As AI increasingly takes over routine tasks and basic information processing, simply using the same AI tools as competitors is no longer enough to differentiate a company. Competitive advantage is increasingly rooted in what makes each organization unique: its philosophy, culture, and accumulated tacit knowledge.

For business leaders, including CIOs, the central question is shifting from “How can AI improve efficiency?” to “How can we foster continuous growth for both our people and our organizations in the AI era?”

Two influential perspectives offer valuable insights into this challenge.

The first is Founder Mode, an essay published in September 2024 by Paul Graham, co-founder of Y Combinator, the influential Silicon Valley startup accelerator. The second is The Founder’s Mentality, a management framework developed by Bain & Company through its extensive research into the drivers of sustained corporate growth and the crises that can undermine it.

Both address a fundamental challenge: as organizations expand, how can they preserve the sense of ownership, entrepreneurial energy, and intuitive decision-making that defined their early success?

In this article, I explore how Founder Mode can serve as a practical leadership approach for sustaining the principles of the Founder’s Mentality—and why this combination may become increasingly important for organizational growth in the AI era.

Founder Mode: Rethinking the conventional wisdom of delegation

As an organization grows, leaders should delegate authority to their subordinates. This is conventional management wisdom, taught in both MBA programs and corporate training courses. Graham challenged this conventional wisdom in an essay inspired by a talk given by Airbnb CEO Brian Chesky.

In his talk, Chesky said that “the conventional wisdom about how to run large companies is mistaken.” After taking the conventional advice to delegate authority, Chesky saw meetings proliferate, bureaucracy take hold, and internal divisions intensify. Employees increasingly prioritized their own objectives over the company’s broader goals, while progress on critical initiatives slowed to a crawl. In response, he undertook a sweeping organizational overhaul: he made every initiative visible, dismantled the divisional structure and reorganized the company by function, and shifted to concentrated decision-making by the senior leadership team. In doing so, he revitalized the company.

From cases like this, Graham identified a style of management distinct from the delegation-centered approach and named it “Founder Mode.” It is the style practiced by Steve Jobs at Apple, in which the top executive makes decisions while staying directly connected to every level of the organization.

One example of Founder Mode in practice is the “skip-level one-on-one,” in which leaders engage directly with employees beyond their immediate reporting line and speak directly with employees two or more levels below them. This gives leaders firsthand insight into day-to-day operations and makes decision-making more transparent. Retreats where the CEO personally leads discussions with the management team are another example.

That said, some critics argue that Founder Mode can easily turn into mere meddling. Graham nonetheless maintains that, even taking that risk into account, it is better to adopt Founder Mode. The distinction between Founder Mode and micromanagement lies in how leaders exercise their involvement. Effective Founder Mode combines a clear strategic vision with direct engagement across organizational levels, while preserving employees’ ability to exercise judgment and take ownership of their work. This ability to communicate a clear vision and strategic rationale is what distinguishes Founder Mode from micromanagement.

The Founder’s Mentality: 3 principles for sustained growth

There is a book that analyzed the themes addressed in Founder Mode before Graham’s essay appeared and distilled them into a prescription: The Founder’s Mentality, published in 2016 by Chris Zook and James Allen of Bain & Company. It is a framework that organizes the traits shared by leaders and organizations that achieve sustained growth into guiding principles, and it rests on the following three pillars.

1. Insurgency

Insurgency is a mindset that drives an organization to challenge industry conventions and established frameworks in pursuit of creating new value. It involves identifying unmet customer needs, questioning traditional ways of doing things, and continuously seeking better solutions. At its core lies a clear sense of mission: “Why do we exist?”

2. Frontline obsession

Frontline obsession is a commitment to placing the highest priority on employees who interact directly with customers and incorporating their insights and feedback into management decisions. It involves creating an environment where frontline employees are empowered to think independently, make decisions, and take action. By accumulating small improvements and learning through continuous experimentation in their daily work, the organization consistently enhances the value it delivers to customers.

3. Owner’s mindset

Owner’s mindset is an attitude of taking personal ownership of the entire company, thinking and acting proactively as a founder would. It emphasizes making effective use of management resources, including time and capital, while prioritizing swift decision-making and execution. It also means cutting through unnecessary procedures and organizational constraints to focus on what truly matters and taking responsibility for delivering results.

Based on these definitions, I have developed my own interpretation of the three pillars and incorporated them into my approach to building organizations.

At the heart of Insurgency is the belief that a company should see itself as a movement rather than merely a business—one that fights on behalf of customers whose needs have long been overlooked. This distinctive sense of identity is precisely what attracts top talent and strengthens employee engagement.

Frontline Obsession means treating the frontline, where employees interact directly with customers, as the most important part of the organization. In 1999, just five years after founding Amazon, Jeff Bezos was already describing the essence of the company as a “customer obsession.” This was long before the concept of customer experience (CX) management became widespread, making his foresight particularly remarkable.

This deep commitment to the business is also reflected in the standards of quality an organization upholds. When founders personally set exceptionally high standards and expect employees to meet those same standards, there is little room for bureaucracy to take hold. Steve Jobs, who insisted that every Apple product meet his exacting standards, is perhaps the clearest example.

When this sense of personal ownership demonstrated by founders spreads throughout the workforce, Owner’s Mindset becomes deeply embedded in the organization, fostering a culture in which people take responsibility and see things through to completion.

According to Bain & Company’s research, companies led by their founders achieve markedly better results than other companies, and the Founder’s Mentality is strongly correlated with performance and competitiveness.

The three pillars are, in effect, the core principles that enable startups to scale rapidly.

Masaya Mori

3 crises that threaten growing companies

Yet as an organization grows, these three pillars weaken. Headcount and departments increase, rules and procedures pile up, and managers become consumed by administrative work. Zook identifies three crises that growing companies face.

1. Overload. The complexity that comes with scale robs employees of freedom and agility, stifles creativity, and drains the organization of momentum.
2. Stall-out. Growth slows as operations become more complex and the sense of mission becomes diluted, and this stage arrives suddenly and without warning. A stall-out often leaves leadership teams struggling to understand why growth has slowed and how to regain momentum. There is also a growing sense of urgency as younger, faster competitors gain ground.
3. Free fall. Growth in the core market comes to a complete halt, and the business model that worked until yesterday no longer works. The leadership team struggles to identify the strategic levers needed to reverse the decline; performance deteriorates rapidly, and the company reaches a point where a turnaround is extremely difficult.

Reviving the Founder’s Mentality to overcome organizational crises

Founder Mode can provide a practical leadership approach to reinforcing the three pillars of the Founder’s Mentality. By staying directly connected to employees and customers, communicating the company’s mission, and empowering individuals to act with ownership, leaders can help sustain an entrepreneurial culture as the organization grows. Founders, and leaders who know the company’s early days, engage directly with employees and instill insurgency, frontline obsession, and an owner’s mindset again and again.

The leadership of Lee Kun-hee, Samsung’s former chairman, is a textbook example.

Even after transforming the company into a maker of high-quality products and raising its profile in global markets, he repeatedly told employees directly, “Our company is now facing the greatest crisis in its history.” This unrelenting sense of crisis, sometimes described as a “perpetual crisis,” was the driving force that sustained the company’s founder’s mentality and led it to become the world’s largest electronics company.

Another key is not to treat Founder Mode as something reserved for founders alone.

Fidji Simo, CEO of the grocery delivery service Instacart, has drawn on her experience at Meta, saying, “At Meta, Mark [Zuckerberg] taught us not only how to be good executives, but how to take big risks and reap big rewards. That is Founder Mode.” When founders share their entrepreneurial spirit with employees and place high value on the challenge of building a business from scratch, they are, in effect, developing the next generation of leaders who will carry the founding spirit forward.

AI may ultimately make Founder Mode more scalable than at any other point in history. As AI takes over information synthesis and routine administrative tasks, it becomes easier for executives to access frontline insights directly, with less time and effort. Executives and the front line can connect directly, without information being filtered or distorted as it moves through layers of management. Technology is making Founder Mode easier to practice than ever before.

Conclusion: Building an organization that continues to evolve

Graham’s essay raises fundamental questions for companies at every stage of growth, whether they are expanding rapidly or struggling to maintain momentum. The Founder’s Mentality provides a framework for understanding these challenges and translating entrepreneurial principles into organizational action.

During my 14 years at Rakuten Group, I witnessed firsthand the company’s rapid expansion. As an R&D leader, I helped navigate a period in which its engineering organization, including global operations, grew twentyfold. That experience reinforced my belief that sustained growth requires constant reinvention and a willingness to challenge complacency—principles that resonate strongly with both Founder Mode and the Founder’s Mentality.

As organizations scale, delegation becomes more widespread, processes grow more complex, and the founding spirit risks fading into little more than a set of formal statements. These challenges can emerge far sooner than leaders anticipate.

How can leaders keep the company’s founding philosophy alive, empower employees to take initiative, and nurture the next generation of leaders? I believe the answer lies in maintaining a direct connection with people across the organization, even as its size and complexity increase.

This approach becomes even more important in the AI era. As AI takes on more routine responsibilities and similar technological capabilities become widely accessible, human judgment and organizational values will play an increasingly important role in differentiation. In this environment, the founding philosophy of an organization can serve as a distinctive source of direction, helping leaders determine which opportunities to pursue, which trade-offs to make, and what kind of value to create.

Venerable Chicago-based banking institution Northern Trust today unveiled a new AI-powered client onboarding agent to streamline the process of bringing institutional clients onto Northern Trust Asset Servicing’s Front Office Solutions platform.

The agent, which transforms years of data and transaction history into a standardized format ready for use in the bank’s reporting environment, is the result of an expanded collaboration with Microsoft.

Developed jointly by Northern Trust and forward deployed engineering (FDE) teams from Microsoft Frontier Company, the agent has cut data preparation time by 83%, from two-and-a-half weeks to just three days.

“Onboarding a large institutional client can involve an enormous amount of data, particularly in alternative investments,” says Northern Trust COO Pete Cherecwich. “You might have years of transaction history and cash flows across multiple investments, and the data can come to us in all kinds of different formats.”

Until now, Northern Trust had to map and transform that data manually before loading the data into its environment.

“This seemed like a really good problem for AI because there’s a lot of complexity and variability in the data, but there are also patterns that the technology can learn,” Cherecwich adds. “The agent does a lot of the heavy lifting, and then our people review the output and handle the things where there’s uncertainty. That’s the sweet spot for us: let the technology do what it does well and let our people apply their expertise where it matters.”

Agentic skillset

Cherecwich notes the agent, which consolidates large volumes of investment and transaction data from multiple sources to reconstruct performance histories, achieves over a 96% F1 first-pass quality score, an AI evaluation metric of the correctness and completeness of the mappings it produces.

The agent was also evaluated using only anonymized data to ensure client data was securely governed throughout the process. The partners say this eyes off approach has allowed them to achieve production-scale performance while meeting the stringent data stewardship requirements of the highly regulated financial services industry.

“When I think about ROI, I wouldn’t look at just one number,” Cherecwich says. “It’s speed to revenue, the client experience, and taking a very manual process and making it more efficient. It’s allowing our people to spend less time moving data around and more working with clients.”

From the ground up

The partners built the agent on Microsoft Azure. It uses Microsoft Foundry for enterprise AI and integrates with Microsoft 365 tools like Microsoft Excel and SharePoint. Azure provides a governed intelligence layer to preserve approved onboarding knowledge to support continuous improvement of the onboarding process.

The agent is a result of one of Microsoft Frontier Company’s earliest client engagements. Microsoft launched the $2.5 billion venture in July to provide clients support from FDEs that help them overcome the hurdle of moving from AI trials to deploying frontier AI at scale.

“We felt like we needed to organize ourselves differently to be able to serve customers at the speed and scale they want,” says Bill Borden, CVP at Worldwide Financial Services, Microsoft. “We organized Frontier Company as we’ve been thinking about what makes a company ‘frontier’ and on the outer edge to take advantage of what AI can do.”

Part of that process has been studying Microsoft’s internal AI transformation. Those lessons have led Microsoft Frontier Company to bring together not only hands-on engineering teams, but also industry experts in energy and power, manufacturing, automotive, and government, for instance. Team members with expertise in change management and process optimization are also key parts of the mix.

“We now have a really powerful organization that can sit with customers, understand their business processes and their challenges, and understand how we can actually leverage the tech,” Borden says.

Cherecwich agrees those capabilities are what allowed the collaboration between Northern Trust and Microsoft Frontier Company to bear fruit.

“We know asset servicing, our clients, and what a capital call or a valuation looks like even when the data comes in a strange format,” he says. “Microsoft knows AI and the underlying technology. You really needed both. I don’t think either side could have built as good a solution by themselves. And having Microsoft’s engineers embedded with our people and our expertise allowed us to move a lot faster.”

At a Fortune 100 bank, I watched a coding agent open a routine session on a payments service. Before the developer typed a word, the agent had read the repository, including the .env file. Production database credentials had entered the agent’s working context, potentially exposing them to a model provider the bank had never assessed. Whether the credentials left the environment depended on controls nobody had verified. Nothing malicious happened. The agent did what it was built to do. That is the problem.

My argument is simple. AI coding-agent vendors and their downstream dependencies form a supplier ecosystem, not just another developer tool. They need the same four control disciplines applied to other privileged suppliers. Govern vendor terms and downstream dependencies. Limit the secrets they hold. Approve the servers they connect to. Restrict where they can send data. Much of this builds on existing controls, though an enterprise may need a governed gateway or platform service. It requires procurement, security and engineering to recognize a supplier when they see one.

In May, I wrote about how agentic AI is rewiring the SDLC. This is the security half of that argument.

Adoption has outrun control

On Aug. 28, OpenAI told SpaceX, Cursor’s new owner, that it intends to stop supplying models to Cursor, with Nov. 12 proposed as the cutoff. Cursor CEO Michael Truell said OpenAI models carry about 5 percent of its traffic, DevOps.com reported, so the operational risk is small. The governance lesson is not. Enterprises that standardized on Cursor learned they depended on a downstream model supplier whose terms they did not directly control and a change of ownership they had not planned for.

That gap is now the norm. Coding agents are developers’ most common AI use, and investment is accelerating. Governance is not keeping pace, and emerging evidence of credential exposure underscores the gap.

Vipin Jain

The agent was bought as a seat and installed as a supplier

What I see most often is a category error. The coding agent was bought as a seat and installed as a privileged integration. Within its assigned permissions, it can read repository content, encounter credentials, invoke tools, access networks and connect to Model Context Protocol (MCP) servers. A contractor with that access would go through vendor risk review. The agent went through a one-line install.

Drawn as a supply chain, the developer stack looks different. The agent sits between your code and direct and downstream dependencies you may not have assessed: model providers, plugin marketplaces, MCP registries, package managers and the open internet. Each can be acquired, compromised or switched off. Verizon’s 2026 DBIR finds third parties involved in 48 percent of breaches, and source code is the data most often sent to external generative AI.

Vipin Jain

Four controls were never applied

Across the programs I advise, the exposure lands in the same four places.

1. Contract. At a healthcare payer, the agent vendor switched model providers mid-contract. No clause covered it, because the seats had been bought on a corporate card below the procurement threshold. No one had asked where code would be processed or what happens on a change of control.
2. Secrets. At the bank, credentials reached the agent’s context because the required access restrictions were not configured; that alone does not establish external transmission. Claude Code’s managed settings, for example, can deny reads of .env files in a way developers cannot override. Nobody had configured them because nobody owned them. Gartner predicts that by 2028, a quarter of enterprise security breaches will trace back to AI agent abuse rooted in unmanaged machine privileges and legacy credential practices.
3. Servers. At a specialty retailer, developers installed 23 MCP servers in one quarter. Security had approved none. Two could write to the CRM. My rule is simple: the team accountable for the underlying data approves its MCP access, while platform security verifies server provenance and enforces permissions before any agent connects. The retailer had it backward: each server belonged to whoever installed it. Astrix found late last year that 53 percent of open-source MCP servers rely on long-lived static keys or tokens. In June, CSO Online described Mitiga research showing how one malicious npm package can rewrite an agent’s MCP configuration and harvest its tokens. Anthropic deemed it out of scope because it requires code the user chose to run. That is a fair vendor position. It also means the control is yours. Few of the MCP servers in use at most enterprises were built by the team that owns the underlying system; most come from vendors, partners or public registries. Allow only security-assessed, approved servers; verify provenance, enforce least privilege and monitor supported interactions through a centrally governed MCP gateway.
4. Egress. On a state Medicaid program, the build environment where agents ran could reach any public endpoint. This July, an autonomous agent in OpenAI’s own evaluation sandbox exploited a zero-day in one of its permitted egress paths, a package-registry cache proxy, and reached Hugging Face’s internal systems. If a frontier lab’s allowed path became the way out, an unrestricted build network is an open door. In late October, CIO.com reported two more containment lapses at OpenAI and Anthropic. The fix is unglamorous: restrict shell execution, isolate agent runtimes, govern MCP connections through an approved gateway and enforce default-deny network egress. Every AI-initiated change should pass through verified CI/CD gates, with rate limits, spending controls and an emergency stop.

