires a budget line to start.

The first week

Five actions. None needs a committee, a consultant or an approved budget. Each one either reduces a risk that already exists or creates information the organisation does not yet have.

1. 01Name one accountable owner. A single person, senior enough to make decisions across functions, with the explicit mandate to run the programme. Not a committee and not a working group. If the answer to "who owns AI here" is a list of names, the answer is nobody.
2. 02Find out what is already happening. Ask, do not audit. Which teams are using which tools, for what, with what data. Make it safe to answer honestly; the purpose is visibility, not discipline. You will find more usage than you expected, and some of it will be good.
3. 03Issue a one-page interim policy. What data must never go into an external AI tool, which tools are permitted for now, and who to ask. One page, plain language, dated, labelled interim. A short rule that people read beats a long one that they do not.
4. 04Choose a sanctioned tool. An enterprise-grade assistant with contractual data protection, deployable quickly. The choice matters less than the speed: the purpose is to give people a safer channel than the one they are already using.
5. 05Open a channel for candidate use cases. Ask managers one question: where does your team spend time producing something that a competent person could check in a fraction of the time? Collect the answers. They are the raw material for the first project.

One note on the first action, because it is the one most often fudged. The owner does not need to be a technologist, and often should not be. What the role needs is authority across business lines, the credibility to stop projects, and enough technical literacy to tell a vendor's claim from a measured result. In many organisations that is the CTO or CIO. In some it is the COO. In regulated environments it may be a leader who already carries quality or risk accountability. What it cannot be is an innovation function with no line authority, for reasons Chapter 03 made clear.

Thirty days, ninety days

The first week starts the programme. The next two horizons establish whether it is working. Each has a short list of things that should be true by its end.

By day thirty, the sanctioned tool is in people's hands, with short practical training focused on what the tool is bad at as much as what it is good at. Usage is visible. The six governance pillars from Chapter 04 exist at their Crawl minimum, each with a named owner. The candidate list has been filtered against the first-project criteria and the disqualifiers, and one project has been chosen. Before any AI touches that workflow, its baseline has been measured and its kill criterion written down and agreed by the sponsor. That last step is the one most often skipped, and the one that most reliably separates the 5% from the 95%.

By day ninety, the first Walk project has run long enough to produce a number. The number is compared with the baseline and the kill criterion, and a decision is taken: expand to more volume or a neighbouring team, adjust and run another cycle, or stop. The decision is communicated, including to the people who did the work, and including if it is a stop. A second candidate is ready, so that whatever the decision, the programme continues.

At day ninety, expand, adjust and stop are all good outcomes. The only bad outcome is no decision.

An organisation that reaches day ninety with an honest result, of any sign, has done something most organisations have not managed in four years: it has run an AI initiative the way it would run any other serious technology investment. Everything after that is repetition at increasing scale.

Questions for your next leadership meeting

Eight questions, drawn from the four discriminating variables in Chapter 03 and the six pillars in Chapter 04. They are deliberately plain. Ask them at the next leadership meeting and note which ones get a confident, specific answer.

• Who, by name, is accountable for generative AI across the organisation?
• Which AI tools did our people use last week, and what data went into them?
• For each AI initiative we are paying for, what was the baseline before it started?
• Which AI initiative have we stopped, and what did we learn from stopping it?
• Who leads our most important AI initiative, a domain expert or a technologist?
• If a regulator asked us to explain one AI-assisted decision from last month, could we?
• Which of our current or planned uses would count as high-risk under the EU AI Act?
• What would we need to see in ninety days to justify the next stage of investment?

Most leadership teams answer two or three of these well on the first attempt. That is not a failing; it is a starting map. Each question without a confident answer points to a specific gap, and the gaps, in order, are most of the plan for the first ninety days. A leadership team that can answer all eight with specifics is already running a governed programme, whatever it calls it.

What not to do

The moves below are tempting, common, and reliably associated with the nothing and damage buckets. Each one has a respectable rationale. Each one should be refused.

• The big-bang announcement. Publicly committing to transformation targets before a single use case has been measured. It creates pressure to report success, which is how Klarna ended up walking a story back.
• The vendor-led roadmap. Letting a platform vendor define which problems to solve. Vendors are good at capability and have no stake in your baseline. Problem first, then tool.
• The innovation lab with no line owner. A team of AI specialists building demonstrations in search of a sponsor. It produces impressive prototypes and almost no production value.
• The pilot with no baseline. Starting before measuring "before". Without a baseline, every result is an opinion, and opinions about AI projects are rarely neutral.
• The blanket ban. Prohibiting generative AI outright to buy time. Usage moves to personal devices and becomes invisible, and the organisation learns nothing while the exposure remains.
• Starting at Fly. Beginning with autonomous agents because that is where the headlines are. Act is the last capability pattern to master, not the first.

What these six have in common is that they substitute a gesture for a measurement. Each one produces visible activity quickly. None of them produces the information an executive needs to decide what to do next. The disciplined path is slower to look impressive and faster to produce value, and the four-years-in evidence is unambiguous about which matters.

Who should lead

A recurring question from boards is whether generative AI needs a new executive role. Sometimes it does. More often, the right answer is to give the mandate to an existing executive who has already led a technology transition and has the authority to see one through.

The profile matters more than the title. The person needs to understand the technology well enough to separate claims from evidence, the business well enough to choose problems that matter, and the organisation well enough to stop things. They need the governance instinct of someone who has worked under real accountability, regulatory or financial, and the delivery instinct of someone who has shipped systems that had to work. That combination exists in most organisations. It is usually busy.

When it does not exist internally, or exists but cannot be freed, there is a case for bringing it in for a defined period: long enough to establish the owner, the policy, the governance minimum and a first honest result, and then hand the running programme to someone permanent. The test for any outside help, including advisors, consultancies and vendors' professional services, is simple. Are they helping you build the capability, or selling you a dependency? The first kind leaves when the job is done. The second kind has a reason to make sure it never is.

Beyond the hype

This article began with a technology and ends with an operating model. That arc is the whole point. Four years in, the question "what can generative AI do" has been largely answered, and the answer is: a great deal, unreliably, at very low marginal cost. The question that remains open in most organisations is a different one: can we run it?

Running it turns out to require nothing that well-run technology functions have not done before. A problem chosen honestly. A baseline measured before the work starts. Domain experts in charge. Humans in the loop where their judgement is the point. Governance sized to the risk. The willingness to stop. Generative AI did not change what good execution looks like. It raised the cost of bad execution and lowered the cost of good execution, at the same time, for everyone.

That is why the hype was never the most important thing to see past. The more important thing to see past is the assumption that this time the rules are different. They are not. The organisations that will look back on this period as a turning point are not the ones that moved fastest or spent most. They are the ones that applied the ordinary discipline, honestly, to an extraordinary tool.