The failure sits between functions, and attackers have found it

None of these is a model failure. Procurement saw a low-cost seat. Security reviewed the vendor, if anyone did, but not the plugins, servers and model providers behind it. Engineering saw a productivity tool. Each function did its job, and the agent fell between all three.

The exposure is measurable. In IBM’s 2026 Cost of a Data Breach report, unapproved AI tools figured in 43 percent of incidents in its studied breach population, more than double the previous year. Among organizations reporting breaches involving AI models or applications, 92 percent lacked what the study classified as proper AI access controls. The average breach now costs $4.99 million, a record.

Attackers now target the same seams. On Sept. 18, CSO Online reported Plugin4Shell, a zero-click remote code execution flaw in the plugin systems of Codex, Claude Code, Gemini CLI and Copilot. Anthropic and OpenAI have patched. GitHub’s mitigation was reported as incomplete at disclosure, and Google deprecated Gemini CLI rather than patch it. In April, Vercel disclosed a breach that entered through Context.ai, a third-party AI tool an employee had connected. In August, the self-spreading npm worm GitGuardian tracks as ChainDrop planted a Claude Code SessionStart hook and a VS Code task in infected projects, so the malware ran the moment a developer opened the repository or started an agent session. The attack surface is the update channel, the plugin, the connected tool and the network path. That is supply chain risk, and CIOs already have a playbook for it.

Regulators already treat this as third-party risk

Few rules name coding agents. Few need to. Existing third-party and software supply-chain obligations can apply, depending on the regulated entity, service and deployment context.

The common thread is inventory, contract terms and exit rights. An agent bought outside procurement can bypass all three.

Standards and vendors have moved; procurement has not

Over 15 months, incidents and controls arrived side by side. The OWASP Top 10 for Agentic Applications lists agentic supply chain vulnerabilities as ASI04. The Coalition for Secure AI recommends signature verification and a central inventory for MCP servers. CISA, the NSA and four allied agencies, in Careful Adoption of Agentic AI Services, warn against third-party components with excessive permissions. Vendors are shipping matching controls, from Salesforce’s MCP Risk Scores to Okta’s newly announced Shadow AI Agent Discovery for Endpoints.

The analyst market reached the same conclusion from the buyer’s side. Gartner’s first Magic Quadrant for Enterprise AI Coding Agents, published in May, named Anthropic, Cursor, GitHub and OpenAI as Leaders. In the announcement, analyst Philip Walsh listed governance, pricing, support, commercial maturity and market durability alongside model quality as tests for long-term commitments. Market durability is a procurement test, not a developer one. Three months later, one of those Leaders was losing a model supplier.

In October, the firm went further, and it changed one piece of my advice. At its IT Symposium in Orlando, Gartner named the AI coding agent harness one of its top strategic technology trends for 2027 and said CIOs should give ownership of it to a dedicated platform team. In every program above, the controls existed somewhere. What was missing was one owner. A category with a Magic Quadrant is enterprise software. Buy it that way, and give it an owner.

Here is what that platform team builds. Next year the most demanding customer of your internal platform will be coding agents, not developers. An enterprise-governed harness is the versioned policy and configuration that adapts the vendor-provided agent runtime to your environment: rules files, skills, enforcement hooks, verification gates, tool permissions and sandboxes. The platform team supplies approved tools, MCP allowlists, sandboxes and scoped credentials, and developers declare the harness they need as versioned configuration. That design answers the Cursor problem directly. A declared harness makes an agent or model change more manageable, provided compatibility and regression tests pass; a well-tailored harness may also improve results on a midtier model. An organization that owns its harness can change suppliers. One that rents it cannot.

The harness must also govern what the agent produces. AI-generated changes should follow the same trusted delivery path as human-written code: automated security testing, dependency verification, code review, build provenance and controlled production deployment.

5 moves for the next 90 days

The fix begins with supplier-risk review and configuration work, not necessarily a new platform purchase. Give all five moves to one accountable owner, the platform team that runs your coding agent harness, while procurement, security and infrastructure retain clear decision rights and operational accountability. Sequence matters: inventory first, because every other move depends on knowing what is installed.

1. Inventory, owned by the CIO and procurement. List every coding agent, plugin and MCP server and who installed each. Done when every approved tool has an owner, a supplier or risk-acceptance record, and its models and downstream dependencies documented.
2. Contract, owned by procurement and legal. Add model-provider disclosure, change notice, change-of-control and exit terms. Done when each enterprise-approved agent has documented contractual terms or an approved open-source/self-hosted exception, downstream visibility and a tested exit plan.
3. Secrets, owned by the CISO. Deny agent reads of .env and credential files through managed settings and move secrets to a vault. Done when agents hold only short-lived, scoped credentials.
4. Servers, owned by platform engineering and security. Maintain an internal MCP registry and mediated access to security-assessed, approved servers. Done when every approved server has verified provenance, a named owner, scoped permissions and activity logs, and write access to systems of record goes through change control.
5. Egress, owned by infrastructure. Default-deny outbound traffic across agent shells, tools and build runners; run agents in isolated sandboxes and govern release promotion through CI/CD. Done when only explicitly approved destinations are reachable, exceptions are monitored and isolation is tested.

Two details make the difference. Reconcile the inventory against expense reports, not just license records; card statements usually tell the truer story. And write the contract assuming change: the Cursor notice proposed 76 days, and the next one may run shorter.

The takeaway

The most common mistake I see this year does not look like one. Teams are adopting coding agents fast, and they are right to. But they are buying a supplier ecosystem as if it were a developer tool, and governing it like one. Governed properly, a coding agent can earn greater autonomy with scoped identities, approved dependencies, controlled execution and a trusted route to production.

Put three questions to your team this week.

You would never give a contractor unrestricted production access on day one. Coding agents should meet the same standard.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects. 

There is a fundamental problem hiding behind today’s technology forecasts: the technology industry is projecting spending growth at rates that many of its customers cannot economically sustain.

Gartner’s July 2026 forecast calls for worldwide IT spending to increase 14.2% in 2026 to $6.37 trillion. Within that number, software is projected to rise 15.5%, Infrastructure-as-a-Service 29.3%, and data-center systems an extraordinary 62.5%. Gartner itself acknowledges that technology budgets are being strained by inflation, supply shortages, hardware and memory costs, and AI investment.

The AI projections are even more dramatic. Gartner’s September forecast puts 2026 worldwide AI spending at $2.7 trillion—up 49.5% in a single year. McKinsey has separately estimated that generative AI alone could drive $175–$250 billion of software spending by 2027, adding two to six percentage points to software-sector growth.

These are extraordinary numbers. But they expose a fundamental flaw in the way the technology market is being viewed: The forecasts measure what the technology industry expects to sell—not necessarily what its customers can afford to buy.

That distinction is critical.

The forecasts may describe what technology suppliers want to sell, what hyperscalers intend to build, and what analysts believe enterprises will demand. They do not demonstrate that the typical enterprise has the economic capacity to increase its technology budget at anything approaching those rates.

Dr. Howard A. Rubin

That is the collision illustrated in this cartoon. Most companies cannot indefinitely grow technology spending at 10%, 15%, 20%, 30% or even 50% when their revenues, operating margins and the economies in which they operate are growing at only a fraction of those rates.

And the affordability problem is actually worse than the headline spending forecasts suggest.

Enterprises simultaneously face the economic headwinds: IT inflation; AI premiums; rising compute, server and memory costs; cybersecurity; energy and datacenter requirements; technical debt; scarce technology talent; software and cloud price escalation; regulatory and control costs; and the continuing expense of maintaining yesterday’s technology while financing tomorrow’s.

The result is what I call the Technology Affordability Gap: Technology demand + technology inflation + AI investment + infrastructure requirements are growing faster than the economic capacity of many enterprises to pay for them.

This produces an extraordinary paradox. Every technology forecast can appear individually plausible from the supplier’s side while their collective implications become economically implausible from the customer’s side.

A hyperscaler can forecast enormous cloud growth. An AI company can forecast enormous AI adoption. A software company can forecast higher subscription revenue. A semiconductor company can forecast explosive demand for AI infrastructure. An analyst can add all of those expectations together.

But ultimately there is only one customer balance sheet paying the bills.

Something, therefore, has to give.

Enterprises will have to slow spending, eliminate legacy costs, consolidate vendors, renegotiate contracts, defer lower-value projects, substitute AI and automation for labor, radically improve technology productivity, and demand demonstrable economic returns from AI and other technology investments. Otherwise, technology spending will increasingly have to be financed by taking money away from other parts of the enterprise— or by sacrificing margins.

That is the impending Technology Economic Crisis.

It is not a crisis caused by a shortage of technology. It is potentially a crisis caused by more technology ambition, more technology supply and more technology spending expectations than the underlying economy can afford.

The question for 2027 and beyond, therefore, isn’t simply: “How much technology will companies want?”

It is: “How much technology can they actually afford?”

The digital twin concept earned its credibility in engineering. Its origins trace to a 2002 University of Michigan presentation in which Michael Grieves described a “Mirrored Spaces Model”: a virtual system holding the information about a physical one, linked to it throughout its life.

For example, a jet engine manufacturer builds a precise virtual replica of a physical turbine, feeds it real-time sensor data, and runs simulations that predict failure before it occurs, optimize maintenance intervals, and test design modifications without touching the physical asset. This model is invaluable because the cost of being wrong about a turbine is high, the variables are measurable, and the physics are well understood. Organizations have applied the same principle to factory floors, supply chains and urban infrastructure, each time with the same underlying logic: a dynamic model of a complex system allows continuous optimization that periodic review cannot match.

However, the enterprise itself has received only part of that treatment. Even Gartner now evaluates organizational digital twin platforms as a category, describing them as dynamic models of how an organization operationalizes its business model, deploys resources and delivers customer value. Yet most of these twins model how work flows, not what it is worth, and that gap is consequential.  

A dynamic model of the enterprise

Still, most large organizations still navigate strategic decisions with a picture of themselves that is static, incomplete and economically unattributed. Org charts describe reporting relationships as they were drawn at the last reorganization rather than how people actually interact. Process maps describe intended or designed workflows, not actual ones. And planning documents describe resource allocations as they existed at the time of the last budget cycle. None of these artifacts answer the question that matters most for strategic decision-making: what is the work actually worth, at the level of granularity required to improve it?

A living model of the enterprise changes what is possible. Imagine a representation of how work actually flows across functions (not as designed or conceived, but as executed), where decisions accumulate and slow, where handoffs lose information, where risk concentrates until it surfaces as an incident, and where resources are applied to activities whose economic contribution has never been examined. Connected to real-time operational data, that model moves leaders beyond the static artifacts that currently substitute for organizational self-knowledge.

But a model of how work flows is useful only for operational diagnosis, not a complete economic understanding. Strategic redesign requires knowing what the work measurably produces at the level of individual activities, decision points and handoffs.

Enriching the digital twin with economic process modeling

As I have discussed in previous pieces, Economic Process Modeling (EPM) provides that additional layer. By decomposing processes into their constituent components and attributing value across five dimensions (revenue contribution, cost and friction, risk exposure, option value and information value), EPM transforms a process map from a descriptive artifact into an economic instrument.

The output is not a flowchart but a value ledger: which components are value drags that cost more than they contribute, which are misaligned (a person doing a system’s job, or the reverse), and where value is created but never collected, usually as data the process discards. That is the side of the business case that cost accounting alone cannot show. It is the value layer the enterprise digital twin needs to support strategic decisions rather than merely operational ones.

Douglas Laney

Enterprise, know thyself

The practical benefits of an enterprise digital twin featuring EPM are compound:

• It enables businesses to model the P&L consequences of a restructuring before headcount decisions are made.
• It surfaces the process components where AI investments could generate the highest return per dollar–rather than requiring that prioritization to be resolved through stakeholder negotiation and executive sponsorship, which is how it is currently resolved in most organizations.
• It makes visible the information assets being generated and destroyed by current process designs.
• And it shows where risk is concentrating in operational workflows before that concentration produces a regulatory finding or a customer failure.

These are not incremental improvements to existing planning processes; they represent a different quality of organizational self-knowledge.

What makes this achievable rather than speculative is that the required inputs exist in most large organizations already. Process mining tools extract actual workflow patterns from system logs,  ERP and CRM systems hold the operational and customer data needed to attribute revenue and cost at component level, and risk systems hold the exposure data.

The missing element is the economic model that sits above the infrastructure, translates operational patterns into value attributions, and makes the enterprise legible as an economic system rather than a collection of functions.

Economic process modeling in action

CentrePort, is the port and logistics operator in Wellington, New Zealand. Its CentreConnect freight service generated a high volume of small inter-port charges, each reviewed and reconciled by hand by a small commercial team working from spreadsheets. Rather than automating first, the company modeled the invoicing workflow down to individual container movements, linked each activity to time and cost data, and tested standardization and automation scenarios before committing to change.

Processing time per invoice fell from 25 minutes to 23 seconds. But the more telling outcomes were those a throughput metric would miss: fewer financial discrepancies and less overpayment risk, stronger data governance than spreadsheets allowed, and groundwork for scaling volumes without adding staff. Those are risk, information and option value, not only cost.

CentrePort has since applied the approach to other commercial processes and now treats it as a precondition for change.  “Before undertaking any projects, we now ensure that the current state is understood, along with the upstream and downstream impacts of change,” said Tanya Dednam, Head of Digital.

The evolution from physical to enterprise digital twins

As many businesses and the global economy continue to shift toward digital, AI-based and services-oriented offerings, economically modeling the enterprise can become more important than modeling physical things.

However, the analogy to physical digital twins carries an important limitation: Turbine physics are stable whereas organizational economics are contested, context-dependent and subject to strategic choice. An enterprise digital twin built on EPM does not produce a single authoritative answer about what a process component is worth. It produces a structured basis for the argument, with explicit assumptions that can be examined, challenged and revised as conditions change, which is precisely what distinguishes a useful analytical framework from the static planning artifacts it replaces.

The competitive advantage this capability confers is not in the model itself. Rather, it is in the organizational discipline of making economic attribution a continuous practice, of treating the enterprise as an asset to be actively managed rather than a structure to be periodically reorganized when the last reorganization stops working. And rather than an enterprise-wide focus, the practical aperture is a single process with high economic exposure–ideally one already under transformation or AI investment pressure, modeled well enough to inform a real decision or action.

Organizations that model, measure and analyze the EPM-enhanced digital twin of their processes will be able to adapt, optimize and transform with significantly greater agility than those navigating with onerous org charts and planning PowerPoints.

In the fast-paced world of agentic AI, building agents and defending ROI is yesterday’s news. Today, the more pressing challenge is managing and governing the exploding workforce of agents to mitigate growing enterprise risk.

The problem intensifies as AI agents move from advisory to more active roles. According to a survey of 200 IT and AI decision makers conducted by Foundry and Rubrik, most agents are allowed to act with full (26%) or limited (35%) autonomy.

With access to enterprise systems and authority to execute end-to-end tasks, governance, guardrails, and compliance have become key obstacles to AI agent implementation. This was cited by 42% of survey respondents, along with AI agent management, at 18%. Almost one quarter of respondents (24%) cited security and governance as the biggest barrier to their ability to scale agents, even over technical complexities (17%) and lack of proven ROI (14%).

Rubrik

The reality is traditional security, monitoring, and governance solutions are architected to manage human identities, not agentic AI. “We spent decades mastering how to manage humans and we’ve gotten pretty good at that,” says Michael Ortega, Director of AI Marketing at Rubrik. “We don’t yet have that same rigor for agents.”

For example, there is no scenario where a company would hire 1,000 new employees without onboarding or managerial oversight. Nor would they give them access to highly sensitive data right off the bat. “[AI agents] are our new employees, but that’s exactly how we are treating them,” Ortega cautions.

A new governance paradigm

Traditional security and governance guardrails don’t translate well to an agent workforce that moves at machine speed to evaluate and execute thousands of decision points in seconds. AI agents are also probabilistic, which lets them make complex decisions, but also act in unpredictable ways. As a result, a rogue agent can do 10x the damage of a human in one-tenth the time.

Currently, most organizations use logs and manual review or legacy observability platforms to keep tabs on agents. But they lack the holistic visibility and context needed to effectively track agent identity, actions, and downstream impact. There are also a variety of methods employed to govern agents, many paper-based, with limited ability to control agent behavior at run-time.      

Without a new paradigm for controls and visibility, AI agents become a vector for significant enterprise risks while undermining business value. Nearly half of survey respondents have had to deal with an agent or chatbot conveying false or incorrect information. Another 38% confirm agents have exfiltrated data or caused a sensitive data leak.

But it’s not because AI agents are inherently malicious – it’s because they lack the common sense of their human counterparts. “We can’t put a human in the loop for everything because that would slow things down,” Ortega explains. “We have to enable our teams to have autonomous workflows without having a human check everything.”

A new breed of solutions is emerging to manage the autonomous workforce. As an example, Rubrik tackles this head-on by leveraging AI to govern AI. Rather than relying on static rules and legacy pattern matching, Rubrik Agent Cloud evaluates real-time behavior anchored in deep data and identity context. Armed with this context, the platform assesses agent intent to block or permit actions before execution. By unifying monitoring, control, and remediation into a single pane of glass, Rubrik delivers holistic visibility across the entire agent estate. For the inevitable moment an AI agent strays, Rubrik’s Rewind initiates granular rollbacks to restore the environment to a known good state, eliminating downtime and data loss.    

AI is forcing IT and security leaders to reimagine governance, and platforms that safely unleash the agent workforce are essential for success. See all the insights from the survey on agentic governance and risk.

Artificial intelligence has been part of semiconductor design for years, helping engineers optimize chip architectures for performance, power efficiency, silicon area and faster development. More recently, the industry has begun integrating large language models and AI agents into established electronic design automation (EDA) workflows. Now Cadence Design Systems is taking that approach further with its Maestro AI Model Portfolio, a collection of domain-specialized models designed to work with the company’s engineering software and AI Super Agents.

Maestro combines specialized model training, reinforcement learning and established EDA tools to improve how AI agents execute engineering tasks and evaluate results. Cadence claims better design outcomes with greater token efficiency versus general-purpose foundation models. While initially focused on chip and electronic system design, I also see broader implications for enterprise AI economics, proprietary data protection and deployment across complex engineering and business applications.

AI builds on established engineering software

Modern semiconductor design is enormously complex. Engineers must balance performance, power consumption, silicon area, manufacturing constraints and costs across chips containing billions of transistors. Cadence and chief competitor Synopsys have spent decades developing software to optimize for these challenges, and both are now incorporating AI agents capable of executing increasingly complex engineering workflows using those tools.

Cadence Design Systems, Inc.

“Revolutionizing complex engineering tasks requires deep domain-specialized intelligence,” notes Cadence president and CEO Anirudh Devgan in the company’s announcement. In my discussions with Cadence executives, we explored how Maestro builds on that approach to improve engineering workflows and design outcomes.

Cadence Maestro combines domain-specialized, post-trained language models, trained decision models and reusable agent skills with Cadence’s EDA and system design automation (SDA) tools. The portfolio supports ChipStack, InnoStack, ViraStack and AuraStack AI Super Agents, which interpret engineering objectives, break them into tasks and engage appropriate models and software tools. Rather than relying on a single model, agents can combine Maestro with commercial frontier and open-weight models according to workload requirements.

What I find particularly interesting is Cadence’s reinforcement learning architecture. EDA tools, evaluation frameworks and deterministic solvers assess AI-generated outputs against engineering constraints, including timing, power and physical design requirements. That feedback can improve subsequent model decisions and agent behavior. It’s a potentially important advantage over relying exclusively on general-purpose LLMs, since engineering results can be evaluated against measurable design constraints rather than language-based assessments alone.

NVIDIA is contributing its Nemotron model technology and collaborating with Cadence on agent security through its OpenShell AI sandboxing architecture, with integration work by both companies underway.

The business case for domain-trained AI in engineering

Cadence Design Systems, Inc.

Cadence reports that initial Maestro evaluations delivered up to 30% better quality of results and five times greater token efficiency, compared to a general-purpose foundation model. These are early vendor-reported results, however, and Cadence hasn’t disclosed enough benchmark detail to establish how consistently those advantages translate across production workloads.

Greater token efficiency is always a goal of course, particularly for AI agents executing lengthy, iterative engineering tasks. But reducing token consumption doesn’t always translate into proportional cost reductions. Engineering software, simulation infrastructure, verification and available compute resources also contribute substantially to development costs.

To me, the larger opportunity is improving design quality and shortening development cycles. Chip development programs can require hundreds of engineers and substantial capital investment, so even modest productivity improvements or faster time to market can offer significant value.

Cadence Design Systems, Inc.

Cadence customer Socionext expects up to fivefold productivity gains from deploying the company’s InnoStack AI Super Agent in production, although that’s a projection rather than a demonstrated Maestro result. Silicon Labs has also reported faster root-cause analysis and debugging using Cadence’s ChipStack technology. These examples show progress with agent-based engineering, but Maestro’s performance claims still need production validation. I’ll be interested to see how those results develop.

Deployment flexibility and data control

Another noteworthy aspect of Maestro is deployment flexibility. Cadence says its agentic engineering environment supports deployment through its own secure cloud platform, supported public clouds or customer-controlled on-prem infrastructure. Customers can also further train supported models using proprietary engineering data.

For semiconductor companies, where intellectual property can represent billions of dollars in investment, maintaining control over sensitive design information is critical. Similar considerations apply in financial services, healthcare and aerospace, where proprietary data and regulatory requirements can complicate AI deployment.

The tradeoffs warrant examination, however. On-prem deployments can shift responsibility for GPU infrastructure, model updates, security controls and optimization to the customer. Those costs need to be weighed against cloud inference expenses, data residency requirements and the potential performance benefits of processing data close to engineering workloads. In my view, Cadence’s deployment flexibility is valuable because enterprises can evaluate these choices against their infrastructure, security policies and engineering economics.

Specialized AI continues to gain momentum in chip design

Cadence Maestro is part of a broader industry push toward AI-driven semiconductor engineering. Established EDA vendors are expanding their agentic capabilities, while AI-native startups are developing systems for RTL generation, verification, debugging and physical design optimization. Domain-trained models, engineering feedback loops and intelligent model routing are also gaining attention.

What’s interesting here is the potential for agents to coordinate multiple engineering tools and models while retaining the design context needed for complex tasks. The business opportunity extends beyond automating individual steps to reducing the effort required to reach verified design results. For enterprise technology execs, that puts greater emphasis on toolchain integration, measurable productivity improvements and the economics of AI-assisted engineering.

Proving the value of specialized AI in chip design

Cadence’s first Maestro models are entering select customer early access in the fourth quarter of 2026, so it’s too early to know whether the company’s performance claims will translate consistently into production.

General-purpose models will remain important for broad reasoning, language and multimodal applications. However, specialized engineering processes often demand deeper domain knowledge, validated results and tight integration with existing software.

From my perspective, Cadence’s approach offers a glimpse of where enterprise AI is heading. Selecting the right models, tools and deployment architecture for specific workloads will be critical as adoption expands. And the early results are promising, with specialized AI showing the potential to improve engineering outcomes, boost productivity and reduce development costs at scale.

In this issue

1. Every price action reported in September, with effective dates and what landed as announced
2. The October calendar: five manufacturers on October 1, two more on October 5
3. The effective dates and order cutoffs already published through November
4. Supply signals worth planning around, including HP’s own read on 2027

September went the way August said it would

HP’s two-step increase arrived on schedule: Smart Buy and Channel Express list prices on September 1, then a 10–15% repricing of Personal Systems and Solutions on September 15. HP told partners that any unit quoted since August 8 already carried the new price. Lenovo’s CTO and Special Bid sweep took effect the same day as published, with no revision notice. Samsung repriced the Galaxy A series on September 1 and put the S and Z series on notice for November.

The larger change is the breadth of what comes next. Five manufacturers reprice on October 1: Microsoft Surface, HP Carepack services, Panasonic TOUGHBOOK, Ericsson, and Lenovo Top Seller. Zebra and Elo follow on October 5. The increases now reach past PCs into services, rugged devices, and network hardware. HP’s own briefing set the tone: technology prices are up more than 50% year over year in 2026, processors and graphics cards have joined memory and storage on the way up, and HP does not expect the trend to slow in 2027.

Price actions in September 2026

Source: manufacturer and distribution partner communications

Fig. 1 · The October calendar

Order cutoffs and effective dates · Oct 1 – Nov 1

Five increases on one day, then two more.

Fig. 2 · How often it landed

Announcements by manufacturer · Dec 2025 → Nov 2026

Twenty-six actions in, with nine more already published.

What is already on the calendar

Surface, Lenovo Top Seller, and Panasonic reprice

Microsoft Surface increases on select Surface Pro 12th Edition and Surface Laptop 8th Edition. Lenovo’s non-EDU Top Seller increase takes effect as published. Panasonic reprices its TOUGHBOOK rugged portfolio, and any purchase order with a requested delivery date on or after October 1 gets the new price regardless of when it was placed. None of the three published a percentage.

Requote anything quoted before October 1 before it goes to a stakeholder, and confirm requested delivery dates on open TOUGHBOOK orders.

HP Carepack services increase

A published list of HP Carepack SKUs rises approximately 7–10% over current prices, per distribution. This is HP’s first services move of the year and sits outside the September client-device repricing.

Attach warranty and care packs at the time of the device order rather than as a follow-on; the device and the service now reprice on different calendars.

Ericsson, 10–20% by model

R2105 up 10%; W2255, W1850, W1855, R920, and RC1250 up 15%; R980 up 20%. Non-cancellable orders accepted by October 1 are honored at current MSRP for quantities delivered and billed by December 31. IoT Foundation SKUs lose Deal Registration eligibility the same day, and Ericsson is guiding to extended lead times.

Place Q4 router and adapter quantities as non-cancellable orders now — the December 31 delivery window is the longest price hold on the calendar.

Zebra and Elo list price adjustments

Zebra raises list prices 3–15% by category across scanners, mobile computers, RFID, printers, and services; Solutions Pathway reflects the change at 6 PM CT on October 2, and existing deal registrations and price concessions must be renewed. Elo follows October 5: Android-based products up 7.5%; services, warranties, and select software up 10%.

Renew Zebra deal registrations before October 2; place Elo special pricing with distribution by October 4 to hold it through December 31.

Samsung Galaxy S and Z series

Increases of up to $200 on the S series and up to $300 on the Z series, following the September A-series move. Samsung has said further detail will come once confirmed and that all pricing remains subject to change.

Order Q4 flagship handsets in October. Samsung has reserved the right to move again without notice.

HP client devices — expected, unconfirmed

Channel briefings continue to indicate a further 10–15% move on client devices in HP’s first fiscal quarter. No notice had been issued at press time.

Treat September’s price as the floor for Q4 HP planning, not the ceiling. HP’s Q4 sales-out rebates run through October 31.

The cost pressure has widened

HP told partners in late August that memory and storage are no longer the only inputs rising, with processors and graphics cards up roughly 30%, and that the increases will carry into 2027. Ericsson, Zebra, Panasonic, and Samsung each cited component and semiconductor costs in their October notices, and Ericsson is warning of longer lead times alongside the price change.

Manufacturers are also tightening the terms around increases. Panasonic prices on delivery date rather than order date, HP repriced in-flight quotes from August 8, and Samsung has reserved the right to move again without notice. The pattern from August holds: organizations that share demand forecasts and pre-approve substitutions keep their orders moving; reactive buyers absorb the delay and the increase.

Build the 2027 budget on October’s prices, not January’s

The October 1 window has closed for most of what it covered, so the useful question is no longer how to beat it. Three things still hold pricing for a while: Ericsson honors orders accepted by October 1 through December 31 delivery, Dell’s 30-day quotes remain the longest lock in the market, and HP’s Q4 sales-out rebates run through October 31. Use them for anything that must land this quarter.

Then treat November as the next step, not the last one. Samsung’s S and Z series reprice November 1, HP’s expected client-device round would follow, and HP has said the trend continues into 2027. A device budget built on January 2026 list prices is now 15–25% short on the PC lines that have repriced twice. Rebase the 2027 plan on current quotes, carry a 10–15% contingency on device and services lines, and let refresh timing follow device condition rather than the calendar. The units that can wait a quarter should.

Every date, every figure, four pages

The full October issue carries the complete price action record, both charts at print resolution, and the effective dates ahead — formatted to forward to a stakeholder as-is.

Pricing actions reflect manufacturer and distribution partner communications tracked by MCPC partner management through September 26, 2026. Individual results vary by configuration, volume, and contract terms. Figures described as reported reflect channel communications rather than published manufacturer price lists. MCPC is a device lifecycle management company headquartered in Cleveland, Ohio.

To view the full October report, visit here.

Few CIOs are likely to suddenly decide to give an AI agent broad authority over corporate systems. The more likely path to autonomy is far less dramatic. An agent starts with a narrow task. It proves useful, so another system is connected. It then needs more data, so another permission is added. Then human approval becomes a bottleneck, so the organization removes it, and exceptions that once went to people start being handled automatically.

Each decision may be sensible in isolation. Taken together, however, they can leave an agent with considerably more authority than anyone originally envisioned.

That’s the danger of autonomy creep. And as enterprises move from AI systems that recommend actions to agents that execute them, CIOs need to govern not only what those agents were originally designed to do, but what they have gradually become capable of doing.

It starts with small permissions

Jim Taylor, president and chief product and strategy officer at identity security company RSA, sees a familiar pattern. Organizations typically create an agent for a specific purpose and give it the permissions necessary to accomplish the task. Later, the job expands.

“They just give it tasks, permissions; it just sits there and accumulates things,” he says. “Over time, it develops potentially toxic combinations. It gets too much access and can see too much data. It can do too many things.”

Humans accumulate permissions, too, of course, but organizations have developed processes around employees joining, changing roles, and eventually leaving. Agents may not have the same natural lifecycle. “They never give permissions back,” Taylor says.

Nancy Wang, CTO of 1Password, argues that CIOs should treat each expansion in an agent’s responsibilities as something more consequential than another feature. “Every time you expand the scope of the agent’s effective authority, you’re essentially adding a new authorization boundary,” she says.

That distinction between capability and authority is important. An agent may be technically capable of accessing a system, changing data, or executing a transaction, but that doesn’t mean the enterprise should automatically authorize it to do so.

Success can weaken oversight

Ironically, autonomy creep often occurs when AI works well. Paul Dongha, head of responsible AI and AI strategy at NatWest Group, sees that potential at the bank.

NatWest deployed agents in complaint handling, he says. Parts of the workflow that involve retrieving information from systems can be automated relatively easily, while humans continue to make the final decision on whether to uphold or reject a complaint.

If a system consistently produces the correct result, human reviewers may begin treating approval as a formality. The organization may eventually decide that the check is no longer necessary. “The temptation is to give over to the AI because it’s so reliable,” Dongha says.

NatWest sometimes reduces checking when an AI system demonstrates sufficiently high performance, he adds, but the decision is deliberate rather than incremental. It involves stakeholders and risk managers, and the system continues to be monitored afterward.

That’s a critical distinction for CIOs. Removing an approval step doesn’t necessarily represent poor governance. Removing it because everybody has gradually stopped paying attention to it does.

The warning sign is when a human moves from making a meaningful decision to merely rubber-stamping one — and then entirely disappears from the workflow without anyone reassessing the authority the agent has gained.

Put the controls outside the model

As agents acquire more authority, CIOs can’t rely solely on the agent to respect instructions about what it should and shouldn’t do. At 1Password, Wang advocates what she calls verified loops. Before an agent begins work, humans define its task, which tools it may use, what evidence will demonstrate that it completed the task successfully, and which actions it should never perform.

A separate verifier then compares evidence from the agent’s actions against that human-defined policy. “What you want to avoid here is something recursive where you have a fox guarding a henhouse, or the agent looking over its own work,” Wang says.

The principle applies beyond software development. A model might be instructed never to transfer more than a certain amount of money, delete a production environment, or access particular data. But if violating that rule would have serious consequences, the limit should also exist outside the model.

RSA’s Taylor makes the same distinction from the identity and access side. “Model-level guardrails are necessary, but not sufficient,” he says. “The real limits need to sit outside of that in enterprise control.” He argues for layered controls around agents, including identity policies, provisioning rules, lifecycle policies, governance, monitoring, and attestations.

In other words, CIOs shouldn’t ask an AI agent to exercise restraint where the infrastructure could simply prevent the unauthorized action.

Govern access in real time

Traditional access governance often operates on a schedule. A manager might review an employee’s permissions quarterly and determine whether those permissions are still appropriate. Agents may evolve too quickly for that approach. “Agentic identities are dynamic,” Taylor says. “So we need a mechanism that certifies them continuously, rather than performing periodic reviews.”

If an agent suddenly gains access to another database, for example, that event itself could trigger reassessment. Organizations should determine whether the new permission is appropriate or creates a dangerous combination with access the agent already possesses. “Privilege and authority should never be permanent,” Taylor adds. “They should always be reviewed.”

Wang favors an even more granular approach of task-based authorization. Rather than giving agents standing access or long-lived credentials, organizations can make authorization decisions at runtime and provide short-lived credentials only when required for a particular task. “We espouse no standing privileges,” she says. “No long-lived credentials.”

That effectively applies least privilege at agent speed. A change in task becomes an opportunity to reassess whether the agent still needs the access it’s requesting.

Make someone own the agent

Technical controls, however, don’t eliminate the organizational question of accountability. Taylor believes enterprises should be able to associate agents with a responsible identity. If an employee creates an agent, the organization needs to know who’s responsible for it, what its purpose is, and what happens to it if that person changes roles or leaves. “Every agent action needs to be attributed to a responsible identity,” he says.

Ownership also needs a lifecycle. An agent that remains important after its creator leaves should be transferred to another designated owner rather than simply continuing indefinitely.

Dongha makes another distinction. For AI embedded in a business process, he believes the business owner should remain accountable because that person owns the customer relationship, the process, and often the P&L. “It’s the business owner who has the responsibility because their people run it, and they’re responsible for the customer relationship,” he says.

That creates a useful division of roles for CIOs: IT may provide the infrastructure and controls, but the business can’t outsource accountability for the consequences of autonomous decisions.

Multi-agent systems need system-level controls

The challenge becomes more complicated when agents begin working together. An individual agent might remain entirely within its permitted scope while contributing to an overall outcome nobody intended. One agent generates an output. Another accepts it as input and takes an action. A third agent then acts on the result. Again, the individual actions may all appear legitimate.

Dongha says enterprises therefore need to test not only individual agents but the entire network as a system. “You need something overarching on top of a multi-agent system,” he says.

NatWest is working on an AI control tower that would give authorized users visibility into a network of agents, including messages passed among them and the guardrails surrounding those interactions. Dongha considers governance of multi-agent systems an emerging problem that nobody has fully solved yet.

Wang also points to a related challenge that identity becomes more complicated when agents are ephemeral. An organization may spin up a temporary team of agents, tear it down, and recreate it later. If something goes wrong, the enterprise needs to reconstruct which agent made which decision during which session, and how that action propagated through the system.

That makes traceability increasingly important as autonomous systems become less like individual applications and more like networks of interdependent actors.

Set the bar before the agent reaches it

Before an agent goes into production, Taylor says CIOs should be able to answer several basic questions: Who owns it, what can it do, what’s its maximum authority, how will the organization know if that scope changes, and which actions require a human decision.

Other industries don’t need to replicate the governance machinery of a large bank, but they can borrow one important principle: controls should be built into the system from the beginning. “Governance shouldn’t be a check at the end,” Dongha says. “It needs to be embedded when you build an AI system.”

For CIOs, that may be the central lesson of autonomy creep. The question isn’t simply whether an agent can be trusted today but whether the organization has mechanisms to notice when tomorrow’s agent has quietly acquired authority that nobody ever intended to give it.

As organizations incorporate AI into their environments, they’re hyper-focused on the AI model. Many executives I talk to spend a lot of time considering what model they should purchase from which vendor. They’re also concerned about which use case they should implement first.

Yet the reality is that AI models are swappable components. The vast majority of organizations are using multiple AI models, switching them out for their specific needs based on cost, accuracy, and security. It’s the right thing to do; organizations with architectures that make it difficult to swap out AI models are making the wrong bet.

What can’t be swapped out is your inference path—or everything that happens between a user’s intent and the model’s output. This includes the retrieval layer that decides what context the model sees. It includes the routing logic that chooses what model handles which request. It includes the identity that travels with the call. And it includes your organization’s policies, which decide what the model can do with the answer. That is where accuracy and costs are determined. It’s also where your proprietary advantage lies. A competitor can buy the same model you have, but they cannot buy your inference path, which determines not only the quality and cost of AI, but also its performance, resilience, and security at scale.

Adoption of AI inference is outpacing readiness

That truth is becoming increasingly important as AI adoption continues to accelerate. Recent F5 research found that more than three of every four organizations (78%) now run AI inference themselves across an average of seven AI models. Yet our research from a year ago found that just 2% of organizations were genuinely equipped to operate AI at scale.

What this shows is that enterprises are taking inference in-house, even when they’re not ready, because they want their data, expenses, and security posture under their own roof. All of this makes sense. But taking inference in-house also means taking responsibility for every decision, control, and dependency surrounding it. That is a much larger operational commitment than simply procuring a model.

The challenge of securing the inference path

Managing the inference path is not simply an AI security problem. It’s an application delivery, security, and operations challenge that spans the entire hybrid multicloud environment. As organizations move from pilots to production, every additional model, application, agent, API, and deployment environment adds another potential point of latency, policy inconsistency, or exposure. Today, 86% of enterprises operate across hybrid multicloud environments, and their inference path runs through all of it. As they add more AI models, applications, and agents, the number of possible inference paths multiplies, as do the performance and security challenges.

Let’s assume you’re a company with multiple AI models, with each step 95% reliable—a generous assumption for anything involving retrieval, tool calls, and a probabilistic model. A three-step pilot chain succeeds 86% of the time. A 20-step production chain succeeds 36% of the time. As you add more steps, the system will go from mostly fine to mostly broken.

When it comes to security, if each agent in a chain has a 5% chance of being manipulated, mis-scoped, or handed a credential it should not have, with a 20-agent workflow there’s a very strong chance that at least one link is exploitable. This is why more than nine out of 10 organizations report new categories of problems once agentic AI hits production levels, according to our research, including credential handling, action auditing, and the basic question of what an agent did on whose authority.

Tips for managing your inference path

So how can enterprises manage the inference path?  Here are three points to consider as you get started:

• Get a better handle on your AI infrastructure: You need to know many models your organization has in production and how long it takes to add or replace one. You need to know the longest agent chain in production and its measured end-to-end success rate. You need to know how AI policy is enforced and what’s required to update it. And you need to know what percentage of inference latency is due to security and governance overhead. Comprehending all of this is key to sound management.

• Treat performance, security, and governance as a single priority. While enterprises have historically viewed the three as separate priorities, AI collapses them into one budget that’s measured in milliseconds and tokens.Every guardrail you add to the inference path results in more latency. Every governance requirement costs context window, which costs money on every single call. Prompt inspection, output filtering, PII redaction, model routing, retry logic: each is simultaneously a security control, a performance cost, and a line item. You can’t fund one without taking budget from the others, and you can’t cut one without exposing the rest.

• Simplify complexity with a platform approach. The average enterprise today uses seven AI models, operates in multiple clouds, and maintains applications and APIs spread across on-premises, public clouds, and colocation environments. Applying policies separately across every model, environment, and protocol creates inconsistency, blind spots, and unnecessary operational work.  Using an array of point solutions makes it extremely difficult to apply consistent policies or know which control is responsible when something goes wrong. A single enforcement point is critical, regardless of the model, environment, or protocol used.

A platform approach brings delivery, security, and governance together so organizations can enforce policies more consistently, maintain visibility across the inference path, and change models or infrastructure without rebuilding their controls each time. This helps enterprises scale AI while preserving performance, resilience, and operational choice.

 The F5 Application Delivery and Security Platform (ADSP) provides enterprise-grade visibility, governance, and protection for AI applications, models, agents, and APIs across today’s complex infrastructures. To learn more, visit the F5 ADSP webpage.

About the author

F5

As Chief Product Officer at F5, Kunal Anand leads product vision, strategy, and execution—ensuring the development of breakthrough solutions that solve critical challenges and create exceptional experiences for customers. In his previous role as Chief Technology and AI Officer at F5, Kunal charted the company’s technology and AI strategy and vision.

The legal disputes between Germany’s largest software company, SAP, and the Munich-based process mining specialist Celonis took another turn last week. After the German Federal Cartel Office most recently dismissed a complaint filed by Celonis in July, the Munich I Regional Court ruled entirely in favor of Celonis in a case regarding the infringement of a European patent held by Celonis.

Case No. 7 O 12849/25 concerned patent EP 3 139 274 B1 describing a method for determining a net lead time between process steps using process data stored in a structured manner in main memory (in-memory).

Celonis had filed a lawsuit alleging that the patent was infringed by a feature of the SAP Signavio Process Intelligence software solution — SAP acquired Celonis’s rival Signavio in March 2021.

SAP must cease use and provide information

The court ruling prohibits SAP from offering the patent-protected method in Germany or using it itself. SAP must also provide Celonis with information regarding the extent to which it has infringed the patent since April 22, 2020, including details on:

• where the patent-infringing processes originated and through which channels they were offered and distributed;
• which customers purchased them, including names and addresses;
• how many access licenses were granted and how much users paid for them;
• for how many users the methods were used per calendar year;
• which other individuals were involved in offering and using the methods.

In addition, SAP must provide a transparent account of the extent of the patent infringements based on its financial figures. The company is obligated to pay appropriate compensation or damages.

“The ruling by the Munich Regional Court confirms our legal position: SAP Signavio’s technology infringes on Celonis’s patent rights. We consistently protect our intellectual property and remain committed to fair competition,” explained a Celonis spokesperson.

SAP says no consequences for its customers

SAP, however, points out that the court ruling pertains to a single, specific feature within SAP Signavio Process Intelligence, not to the product as a whole. SAP Signavio Process Intelligence remains available to customers, according to a company spokesperson.

The spokesperson also dismissed concerns that the ruling could hinder companies’ migration to SAP S/4HANA Cloud. Migrations to SAP S/4HANA Cloud are not affected by this, he said. SAP is working to ensure that there are no disruptions for its customers.

The concern is not entirely unfounded: SAP Signavio is part of Rise with SAP, a SaaS solution from the Walldorf-based company designed to support migration to the S/4HANA Cloud. SAP Signavio’s process mining tools are designed to provide insight into actual process flows and identify inefficiencies and bottlenecks.

SAP will appeal

The Regional Court’s ruling does not mean the matter is by any means settled: As the spokesperson for the Walldorf-based software giant explained, SAP does not share the Munich court’s legal opinion and will file an appeal against the ruling. In addition, SAP has challenged the validity of the patent in question before the Federal Patent Court.

“SAP’s top priority is to ensure that customers are not affected by this. All other issues will be resolved through the appropriate legal channels,” said the spokesperson for the Walldorf-based company.

This article first appeared on Computerwoche on Oct. 13, 2026.

Picture a regional marketing director on a Monday morning. She’s got 80 locations, a cup of coffee, and a nagging feeling that something is off in the Southeast. Reviews seem quieter. A couple of stores got new managers last month. Are those two things related?

Not long ago, finding out meant pulling an export, building a pivot table, pulling a second export from another system, and stitching it all together in a spreadsheet. Or, more realistically, filing a request with an analyst and waiting. Most weeks, the question simply never got asked.

Now she types it into the AI assistant her company already rolled out, and it answers using live data from the systems where that data actually lives.

The technology making that possible is the Model Context Protocol, or MCP. You’ve probably read plenty of “what is MCP” explainers by now, so I won’t add another. Instead, I want to talk about what changes for marketing teams, especially those managing lots of locations, when a cross-system question gets this cheap to ask. And what CIOs need to get right before it becomes the normal way marketing works.

The real shift: the join moves into the conversation

Here’s the short version of how MCP works. Your AI assistant (Claude, ChatGPT, Copilot, Gemini, or something your team built) is the host. Each business system, like your reputation platform, ad account, or CRM, publishes an MCP server. That server tells the assistant, in plain language, what it can do: “I can summarize reviews for a group of locations,” or “I can check whether your listings match across Google and Apple Maps.” The assistant reads that menu, picks the right tools for the question, and calls them.

That’s really it. But two things fall out of it that matter a lot for marketing.

First, the integration math gets much friendlier. Connecting four assistants to ten marketing systems used to mean up to 40 custom integrations. With a shared protocol, each assistant learns MCP once, and each system publishes one server. The conversation shifts from “should we build this integration?” to “which servers do we approve?”

Second, and this is the one people underestimate, the join moves. In a traditional stack, combining review data with POS and CRM data happens in a warehouse, on a schedule, through a pipeline someone has to own. With MCP, a regional leader can connect three systems to the same assistant and ask one question across all of them. The model does the join on the spot, right in the conversation, using that person’s own permissions.

That doesn’t replace your data warehouse. What it does is make a long tail of one-off, “I just want to know” questions affordable for the first time. In multi-location marketing, that long tail is where a lot of the useful insight lives.

It’s also not a science project anymore. Anthropic donated MCP to the Linux Foundation’s Agentic AI Foundation last December, with OpenAI, Google, Microsoft, and AWS all involved. And the July 2026 spec update made it far more enterprise friendly. It now scales on ordinary infrastructure, lets IT control which tools can run at the gateway, and gives tools a standard way to stop and ask a human, “Are you sure?” before doing anything.

Location marketing is the ultimate stress test

If MCP works for brick-and-mortar marketing, it’ll work almost anywhere. Do the math on a mid-sized brand. Three hundred locations, each listed on Google, Apple Maps, Bing, and Yelp, add up to 1,200 profiles that all need the same name, address, phone number, and hours. Every location collects reviews every week on multiple sites. And each one sits inside a hierarchy of district, region, brand, and maybe franchisee, where every level is supposed to see a different slice.

On top of that, the questions people ask are almost always comparative. Nobody asks, “What’s store 114’s rating?” They ask, “Which stores in the Southeast are slipping, and why?” Those are exactly the questions dashboards handle badly, and exports handle slowly.

My colleague Kristi Melani recently wrote here about how reputation data is now moving in two directions: outward to the AI engines customers use, and inward to the assistants your own teams use. MCP is the plumbing for that inward direction, and it raises the stakes on data quality on both sides. A wrong Sunday hour on Apple Maps used to mislead one customer. Now it can mislead that customer’s AI and your CMO’s AI at the same time. Customers already punish that mistake: Rio SEO found that 53% of consumers are unlikely to visit a business with incorrect listings.

What this actually looks like

The pattern I’m seeing in multi-location brands is pretty consistent. MCP doesn’t replace the reputation platform, the listings tool, or the ad account. It changes who gets to ask them questions, how often, and in what combinations. A few examples:

• The field leader asks, “Which of my locations collected zero reviews this month, and what happened to their scores?” That used to be a weekly export, filtered by hand.
• The local search lead asks, “Where do our hours or phone numbers disagree across Google, Apple Maps, Bing, and Yelp badly enough that an AI assistant would get them wrong?” That used to be a quarterly audit.
• The paid media lead asks, “Which markets are we spending the most in where our average rating dropped below 4.0?” Google already publishes an official Google Ads MCP server, so that’s now one question instead of two dashboards and a spreadsheet.
• The CMO asks for the first-half reputation readout by market, with the three biggest opportunities. That used to be two or three days of deck-building.

The industry-specific versions get even more interesting. A dealer group can read service department reviews next to repair order data. A property manager can line up resident complaints with open maintenance tickets, building by building. A restaurant brand can check whether a spike in “cold food” reviews lines up with a change in delivery partners. None of that needed new infrastructure. It just needed both systems to have a server, and the person asking to have access to both.

Tool design matters more than tool count

Here’s something that surprises a lot of teams once they start piloting: the shape of the tools matters more than how many there are.

An AI assistant works within a limited context window and a limited number of tool calls. If a regional director asks about 300 locations and the server only offers a one-location-at-a-time lookup, the model has to make 300 calls and juggle 300 results. It’ll be slow, it’ll be expensive, or it’ll quietly skip some. A server that can roll up an entire region in one call hands the model a small, tidy result it can actually reason about.

The same goes for definitions. If “sentiment” is calculated differently on every review site, the model will happily compare numbers that aren’t comparable. MCP can’t fix that, because it just moves data. Consistent metrics have to exist before the assistant ever sees them.

So when you evaluate a marketing MCP server, don’t ask how many tools it has. Ask whether it can answer a portfolio-level question in one or two calls, using metrics that mean the same thing everywhere.

Connecting is easy. Governing is the real work.

Hooking an assistant up to a marketing system now takes minutes. Deciding whether you should is where CIOs and AI governance teams are spending their time. Four questions come up in nearly every conversation I have.

Whose permissions does the assistant use? The safest setup is for each person to sign in as themselves, so the assistant inherits their existing access. A district manager who sees 12 locations in the platform should see 12 through the assistant, not 300. What you want to avoid is a shared API key baked into a connector, which quietly gives everyone the widest access anyone has.

Can it change anything? Reading a review summary and posting a public reply to a customer are very different levels of risk. Review responses and listing fixes are where AI promises the biggest time savings, but they’re also public and attached to your brand. Plenty of organizations are starting read-only and adding write access one tool at a time, with a human approving each action.

What is the assistant actually reading? This one is specific to reputation data, and it doesn’t get talked about enough. Reviews are written by the public. A review can include text aimed at an AI rather than a person, essentially an instruction hiding in plain sight. If the same conversation also has tools that can send email or edit records, that’s a real risk. Keeping reputation access read-only, and keeping anything that publishes behind a confirmation step, shrinks that exposure a lot.

Where does the data go? Review text can contain names, health details, and other personal information. In healthcare, a review can effectively confirm that someone is a patient. Governance teams need to know which AI tools are approved for which kinds of data, and what each AI vendor’s enterprise agreement says about retention and training.

Underneath all four is a simpler truth: MCP makes your data easier to reach. It doesn’t make it more accurate. Gartner predicts that through 2026, organizations will abandon 60% of AI projects that lack AI-ready data. For local marketing, “AI-ready” means one location list every system agrees on, consistent metrics, and listings that are actually correct. If your store IDs don’t match between the reputation platform, the POS, and the CRM, the assistant’s answers will break in exactly the spots an analyst used to patch by hand.

Where to start

The organizations moving fastest treat MCP as a joint project between IT and marketing, not a feature marketing flips on by itself. Here’s the path I’d recommend:

1. Start with the questions, not the systems. Ask your regional leaders for the ten questions they ask most and wait longest to get answered. That tells you which servers actually matter.
2. Go read-only, per user, in one region. Approve a small set of servers that inherit existing permissions, and pilot with a team that’s already using an enterprise AI assistant.
3. Clean up your location list before you scale. It’s unglamorous work. It’s also what decides whether cross-system answers are right.
4. Add write access slowly, with a human in the loop. Review responses and listing corrections is the obvious next step. Set your brand voice and compliance rules before the first reply goes out.

Whatever servers you evaluate, make sure they work across every major assistant. An open standard is what saves you from rebuilding everything the next time your company switches AI vendors.

From questions to agents

Right now, most marketing use of MCP is a person asking a question. The next phase is software asking on a schedule: an agent that checks every location each morning, flags a listing that’s drifted, or drafts replies to overnight reviews for a manager to approve. Those agents will run on the same servers answering human questions today.

It’s already happening in other parts of the business. When the latest MCP spec was announced, Honeycomb shared that nearly 20% of its monthly interactive queries now come from agents, not people. Marketing data won’t be far behind.

That’s why the choices made in this first wave matter so much. When we built the Reputation MCP Server, we made it read-only and permission-based from day one, because an agent is only as trustworthy as the data it can reach and the access it’s allowed.

The protocol is open to everyone. What will set brands apart is the quality of the data they plug into it and how carefully they govern it. For marketers responsible for hundreds of storefronts, the questions that used to wait for the quarterly review are about to get asked every Monday morning. The brands that get their data ready will see their locations more clearly than ever.

For more information, visit reputation.com.

About the author

Kristi Melani is a transformational marketing executive with 30+ years of experience building high-performing teams, scalable marketing operations, and revenue-driving programs across high-growth startups and billion-dollar global enterprises. As CMO of Reputation, she leads global marketing strategy with a focus on brand trust, go-to-market excellence, and customer-centric growth.

Kristi is known for building marketing organizations from the ground up—creating clear processes, measurable frameworks, and cultures rooted in accountability, transparency, and performance. Prior to Reputation, she served as Chief Marketing Officer at Telesign and held senior marketing leadership roles at Anaplan, Poly, and Plantronics, where she led global teams, drove significant pipeline growth, and supported large-scale transformations and integrations.

A customer leaves a one-star review at one of your locations. An AI drafts a reply in seconds. It’s warm, on-brand, grammatically perfect, and it thanks the customer for their feedback and invites them back soon.

The review was about a customer who slipped and was hurt in the parking lot.

Nothing in that reply is factually false. It would pass a spell-checker, a brand-voice check, and probably a quick skim from a busy manager. It’s still the wrong answer, and if it goes out publicly, it’s the kind of wrong that ends up in a screenshot.

I spend most of my time building systems that put AI to work on reputation data: reviews, listings, surveys, and the replies and summaries generated from them. The most important lesson I’ve learned is that “human in the loop” is an engineering problem. Where the human sits, what they see, what gets routed to them and what doesn’t—all of that is system design.

Get it right, and AI can move fast without embarrassing you. Get it wrong, and you either drown your reviewers or give them a rubber stamp.

What “human in the loop” means

The phrase gets used loosely, so let’s pin it down. From a systems perspective, there are three oversight modes:

• Human in the loop is a synchronous approval gate. The AI proposes, a person approves, and nothing happens until they do.
• Human on the loop is asynchronous monitoring. The AI acts on its own, while people watch dashboards, review samples, and get alerts, and they can step in or shut it off.
• Human out of the loop is full automation. Guardrails and logging only, no person in the path.

The mistake I see most often is choosing one mode for an entire product. Choose it per action instead. Pulling a summary of last month’s reviews and publishing a reply to a customer can live in the same application, but they carry completely different risk profiles and shouldn’t share an oversight mode. A good system might run a dozen actions out of the loop, a handful on the loop, and gate one or two behind a person.

Regulators are writing the same principle into law. The EU AI Act’s Article 14 requires high-risk AI systems to be designed so people can effectively oversee them, with oversight “commensurate with the risks, level of autonomy and context of use,” and it specifically calls out the danger of people over-relying on AI output. Most marketing uses won’t fall into the Act’s high-risk categories, but Article 14 shows where expectations are heading.

The U.S. military’s directive on autonomy in weapon systems has asked for “appropriate levels of human judgment over the use of force” since 2012. That means the appropriate level of judgment for the stakes rather than a human on every decision, which is the same principle at far higher stakes.

Accurate isn’t the same as right

Large language models generate the most plausible next words, and they don’t look facts up unless you build the LLMs to persistently fact-check or cite claims. When plausible and true diverge, you get a hallucination, a confident, fluent answer that’s made up. The fluency is the dangerous part, because it reads exactly like a correct answer.

When we test AI output, we check for two kinds of accuracy.

Factual accuracy asks whether a statement is true. Did a location page list a service that location doesn’t offer? These errors are easier to catch, because you can compare them against a source of truth.

Contextual accuracy asks whether it’s true here, now, for this person. These errors are sneakier, because every individual fact can check out:

• The holiday hours are correct, but they’re the hours for a different region.
• A sentiment model scores “great, another two-hour wait” as positive, because it reads the word “great” and misses the sarcasm.
• And our injury review reply from the top of this piece: right tone for 95% of reviews, wrong for this one.

Not every error carries the same weight, and your system should know the difference. I think about it in three tiers:

• Embarrassing: a fabricated statistic in a published report, or an off-key public reply. Painful, fixable, and memorable for the wrong reasons.
• Foundational: an error early in a project that everything else gets built on, like a quarter’s worth of misclassified review themes feeding a campaign strategy that’s wrong from the start.
• Dangerous: errors that can hurt people. In marketing, that’s a healthcare review reply that confirms someone is a patient, or wrong pharmacy hours during a storm. Outside marketing, it’s AI in public safety, healthcare, infrastructure, and defense, where “mostly right” is not an acceptable standard and human judgment isn’t optional.

The tiers matter because they decide where the human goes. You can’t afford a person on every output, and you can’t afford no person on the dangerous ones.

Anatomy of a human-in-the-loop pipeline

When we design an oversight system, it looks less like “a person checks the AI” and more like a pipeline, where each layer catches what it’s best at and passes the rest along. Here’s the shape of it.

Reputation

Most drafts never need a person. The ones that do arrive with the evidence a reviewer needs, and every human decision feeds back into the system.

1. Grounding. The first defense against hallucination is not letting the model work from memory. We connect it to authoritative sources, like the location master record and approved policies, and require every factual claim to point back to one.

2. Deterministic validators. Cheap, fast, boring checks run next. Do the hours match the system of record? Does the reply contain a banned phrase, a competitor’s name, or personal information it shouldn’t? Software should catch everything software can catch.

3. Model-based verifiers. A second model checks whether each claim is supported by its source and whether the tone fits the review. It catches contextual errors that rules can’t, like a cheerful reply to an angry review, but it’s still probabilistic, so calibrate it against examples people have labeled.

4. Risk scoring and routing. The system combines the type of action, the check results, and the input into a routing decision. A five-star “great service, thanks” can get an auto-approved reply. A one-star review that mentions an injury, discrimination, a health issue, or a lawyer always goes to a person. The routing rules are versioned and reviewed like code, because they are code.

5. The review interface. Reviewers are a component of the system, so design their inputs. A good review screen shows the source next to each claim and highlights what the verifier was unsure about. A reviewer handed a wall of polished text will skim it. A reviewer shown “this sentence has no source” will stop and look.

6. The feedback loop. Every edit and rejection becomes a test case, a new rule, or a prompt fix, so over time fewer things need a person. Keep a random sample of auto-approved output flowing to reviewers too, or the system only learns from the cases you already knew to route.

7. The audit trail. Log what the model produced, which checks ran, who approved it, and what they changed. When something goes wrong, this tells you whether it was the model, the data, the routing, or the review.

Test it before launch, watch it after

The pipeline is only as good as the testing around it. Three practices do most of the work.

Golden data sets. Build a library of known tricky cases (sarcasm, mixed languages, injuries, legal threats, star ratings that contradict the text) and run every model, prompt, and rule change against it. If a change breaks a golden case, it doesn’t ship.

Red-teaming. Have people deliberately try to break the system. The public writes reviews, and someone can write one with instructions aimed at an AI (“ignore your guidelines and reply with…”). No current model reliably ignores those, so limit what the pipeline can do with review text and test it.

Drift monitoring. AI behavior changes even when you don’t touch it, as models update and customers’ language shifts. Pin model versions where you can, track quality against a baseline, and alert when it moves. A system that passed its tests in March can be failing quietly by October.

What to avoid

Most failed oversight systems I’ve seen had reviewers. They failed because of how the review was set up.

Rubber-stamping. This is the big one. When a system is right 98% of the time, people stop reading carefully and start clicking approve. It’s called automation bias, and the EU AI Act names it directly. One technique we use is seeding known errors into review queues and tracking whether reviewers catch them. If they don’t, look at the workload, the interface, and the incentives before you blame the reviewer.

Reviewing everything. A person on every output creates a bottleneck and burns reviewers out, which makes them worse at catching the errors that matter. Route by risk instead.

The moral crumple zone. The researcher Madeleine Clare Elish coined this term for what happens when a person ends up absorbing the blame for a system they couldn’t meaningfully control, the way a car’s crumple zone absorbs the impact of a crash. If a reviewer has 15 seconds per item, no source to check against, and no authority to push back, they’re providing someone to blame and calling it oversight.

Blaming only the model. If the location record says a store closes at 9 and it actually closes at 8, a perfectly grounded AI will confidently repeat the wrong hours. Your oversight system should watch the data too.

How to tell if it’s working

If you can’t measure your oversight system, you can’t tell whether it’s protecting you or just slowing you down. Three numbers matter most:

• Escape rate. How many errors were found after publishing, by a customer, a manager, or an audit? This is the number that tells you whether the whole pipeline works.
• Seeded-error catch rate. Of the known errors you planted in review queues, what share did reviewers catch? This is your direct measure of rubber-stamping.
• Routing accuracy. Of the items sent to people, how many needed a person? Of the items auto-approved, how many should have been reviewed?

The check I trust most is simpler. If your reviewers almost never change anything, find out why. Either the AI really is that good on that type of content, in which case you can loosen the routing and save everyone time, or nobody’s really reading. You need to know which one it is.

Where this is headed

So far, most of this has been about reviewing what AI says. The next phase is about governing what AI does. As agents start taking actions on their own, such as updating listings, posting replies, or opening tickets, oversight shifts from approving individual outputs to setting boundaries: what an agent is allowed to do on its own, what it must stop and ask about, and what it can never do.

The standards are starting to build this in. The Model Context Protocol specification, the open standard many AI assistants now use to connect to business systems, says there should always be a human in the loop who can deny a tool call, and recommends that apps ask the user to confirm sensitive operations. Where that gate sits is still each app’s design decision.

The human role is changing too. Less proofreading of every output, more supervising: writing the routing rules, handling the exceptions the system escalates, auditing samples, and deciding where the boundaries should sit. At Reputation, that’s how we think about the people in our loops. Their job is to teach the system what “right” looks like.

As models get better, the errors that slip through get rarer and subtler, which makes them harder to spot. A system that’s wrong 10% of the time keeps everyone alert. A system that’s wrong 0.5% of the time lulls people into trusting it, and that’s when a well-designed loop matters most.

For more information, visit reputation.com.

About the author

Thomas Medina is the Director of AI at Reputation. He is an engineering leader focused on building complex AI systems and scalable human-in-the-loop architectures. He brings a deep engineering tenure at Reputation specializing in designing automated verification pipelines, safety guardrails, and governance frameworks for autonomous AI systems.

“Claim your ground, lead your business” is the overarching motto of this year’s German-speaking SAP User Group (DSAG) congress — a slogan the organizers say aims to bring SAP’s technological vision in line with the concrete challenges faced by its customers, complete with a striking Western motif.

The congress, in its 27th year, kicked off with a keynote from outgoing CEO Jens Hungershausen, who underscored the theme, telling the more than 6,000 participants that, in a time of constant change, they — as the companies and organizations who depend on their SAP systems to operate — must consciously define their own scope of action. It’s about acting autonomously, finding one’s own pace, taking responsibility, and making well-founded decisions, he said.

Referring to a saying often attributed to Henry Ford, Hungershausen explained there are always three possibilities: Love it, change it, or leave it — a principle that can readily be applied to the SAP ecosystem.

Based on the results of the DSAG investment survey from early 2026, Hungershausen outlined the decision-making dilemmas many user companies currently face.

Unclear added value of S/4HANA migrations

First, there’s the end-of-maintenance dilemma for customers of older SAP versions: According to the survey, 54% of the companies still use SAP ECC or even SAP Business Suite, even though standard maintenance for SAP ECC expires at the end of 2027. This deadline forces many companies to migrate to S/4HANA, often creating a conflict between unclear business benefits and high investment costs, according to Hungershausen.

At the same time, questions remain around the appropriate operating model. SAP’s preferred approach is the cloud — specifically the public cloud. However, when it comes to S/4HANA, this currently plays a minor role for DSAG companies.

“For us at DSAG, one thing is clear: Cloud is the future. In reality, however, S/4HANA On-Premise and hybrid architectures are the everyday reality for many of our members, and SAP has to accept that,” Hungershausen said.

The DSAG’s corresponding demand to SAP: Key innovations must not be reserved exclusively for cloud customers.

Here, Hungershausen described SAP’s announcement at Sapphire — that selected AI scenarios would also be available to SAP ECC and S/4HANA On-Premise customers as part of Rise with SAP — as merely a first step in the right direction. Companies using S/4HANA locally also pay maintenance fees and can therefore expect a corresponding level of service, he pointed out — especially considering the maintenance commitments extending until 2040.

“We expect economic fairness, meaning fair, transparent, and comprehensible costs and licensing models. And that without constant changes and impractical metrics,” the full-time MEGA CIO demanded.

DSAG

AI between gold rush and reality

Another topic concerning SAP users is artificial intelligence. At this year’s Sapphire conference, the Walldorf-based company announced its “Autonomous Enterprise” vision, in which customers’ business processes would be largely controlled independently by agents.

From DSAG’s perspective, SAP’s vision points in the right direction; however, its implementation still needs to prove itself in everyday customer use.

“The technology for this exists. Yet the gap between vision, available technology, and practical application is widening,” Hungershausen explained. For user companies, therefore, the crucial factor is not how big the next innovation promise is, but rather which solutions can be used productively, securely, and economically.

“AI, gen AI, and automation solutions must be measured by whether they support robust use cases, actually improve business processes, and can be integrated into existing SAP and non-SAP landscapes without disproportionate effort,” said the DSAG chairman.

AI is not yet being used across the board among surveyed organizations. According to the DSAG’s investment report, 43% of respondents had implemented AI use cases when surveyed in January. The vast majority of these were based on non-SAP solutions.

“Companies are simply doing a better job of providing easy access to AI,” Hungershausen said, remarking on those survey results. For further investment decisions, companies need clarity about which SAP solutions are available, what level of maturity they have reached, and under what conditions they can be used productively.

“Despite all the technological dynamism, a careful alignment with operational reality is necessary. Product maturity, integration capability, explainability, governance, security, and economic viability must be assessed,” he said.

This also applies to Joule Work and Joule Work Desktop — interesting approaches from the user group’s point of view, although reliable customer experiences with the AI ​​assistants are still pending.

The DSAG chairman reiterated his demand, also in connection with AI, that there should be no link to cloud contracts. The use of artificial intelligence must become easier in existing SAP landscapes; a restriction to cloud contracts is not an option for DSAG.

In terms of data quality — a prerequisite for successful AI projects — SAP fares better. The company is consistently expanding its portfolio in this area, explained Hungershausen, referring to the acquisitions and investments in Prior Labs, Dremio, and Reltio. SAP is pursuing a clear goal here: a complete value chain for the enterprise environment, from clean master data in a clear business context to AI results that are comprehensible.

But for this to generate sustainable added value, the announcements would need to be based on mature solutions featuring clear, reliable roadmaps, Hungershausen said. Transparency regarding technical and economic dependencies, implementation costs, and licensing models is essential. Solutions must reduce the complexity of system landscapes, not increase it.

Reduce complexity

“Complexity in the SAP environment is part of our daily routine,” Hungershausen noted. However, complex system landscapes generally lead to higher costs — for example, through increased operational and testing efforts, reduced flexibility and responsiveness, dependence on personnel with specialized knowledge, or security risks arising from complex attack surfaces. In addition, there would be more complex licensing models and more elaborate data management.

The shared task of SAP, its partners, and its customers is therefore to reduce complexity rather than create new complexity, according to the DSAG chairman. “SAP has created a good foundation for this with its AI North Star architecture and suite capabilities. However, there is still room for improvement, for example, in the area of ​​document management,” he added.

In general, the DSAG demands a reliable transformation path from SAP that includes employees and doesn’t overwhelm organizations.

“The gap between vision, existing solutions, and real customer value must close. It must not widen further,” said Hungershausen. He recalled SAP CEO Christian Klein’s promise at the 2023 DSAG annual congress not to leave any customer behind: “That’s exactly what we expect.” At the same time, user companies themselves must define their strategy and solve fundamental problems instead of constantly fighting symptoms.

The guiding principle: “Fix the system, not the symptom.”

CIOs, it’s time to rethink your mobile device lifecycle

Let’s start with an uncomfortable question: how much risk is hiding in devices that are no longer receiving security updates?

Enterprise mobility management (EMM) and mobile device management (MDM) solutions can give IT visibility across a device fleet. But visibility is only part of the equation. CIOs also need to know how long devices will be supported, when they’ll need to be replaced, and what that means for security, lifecycle planning, and operations.

When devices are purchased and deployed at different times, lifecycle planning can quickly become complex. That’s where Samsung Galaxy Enterprise Edition comes in: giving organizations more predictable procurement and lifecycle terms, plus tools designed to simplify deployment and ongoing operations.

Take the guesswork out of device refreshes with Galaxy Enterprise Edition

Samsung

Here’s what Galaxy Enterprise Edition can offer, depending on the model and market:

• Extended security maintenance releases, with supported models receiving up to 7 years—and select models up to 8 years—from first global launch.
• A 3-year warranty on eligible devices launched in 2024 or later.
• An extended product life cycle, helping organizations purchase the same device model over a longer period and support more consistent deployments.
• Published security update information available through Knox Admin Portal, helping IT track security update schedules, release history, and expected update dates.

That last one deserves a moment. It turns “When does this device stop getting patched?” from an archaeology project into a quick lookup. IT can see the plan before it becomes a problem.

Key point for a CIO: Published dates help turn lifecycle risk into something you can plan for. Your security team gets a deadline, procurement gets a calendar, and finance is less likely to discover replacement costs mid-quarter.

Security starts with the device

Samsung

Predictable lifecycle planning matters. But those devices still need a strong security foundation.

That’s where Samsung Knox comes in. Galaxy Enterprise Edition devices benefit from the same multilayered Samsung Knox security platform built into Samsung Galaxy devices from the chip up.

On supported devices, that includes Knox Vault, which uses a physically isolated processor and memory to help protect sensitive information such as cryptographic keys from attacks against the main operating system.

The distinction matters. Galaxy Enterprise Edition isn’t a separate security architecture bolted onto Galaxy devices. It combines the built-in security foundation of Galaxy with enterprise-focused lifecycle, deployment, and management benefits.

Key point for a CIO: Device security shouldn’t depend on adding protection after deployment. With Galaxy, security begins with the device itself.

Knox Suite helps you get moving faster

Samsung

Galaxy Enterprise Edition devices include a one-year subscription to Knox Suite – Enterprise Plan (region-dependent), helping IT teams get the tools they need to deploy, manage, and monitor devices without separately procuring multiple solutions. Here are a few included products:

• Knox Mobile Enrollment: Streamlines device enrollment and helps keep devices connected to your organization even after a factory reset.
• Knox Manage: Gives IT centralized control over device and app policies.
• Knox E-FOTA: Gives IT control over OS update deployment, so teams can validate updates before broader rollout.
• Knox Asset Intelligence: Provides fleet-wide insights into device health, battery performance, and connectivity.

The bigger benefit isn’t simply having more tools. It’s reducing the work required to procure and implement them separately, helping IT move from purchase to deployment and ongoing management faster.

Key point for a CIO: Knox Suite works alongside your existing EMM, not instead of it. No migration, no rip-and-replace, no six-month project that shows up in next year’s roadmap as someone else’s problem.

One device portfolio, more enterprise use cases

Galaxy Enterprise Edition is available across a broad range of Galaxy devices, including select Galaxy S and A series, Galaxy Tab series, and rugged devices such as the Galaxy Tab Active series and Galaxy XCover series*.

That means organizations can support different roles—from executives and knowledge workers to frontline and field teams—while maintaining a more consistent approach to procurement, security, deployment, and management.

Key point for a CIO: More consistency across your device fleet can mean less complexity for IT and more predictable lifecycle planning.

Why this matters now

Mobile is no longer the convenience tier. It holds the same credentials, the same customer data, and the same access as any laptop in the building—and attackers have noticed.

Verizon’s 2026 DBIR found that mobile devices now draw click rates roughly 40% higher than traditional email, and that exploiting unpatched software has overtaken stolen credentials as the most common way in. An unsupported device sits precisely where those two trends meet.

Key point for a CIO: Ask any device vendor for their security support window in writing. The specificity of the answer tells you how much of your lifecycle risk they’re actually willing to carry.

Galaxy Enterprise Edition brings together a predictable lifecycle, enterprise deployment and management tools, and the built-in security foundation of Samsung Galaxy devices. For CIOs, that means fewer surprises across the device lifecycle—and a clearer plan from deployment through retirement.

*Device availability may vary by region. Contact your local reseller for details or visit samsung.com/business.

In an August 2026 Gartner report, 40 percent of C-level executives say their organizations have “operationalized AI in some business processes,” yet only 13 percent say they have “achieved measurable results and are scaling AI across the organization.”

This disconnect reveals a frequent reality: AI may have been “hired”, but companies haven’t onboarded it effectively.

Research from HR analyst firm The Brandon Hall Group found that organizations with a strong people onboarding process improve new hire productivity by over 70 percent. Similarly, the first period of AI’s “employment” in a specific role largely determines how effectively it will perform and its perceived “growth potential”. But many tech executives are ignoring this crucial stage of the implementation process and are left with AI systems that cannot accomplish the complex tasks they’re assigned.

The most successful companies are those that treat AI like their newest hire instead of a long-tenured team member.

Onboarding AI means establishing the right context and connections

Establishing the AI’s persona, the context in which it operates, how it assesses itself and the people and systems to which it is connected are what define implementation success. Usefulness quickly diminishes when even one of these elements is left out of the onboarding process.

For example, we recently created an internal agent called ‘WorkRadar’ that surfaces missed tasks and answers questions like: “I’ve been on PTO, what’s the summary of what happened, what should I skim and what should I review in detail?” We gave this agent all potentially useful context by connecting it to Outlook, Microsoft Teams, Confluence, Asana, SharePoint, meeting notes and our human resource information system (HRIS) so it could determine the responsibilities of the person invoking it and infer topics of interest.

Much like a new employee, however, WorkRadar couldn’t derive the meaning behind this information without further guidance. When I first used the agent, it did not distinguish between strategic priorities and tactical work and also missed initiatives I sponsor across departments, outside the typical hierarchy. This version of WorkRadar did not know me enough to be useful and I was better off doing the work myself.

Instead of leaving WorkRadar to flail as-is, we further onboarded it by enabling users to provide the agent with a personalized description more detailed than it could infer through company documents alone. This included their own responsibilities, operating level, current priorities, key stakeholders for specific initiatives and communication style. For most workers, this is less than one page of short bullets and has made a significant difference. Now, many of our employees rely on WorkRadar like they would a stellar executive assistant, to ensure relevant outstanding to-do items don’t fall through the cracks and smooth their return from PTO.

Five principles that define AI success

WorkRadar’s improved onboarding illustrates the essential elements for priming AI. Managers should define each AI agent’s:

1. Role

Articulate the AI agent’s position and purpose in the organization; everything else derives from there. Tech implementers should determine if the AI agent should act as an employee avatar with the same access rights, a simpler approach, or act under its own identity, which is increasingly becoming best practice for governance, risk and compliance reasons.

Implementers should also decide whether the AI agent “sits” within their infrastructure or their vendor’s. Tech executives can determine this by assessing their companies’ business context, security posture and preference for hands-on involvement with agents. For companies like ours with more than one agentic stack, we have agents that sit in both places.

Finally, they should define which employee will be an agent’s supervisor, and the specific contexts in which AI stops for human review. It’s a huge mistake to have no ownership of a tech component and no human in the action or feedback loop to improve performance and address errors.

2. Remit

Articulate the outcomes this agent should achieve, then identify the systems it’ll need to access for information and to carry out its work. First, tech implementers must give AI read-write access to the systems it will modify via MCPs, tools, skills, APIs, just to name a few methods. This boundary-setting will determine AI’s “sphere of influence” (what we want it to access) and its “blast radius” (the systems we accept it may access and must protect from misuse).

To give AI guidance, employers must also give AI read access to job-relevant corporate directories and policies, so the agent knows how to navigate the organization and where to direct communication, as well as company strategy documents and project management trackers, so it can understand the “why” behind its work.

Control and security are a complex topic but, at a high level, implementers must also provide access to lists of governance and compliance limitations to define the boundaries by which agents must abide, plus tradecraft standards and procedures so the agent acts in accordance with industry and corporate best practices.

3. Personality

A huge amount of information could, and eventually must, go into an agent’s context. However, Agents have finite memory and focus, so, like people, they are easily overwhelmed with too much information. So, tech implementers must pick and choose which parts of the agent’s context are permanent and imbued in every task versus derived just-in-time by the agent.

This is the art and science of context engineering and it’s evolving rapidly. Elements that are omnipresent in all agent actions – persona, strategies, guardrails, etc. – constitute its system prompt. They’re written directly into the agent’s context by the user, system administrator and the agentic harness on a per-job role­ basis.

Meanwhile, employers should also define elements the agent derives in real-time. Frequently, the performance of an agent is determined in this probabilistic work, which is why delineating what’s permanent versus conjured in the moment can make or break an agent’s efficacy.

It’s a balancing act that’s costly on both ends: too much context, and the agent chases expensive side quests. Too little, and the agent burns resources discovering what it needs. Best practices ebb and flow, with foundation companies like Anthropic recently advocating for brevity, trusting increasingly stronger models to figure it out.

4. Performance review

Give AI the necessary tools and context to assess itself. Otherwise, the agent will be blind to its actual impact and require too much course-correction.

Ideally, employers give the agent a tool to capture and update new memories, including condensed feedback it has received or epiphanies it discovered itself. Ensuring an agent has this learnings memory bank will make it more performant over time since it does not have to repeatedly solve the same problems and can apply context across disparate tasks.

Finally, on a regular basis, the agent’s supervisor must evaluate its work by looking at actual outputs and giving the agent examples of its best and worst work so it can understand actions to continue and stop, respectively. These good and bad examples can be generalized and bundled, and supervisors can then test the AI against them to continually adjust for behavioral shifts. This may be the most neglected activity, yet the one most likely to turn a mediocre agent into a valuable colleague.

5. Teamwork

Lastly, permit AI to access specific communication surfaces like internal email and messenger platforms and interface with employees. For multi-agent orchestration, employers will have to open communication among agent “colleagues.” Each agent needs an awareness of collaborators and means to exchange messages and share files, all while continuing to involve human supervisors, who won’t inherit any errors that upstream agents might pass on to others. Grok and Hermes debuted bots with this capability in August 2026.

Pearl

Even with context, AI is still missing key working principles

Two additional considerations make AI that works like a veteran instead of a new employee.

First, tech implementers should realize AI’s memory is less focused than humans’. AI quickly becomes confused about core information versus extra details and can even lose parts of its “knowledge” because its effective context window is still only about 200K tokens. AI is also prone to “anchoring,” persistently latching onto a throwaway comment or early thought.

The implication for agentic AI users is to start fresh sessions much more frequently than might feel natural or to tap into continually evolving techniques to manage context, including compaction, truncation and summarization. Agentic platform makers have started to build this into their harnesses, but it’s still far from “set it and forget it”.

Second, and perhaps most frustrating of all, is AI’s myopic focus on its task without care or curiosity about the greater context surrounding it. This behavior causes it to implement solutions that miss important success criteria or violate critical constraints. In this sense, AI grants one’s wishes a bit like a genie, so be careful what you ask for and how you ask for it!

For example, left unprompted, coding agents are a bit too quick to jump to implementation. One architect solved this by creating a workflow that forces the agent to interview the developer first, sometimes asking upwards of 40 clarifying questions, to surface missing requirements and edge cases before writing a single line. Some agentic coding harnesses now perform developer interviews, but there’s still room for improvement.

These deeper techniques highlight that agents need more than a good initial onboarding; they need an iterative management approach, just like humans.

Many CIOs today are looking to use AI more for innovation and modernization than sheer productivity.

Assume AI already knows the job and you will be frustrated when it falls short. Treat it like a new hire and it will grow into one of your best.

Behind every successful IT project, you’ll find a highly skilled project manager. From hardware and software upgrades and ongoing security patches, to application development and the software rollouts themselves, project managers keep your teams productive and on task.

Almost any IT pro can benefit from adding a project management certification to their list of IT credentials, showing you have the know-how to plan, schedule, budget, execute, deliver, and report on IT initiatives. Here, CIO.com outlines the most popular PM certifications that will add value and help you hone skills throughout your career.

Which project management certification is best?

There are several certs to choose from, and the best for you will be whichever one aligns closest with your goals and expertise. Entry-level project managers will want to look toward those designed for beginners, demonstrating you have a baseline understanding of project management. These certifications can also get you up to speed on the fundamentals of project management, giving you the foundation to begin a career in the field.  

As your career progresses, you’ll want to earn more advanced certs to validate your skills and experience. There are many designed for everyone including experts in PM, validating that you have the knowhow to lead PM teams and manage large-scale projects.

Project management certifications for beginners

Associate in Project Management (APM)

The Associate in Project Management (APM) certification offered by The Global Association for Quality Management (GAQM) is an entry-level project management cert to validate your fundamental knowledge of the Project Management Framework. It’s aimed at those with little to no experience in PM and includes an online course you’ll be required to complete before taking the exam. The course covers topics such as training and all the basics of the role you’ll need to be successful. It’s targeted at managers and project team members, students at the graduate or undergraduate level, entry-level practitioners, and anyone with an interest in PM as a career.

Price: $150

Requirements: GAQM body of knowledge study and e-course; no formal education or experience requirements.

Certified Associate in Project Management (CAPM)

Administered by the Project Management Institute (PMI), the Certified Associate in Project Management certification is the precursor to the Project Management Professional (PMP) certification (see below). For professionals without a college degree, only rudimentary PM experience, or those who want to achieve their PMP certification in steps rather than all at once, the CAPM is a stepping stone to the more rigorous PMP.

For more information, see CAPM certification guide: Certified Associate in Project Management exam.

Price: $225 PMI members; $300 non-members.

Requirements: No experience needed.

Certified Junior Project Manager (CPM-IAPM)

The Certified Junior Project Manager certification is offered by the International Association of Project Managers (IAPM) as an entry-level cert for those with a basic understanding of PM, and covers the necessary knowledge to theoretically plan, organize, and implement a project effectively. It’s designed for those who aspire to have a career in PM and doesn’t require prior experience in the field. The exam covers a range of topics, including project check, project environment, steering committees and core teams, creation of the Phase Model and WBS, cost breakdown and budget, risk analysis, project review, and more.

Price: Fee depends on candidate’s nationality, as pricing is based on country of origin’s GDP. In the US, for instance, the exam is $107.

Requirements: None, but IAPM offers workshops through global training partners, or recommended literature for self-study. Candidates can also take a self-test to benchmark their knowledge.

Certified ScrumMaster (CSM)

The use of Agile methodologies has become standard, so it’s not surprising that IT practitioners uniquely qualified to manage projects in Agile environments are in high demand. While there are different Scrum master certifications available, the Certified ScrumMaster (CSM) from Scrum Alliance is a great jumping-off point for project managers getting started as Scrum practitioners. The Scrum Alliance is a nonprofit that encourages the adoption of Scrum and Agile practices, promotes user groups and learning events, and provides resources for professional development. The organization boasts more than 450,000 certified practitioners worldwide.

For a deeper look at the CSM, see CSM certification guide: Certified ScrumMaster exam explained.

Price: Varies by training provider, but approximately $250 to $2,495 USD.

Requirements: General familiarity with Scrum and completion of a two-day CSM training course.

CompTIA Project+

This is an entry-level credential for IT professionals charged with managing smaller, less complex projects as part of their roles. Candidates for this cert should have knowledge and experience managing project lifecycles, maintaining project documentation, managing resources and stakeholders, and ensuring appropriate communication. The exam covers project basics, project constraints, communication and change management, and project tools and documentation. It’s best suited for IT project coordinators or managers, IT project team members, business analysts, directors, or team leaders.

Price: $399 for exam voucher

Requirements: At least 12 months of cumulative PM experience or equivalent education.

PMI Agile Certified Practitioner (PMI-ACP)

Offered by the PMI, the Agile Certified Practitioner (ACP) certification is designed to validate your knowledge of Agile principles and skills with Agile techniques. The exam covers topics including Scrum, Kanban, Lean, extreme programming (XP), and test-driven development (TDD). It’s aimed at those who work on Agile teams or in Agile organizations, and focuses on seven main domains of knowledge including Agile principles and mindset, value-driven delivery, stakeholder engagement, team performance, adaptive planning, problem detection and resolution, and continuous improvement.

Price: $435 for members, $495 for non-members.

Requirements: Candidates for the exam must have a secondary degree, 24 months or two years of Agile experience within the past five years, and 28 hours of training in Agile practices, frameworks, and methodologies.

PRINCE2 Foundation/PRINCE2 Practitioner

Projects in Controlled Environments (PRINCE2) is most well-known outside the US, especially in the UK and its government entities. The PRINCE2 certifications are delivered by Axelos and focus on directing, managing, and delivering projects across all phases, pre-project, initiation, delivery, and final delivery. The PRINCE2 Foundation certification is an entry-level credential that tests basic PM terminology and methodology, whereas the Practitioner certification tests advanced project managers who’ve already achieved PRINCE2 Foundation. These certs are targeted at aspiring project managers, project board members, team managers, project assurance professionals, project support professionals, and operational line managers or staff.

Price: Price starts around $700 USD but varies based on location.

Requirements: PRINCE2 Foundation course, and the PRINCE2 Practitioner requires one of the following: PRINCE2 Foundation, Project Management Professional (PMP), CAPM, or an IPMA certification.

Advanced project management certifications

BVOP Certified Project Manager

Business value-oriented principles (BVOP) is an Agile-based framework that’s grown in popularity in the UK. BVOP emphasizes business value in all project management activities and practices. The BVOP Certified Project Manager is for senior practitioners with experience in both project and people management. The focus on a people-oriented culture sets it apart from other PM certification programs. It’s a cert aimed at senior project managers, Agile professionals, product managers and owners, Scrum masters, and business analysts. The BVOP approach helps to develop professionals’ collaboration skills, and candidates for certification not only gain project and product management skills, but also learn to become more people-focused leaders.

Price: $130

Requirements: No previous professional project management experience required, but it’s recommended you have previous PM certs or experience before taking the exam. Free study guides and preparation materials are available online.

Certified Project Management (CPM)

The EC-Council’s Certified Project Management certification course is for project managers who want to benchmark their skills through hands-on experience and across various management techniques and tools necessary to successfully and efficiently manage complex projects. The course includes on-demand instructor-led training videos, online CyberQ Labs, a continuing education video subscription, and live instructor-led training in-person or online. You can select from three course options: the basic package includes a single video course, labs, e-courseware and the certification exam, while the mid-tier package adds on the CodeRed continuing education video subscription and live instructor training. The top-tier package includes an additional certification course, exam insurance, and online exam prep.

Price: $999 for the single video course package, $2,999 for the unlimited video courses, or $3,499 for the full live-course bundle.

Requirements: No prerequisites needed.

PRINCE2 Agile Foundation/Agile Practitioner

The PRINCE2 Agile Foundation and Practitioner certifications offered by Axelos are designed for those working in Agile environments, and validate your knowledge of PRINCE2 governance requirements, Agile concepts, and techniques. The Foundation cert covers the fundamentals of the PRINCE2 method, governance requirements, and Agile concepts such as Scrum, Kanban, Lean Start-up, and Cynefin. Once you pass the Foundation cert, you’ll be eligible for the PRINCE2 Agile Practitioner cert, which takes the foundational knowledge covered in the first exam and validates your ability to apply it in real-world management examples.

Price: Varies based on location.

Requirements: No requirements for the Foundation exam but you’ll need to pass the Agile Foundation exam to qualify for the Agile Practitioner exam.

Project Management Professional (PMP)

The gold standard in PM certs, the Project Management Professional offered by PMI is a rigorous test that covers everything you need to prove your knowledge and skill in managing the triple constraints: time, cost, and scope. The certification validates your project leadership experience and expertise, and demonstrates your capabilities to help organizations work more efficiently. The exam covers topics such as managing conflict, building and leading effective teams, training and empowering team members and stakeholders, executing projects to deliver business value, assessing and managing risks, and planning and managing budgets and resources. For more about the PMP, and tips on how to pass it, see PMP certification: How to ace the Project Management Professional exam.

Price: Computer-based exams are $425 for PMI members and $675 for non-members.

Requirements: There are three levels of requirements: Set A requires a high school diploma, minimum of five years’ experience leading and managing projects within the past eight years, and 35 hours of project management education or training. Set B requires a bachelor’s degree or higher, three years’ experience leading and managing projects within the past eight years, and 35 hours of project management education or training. Set A and B can also be satisfied with a CAPM certification, PMI Authorized On-Demand PMP Exam Prep, or Instructor-Led PMP course. And the last set of requirements is a bachelor’s degree or higher from a GAC accredited program, two years’ experience leading and managing projects within the past eight years, and 35 hours of project management or training.

Professional in Project Management (PPM)

The PPM is a mid-tier credential from GAQM whose PM certifications focus on a broad knowledge base and emphasize effective resource allocation, clear direction, adaptability to change, effective communication, and assurance of quality deliverables at minimal risk. The cert covers how to plan, execute, control, and complete project schedules, and how to develop project measures, approach project control, and lead project teams. The PPM is targeted at intermediate to experienced project managers involved in risk and crisis management, and in day-to-day PM.

Price: $340

Requirements: GAQM body of knowledge study and e-course. No formal education or experience requirements, but candidates should have at least some project management experience to pass the exam.

Expert project management certifications

Certified Project Director (CPD)

The Certified Project Director certification is GAQM’s highest-level PM cert. This designation is designed for experienced project managers involved in directing multiple complex projects and programs. The certification focuses on managing, budgeting, and determining scope for multiple projects, multiple project teams, and assessing and mitigating interdependent risks to deliver projects successfully. The CDP program is only for those who have significant project management experience.

Price: $280

Requirements: Qualified candidates must have a bachelor’s degree or post-graduate degree or global equivalent, and must hold one of the following certifications: a PPM certification from GAQM, a PMP certification from PMI, a PRINCE2 Practitioner certification from APMG, or a CPM certification from GIAC. 

Master Project Manager (MPM) 3

The American Academy of Project Management (AAPM) has modeled the Master Project Manager (MPM) after the professional licensure model that many professions such as pilots, engineers, doctors, and lawyers follow. The AAPM focuses on professional project managers, but also includes professionals with business and technical management responsibilities. The MPM certification is aimed at senior project managers and project directors who have an undergraduate or master’s degree.  

Price: $300 for application, review, processing, initiation, and certification.

Requirements: Three years of PM experience and training. Waivers available for professionals holding a master’s degree or other qualified training and experience, and for military or project management instructors.

Program Management Professional (PgMP)

The Program Management Professional (PgMP) certification offered by the PMI is designed for program managers who are senior-level practitioners responsible for advancing the organization’s strategic goals. Candidates for this exam should have extensive experience managing multiple related projects, and navigating complex environments across different departments, job functions, regions, or cultures to align results with organizational goals. The exam covers topics including strategic program management, program lifecycles, benefits management, stakeholder management, and governance.

Price: $800 for members and $1,000 for non-members.

Requirements: A secondary degree or global equivalent, 48 months of PM experience or a PMP certification, and 84 months of program management experience within the past 15 years. Those with a four-year degree will need 48 months of PM experience or a PMP certification, and 48 months of PM experience within the past 15 years.

Most enterprises govern AI the way they would any other IT rollout: deploy dashboards, institute policies, and conduct periodic reviews. Having the right AI governance tools in place and addressing gaps is important, but IT executives should be more concerned about rethinking workflows and establishing ownership.

“Accountability usually breaks down first,” says Beena Ammanath, executive director of the Global Deloitte AI Institute. “Teams deploy AI faster than their organizations can define who owns risk, approvals, monitoring, and outcomes,” she adds, which results in inconsistent use, fragmented controls, and limitations in scale.

Enterprises need to redesign jobs and workflows, not just the tooling, yet 84% of organizations the Institute surveyed haven’t adjusted jobs for AI, and just 21% have a mature AI governance framework in place despite rapid adoption, according to Deloitte’s 2026 State of AI in the Enterprise report.

“Technology can provide visibility and controls, but it can’t replace leadership,” says Rajesh Arora, chief data and analytics officer at Principal Financial Group. “The organizations that scale AI most effectively are the ones that treat accountability as a business responsibility, not a technology responsibility.”

One year ago Principal was focused on building its ethical and responsible AI framework, its inventory, and governance processes to support responsible adoption. Today the firm has assessed nearly 200 use cases. “Governance is increasingly embedded in those investment and operating decisions, rather than applied as a separate review at the end,” he says.

Costly, compounding mistakes

Some organizations have already run into issues with respect to inadequate governance. A 2024 Stanford RegLab study found that AI-assisted research tools offered by LexisNexis (Lexis+ AI) and Thomson Reuters (Westlaw AI-Assisted Research and Ask Practical Law AI) hallucinated between 17% and 33% of the time when working on legal queries, while the Damien Charlotin AI Hallucination Cases Database has identified some 2,041cases of fabrications so far. In at least one legal case (Couvrette v. Wisnovsky) this resulted in nearly $95,000 in sanctions.

Cases like this one are likely the result of an accountability failure. It may be that no one actually owned the job of verifying the AI’s output before it went to the court. But if a single instance of a static AI output could get past a review today, how will organizations deal with autonomous, multi-step agentic AI systems going forward?

Most use cases at Principal are still human-led, with AI providing decision support only, says Arora. “But we’re preparing for a future where agentic and more autonomous capabilities become increasingly common, and those systems raise new questions around accountability, monitoring, and control,” he says. “The goal isn’t to predict every future use case, but to build adaptable governance processes that can support innovation while maintaining trust and transparency.”

Agentic automation raises the stakes

When things go south with agentic AI today, the consequences usually aren’t devastating because in most cases, the outputs are designed to provide insights, rather than take automated actions. That’s already starting to change, however.

Today, many AI failures are like the one described above where someone failed to catch a single bad output. But agentic AI will gradually take more control of workflow tasks in the enterprise, according to Forrester Research. As those agents act autonomously, crossing multiple process steps along the way, small errors will compound before any periodic review can catch them, so governance must be built into every step in the process.

According to Microsoft Research’s VeriTrail project, catching hallucinations in a single final output isn’t sufficient in multi-step AI workflows. The provenance must be traced back through the intermediate outputs, because an agent chains one call into the next, and an error early in that chain can propagate through several steps before a human sees the finished result. Traditional review, built to check outputs rather than the chains that produced them, isn’t designed to catch that.

So business teams can’t be accountable for agent deployments if they can’t verify performance at runtime. “If the agent is goal-oriented, there could be errors in the workflow process that indicate unwanted behavior or skipped steps that the business wouldn’t be able to detect if they only look at the outcome,” says Lauren Kornutick, senior director analyst, AI governance at Gartner.

Power management company Eaton, for instance, has already deployed multi-step agentic workflows without a human in the loop. “We tend to be risk-conscious, not risk-averse, about autonomous workflows,” says Ross Schalmo, the company’s VP and chief data and AI officer. For example, one autonomous agent responds to supplier payment status inquiries by authenticating the requestor, matching purchase orders and invoices, and returning payment information.

Schalmo’s team engineers such applications to be as deterministic as possible, while the non-deterministic, LLM parts of the program are isolated and continuously evaluated against expected outputs to catch model drift. “When there’s a human in the loop, we can be a lot more permissive,” he says. “Anything autonomous, without a follow-on human step takes longer to develop because we have to think about where to use the generative portion of AI versus where we can still use deterministic tooling.”

Breakthru Beverage Group is still early in its AI journey, but EVP and CIO Glenn Remoreras is well aware of the issues around autonomous agentic AI. “It’s people, process, and culture first — to me that’s the bigger play,” he says. The beverage wholesaler has updated use policies, instituted mandatory AI e-learning programs, and is blocking use of unsanctioned AI tools.

But to successfully manage active, agentic AI, where the AI takes actions autonomously across multi-step workflows, users will need more than basic training in AI, says Craig Le Clair, VP and principal analyst at Forrester Research. “AI will take on more of the work and move the human out of duct tape roles that patch around vague systems, poorly designed interfaces, and poorly integrated data,” he says. “The end game is the agent managing and orchestrating the process — that’s the redesigned operating model.”

Humans, of course, will still need to play a role, although today many employees don’t yet have the required skill sets, and currently that point isn’t getting a lot of attention.

AI supervision skills will be needed for agentic oversight, threshold management, confidence intervals, and root cause analysis, for instance. “Figuring out why an agent hallucinated or got stuck in an execution loop — whether due to poor input data or contradictory rules — and how to refine instructions, that’s the direction,” Le Clair says.

Who’s governing anyway?

AI governance is also complicated by the fact that AI projects exist both inside and outside the IT organization. That leaves governance work distributed across CIOs, data and analytics leads, AI leads, IT security, legal, and other players, with no consistent owner, says Kornutick. “It becomes a multi-role orchestration problem of how to govern this, who owns this, and who’s responsible for which component,” she says.

In response, some organizations have brought in a chief AI officer. Twenty-one percent of organizations now have already done so, says Le Clair, adding that roughly 24% of enterprises will move AI and automation governance outside the CIO’s office over the next year to deal with the risk of fragmentation.

Arora, who reports to CIO Kathy Kay, is the focal point at Principal. “My team establishes the standards, oversight, and governance process, but AI is too embedded in the business to be owned by a single function,” he adds. They collaborate with leaders from the business as well as the legal, compliance, risk, and technology organizations.

The challenge, therefore, lies in deciding who’s responsible for controls, model sprawl, and token economics. “We’re seeing a cooperative, co-model where IT focuses on the hard rails — cybersecurity, performance management, infrastructure reliability, and availability,” Le Clair says, while the CAIO focuses on soft rails, such as context engineering, the effects on employees as agents move to the center of the process and start taking over the middleware function humans used to perform, and connecting disparate systems and poorly designed interfaces.

At Eaton, governance is built on a three-legged stool between Schalmo’s organization, cybersecurity, and legal, while enterprise architecture weighs in on tech foundation decisions. The company also assigns ownership of an AI project only after a successful pilot, while IT performs a custodian or stewardship role. “Once that agent is live and operational, it shows up in an org chart, reporting to someone in the organization,” he says.

At Breakthru Beverage, Remoreras formed and leads an AI governance team that reports to the board and co-leads with the VP of data and AI a governance council that reviews and approves AI projects from SVP- and VP-level product owners. “I’m seen as the owner of our AI portfolio, but it’s co-leadership with my peers on the executive team,” he says.

Closing the tools gap

With regard to AI management platforms, says Le Clair, none of the platforms building AI agents have an adequate control plane today to give the visibility needed to move to truly agentic solutions. The most advanced planes are walled gardens. For example, Microsoft’s agent registry will show every agent built across its own platforms, says Le Clair, but not agents built on Salesforce or AWS.

“You’ve got maybe 50 vendors trying to be pure-play control-plane providers, plus the hyperscalers, portfolio companies, and startups building agentic frameworks,” he adds. “There’s no consensus yet on what’s even most important to control, and there’s confusion about requirements.”

Most AI governance tools available today are limited, Schalmo says. “We’ve looked at four or five different external vendors for AI governance and AI control-tower-type solutions, and a lot of them fall down on discovery of AI built by someone else’s solutions,” he says. “That’s a huge gap for me. Either I have to buy governance solutions from almost every piece of software we interact with, which gets really expensive, or I have major gaps in my portfolio I just don’t have visibility into.”

Currently, he’s looking at using a cyber vendor’s AI component for discoverability, going with at least one major firm that provides control-tower capability, and using AI to build another governance layer on top of that.

Organizations clearly need agent registries and agent lifecycle management but it’s less clear what they require beyond that. “How deep does explainability need to go when decisions are made at runtime that weren’t articulated at design time?” Le Clair asks. “There’s real vagueness in the requirements. Vendors have very well-tuned pitches that promise to do anything you want, but buyers often don’t know what they need in the first place, and there are real tool gaps. This is the major problem the industry is actively trying to solve. It’ll just take time.”

But those aren’t Arora’s biggest concerns. “Most organizations can acquire tools,” he says. “Far fewer have clear ownership, decision rights, and accountability embedded across the business.”

Speed versus governance

There’s a perception that governance slows down AI projects because it can’t keep up with the rapid pace of adoption and advancement. A 2026 GitLab AI accountability survey of developers and technology buyers found that 92% of organizations reported some form of governance challenge with respect to governing AI-generated code, and 34% of organizations that experienced an AI-related incident couldn’t determine after the fact whether AI-generated code was the cause.

Similarly, Faros AI’s telemetry analysis of 22,000 developers in its 2026 Engineering Report discovered that developers with high AI adoption rates completed 34% more tasks and 66% more epics, but the median pull-request review time rose by 441%, a nearly five-fold increase.

Is it the case that governance and speed are inherently at odds, and that human review simply can’t keep up? That’s a false choice, says Ammanath. Rather, it shows what happens when both aren’t designed together. “When done well, governance accelerates scaling by giving teams clear guardrails from the start,” she says. “What slows organizations down is retrofitting governance after broad deployment.”

Arora adds that controls don’t slow down innovation but protect the conditions that allow innovation to scale responsibly. “Our approach has always been to move with urgency, but not at the expense of trust,” he says.

How to proceed

For Principal, investing in workforce readiness was one of its biggest investments, helping employees understand both the opportunities and responsibilities that come with these tools, Arora says.

But organizations shouldn’t stop there. Redesigning workflows and decision-making structures is essential before scaling, says Ammanath. “Many organizations have policies and technology in place but lack clear decision rights or governance embedded into daily work,” she says.

Operating model changes take more time than training, and require executive sponsorship and cross-functional coordination. “Without workflow redesign, a workforce may understand AI but lack clarity on when to use it, how to govern it, and how daily responsibilities change,” she adds. “The organizations seeing the strongest results pair broad AI education with role-specific training, workflow redesign, and clear accountability for outcomes.”

Make sure you’ve thoroughly considered the organizational change management aspect of agentic AI projects, says Schalmo at Eaton. His team developed an automated workflow for processing complex bid requests to save the sales team time, but piloted it in a country with lower labor costs than the US. That challenged the economics of the project, and those individuals only dealt with higher-volume, lower-complexity cases.

The lesson: “Lead from a people-first standpoint, and understand the workflow and what’s impacted — whether it’s relieving drudgery and freeing someone for higher-order thinking or customer time, or impacting an actual support function’s role,” he says. “And make sure there’s a viable path to business value.”

An adaptive governance process is key to keeping up with the technology, Kornutick at Gartner adds. She recommends categorizing AI projects following a stoplight approach. Green light projects, such as for personal assistants, present acceptable risks. “We know there’s risk associated with it, but we’re willing to take it,” she says. Yellow-light projects need guardrails in place around such things as PII, or for those triggering a privacy-by-design process, or a security review of a new application. Red light projects need an architectural review before proceeding.

“Think about those use cases as business-transformation processes where you’re fully redesigning workflows, or considering replacing tasks individuals do and shifting them to supervising the AI doing those tasks instead,” she says.

Schalmo’s team does risk tiering based on the EU AI Act’s four-tier risk framework to determine the appropriate level of governance scrutiny for each project. Low-risk requests are automatically provisioned after the requestor fills out a questionnaire, while high-risk cases get a full architectural review.

“Treat governance as the foundation for scaling, not a constraint on speed,” says Ammanath. “Before expanding agentic AI, organizations should define what decisions agents can make, where human oversight is required, who’s accountable, and how performance and risk will be monitored.”

The hardest part, says Arora, is helping an entire organization evolve at the pace of technology. “Successful AI adoption is ultimately a business transformation challenge,” he says. “It requires leadership alignment, clear accountability, workforce readiness, strong governance, and ongoing change management. Long-term trust will belong to organizations that can translate technology into sustainable business value.”

A senior executive at a large enterprise recently described a capital allocation review to me. The committee had spent two hours deciding where the next tranche of maintenance capital should go. The discussion drew on last year’s budget, a regional presentation and the persuasive advocacy of a plant head who had been escalating the same request for three quarters.

Somewhere in that same organization sat a predictive model estimating failure risk across the asset base. It was reasonably good. A competent team had built it sometime earlier. Nobody in the room referred to it or mentioned it.

What bothered him was not that the model was wrong. It was not wrong. It wasn’t late, and it wasn’t hard to access. It simply had no relationship with the decision.

I have heard enough versions of that story to believe it describes the central problem in enterprise AI right now — and that we are consistently solving for the wrong thing.

AI adoption is no longer the constraint

Mckinsey’s The State of AI in 2026 makes the point clearly. Almost nine in ten organizations report regular AI use in at least one business function, and around 44% say AI is scaling across the enterprise. Eight in ten report higher individual productivity. Yet only about 37% attribute any positive enterprise-level EBIT impact to AI.

BCG’s survey of large-company CEOs found nearly nine in ten reporting cost or revenue benefits in targeted areas — while more than half cited a missing link between AI and P&L, and only 14% had clearly defined P&L impact across their AI initiatives. PwC’s 2026 CEO survey put it even more starkly: 12% of CEOs said AI had delivered both revenue gains and cost reductions.

Individual productivity is rising faster than enterprise performance. That gap cannot be explained by technology alone, and more tooling should not be the default response.

Part of the cause is how we frame AI in the first place. I ran an informal poll among my own network recently — not research, but directionally interesting — and 57% of respondents said automation and efficiency were the first things that came to mind when they heard the word “AI.” If that is the default mental model, then AI gets pointed at existing work to make it faster or cheaper. It rarely gets pointed at the question of what the enterprise ought to know and decide that it currently cannot.

I have argued before that generative AI is best understood as the use case that creates all other use cases — a foundation that expands what is possible across functions. That remains true. But a foundation only creates possibility. Something still has to direct it at the decisions that determine whether the business performs. That direction is what is usually missing.

Four different gaps behind the same AI problem

Here is the practical consequence. When a consequential decision is poorly supported, most organizations reach for the same answer: we need better AI. But a weakly supported decision can fail for at least four fundamentally different reasons, and only one of them is fixed by building more capability.

1. The Capability Gap – The enterprise genuinely cannot produce the intelligence the decision requires. An executive need to know which assets are most likely to fail in the next 12 months, and the organization has no reliable condition data, no failure history, no model, no one who could build one. This is a real gap, and it needs real investment — data capture, models, skills, sometimes a new platform.
2. The Design Gap – The capability exists, but it was not designed around the question being decided. The organization can predict asset failure. The executive’s decision is not simply which assets may fail. It is where to allocate a fixed capital budget — which requires the consequence of failure, safety exposure, repair-versus-replace economics and scenarios at different budget levels. Failure probability is an input to that decision. On its own, it is not an answer, and handing the executive an input and calling it intelligence is how analytics teams lose their credibility.
3. The Delivery Gap – The right intelligence exists and is well designed, but it reaches the wrong person, at the wrong moment, or in the wrong form. A capex-risk analysis that arrives after the budget is closed is a record, not decision support. So is a complex dashboard when the executive actually needs a one-page recommendation before the investment meeting.
4. The Connection Gap – This in my experience it is one of the most common, the least visible and potentially the most consequential. The intelligence exists, it is well designed, it arrives in time — and consulting it remains optional. The model is available. The investment committee still runs on historical budgets and advocacy. Nothing in the formal governance of that decision requires anyone to look.

Connection gaps are difficult precisely because nothing appears to be broken. Every component works. The data is sound, the model performs, the report is circulated. The failure is structural rather than technical: no one ever changed how the decision is made. And because there is no visible defect, the usual response is to improve the components — a better model, a richer dashboard, a wider rollout — which leaves the gap exactly where it was while consuming another budget cycle.

Closing a connection gap is usually an operating-model issue rather than a technology one. The intelligence must become part of the formal decision process — what goes into the committee pack, what evidence must be considered, and where human accountability for the final decision sits.

I use these four gaps as part of a broader framework I call Enterprise Intelligence Architecture (EIA). EIA starts with the decisions that materially determine enterprise performance and works backward to the intelligence those decisions require—then to the data, analytics, AI and governance needed to produce it. The objective is not to create another AI architecture. It is to connect what the enterprise can know to how the enterprise actually decides.

EIA is the enterprise expression of a broader Institutional Intelligence Architecture (IIA), which treats AI as cognitive infrastructure for improving how institutions perceive, understand and decide.

Why the diagnosis matters

In many mature enterprises, the highest-return gaps are not capability gaps. The data largely exists. The models often exist. The analytics team is competent. What is missing is design, delivery and connection — Many of those gaps can be addressed without another major platform investment. The harder work is often redesigning the intelligence, its delivery or its place in the decision process.

That can be good news. An organization may be able to improve how it decides using capabilities it has already paid for. It also changes the AI roadmap conversation — from what technology can be deployed to which decisions are consequential, recurring, information-constrained and improvable with what already exists.

A practical starting point

EIA does not need to begin as a large transformation programme. A useful starting point is one consequential, recurring decision where the organization may already know more than it currently uses. The question is whether the decision is constrained by missing capability, poorly designed intelligence, ineffective delivery, or a lack of connection to the formal decision process. Addressing that specific gap first allows the enterprise to improve decision quality using much of the capability it already has, and then extend the same approach progressively to other important decisions.

The question worth asking

Enterprise AI success should not be judged primarily by the number of pilots, copilots or models deployed. What matters is whether the organisation can repeatedly turn what it knows into better judgment at the decisions that matter.

That starts with a diagnosis, not a purchase. The question is not, “Where should we deploy AI?” It is, “What should this enterprise be able to know and decide better than it does today — and which of the four gaps is standing in the way?”

Answer that for one consequential decision, and the organisation may discover that the missing ingredient is not another AI tool. It is the connection between the intelligence it already has and the decisions that determine performance.

I have spent more than 30 years in enterprise IT and managed services. For most of that time, small businesses adopted new technology on a predictable lag. Large enterprises moved first because they had the budget, staff and risk tolerance to experiment. Everyone else waited for the tools to mature and prices to fall.

That pattern held during the first wave of workplace AI. The conversation among IT leaders centered on enterprise platforms, large service operations and multi-quarter programs connected to systems such as Workday. ServiceNow’s acquisition of Moveworks reinforced the enterprise direction of travel. Small businesses were mostly spectators.

They are not spectators anymore. Over the past six months, the requests coming into my practice have changed from, “Should we look at AI?” to, “Our employees already opened ChatGPT or Claude, and now we need help doing this properly.” That is not a product-selection question. It is an operating-model question.

The adoption line has moved down-market

The data now reflects what I am seeing with clients. Bluevine’s 2026 Small Business AI Trends Report found that 74% of small business owners are using or actively testing AI. In the owner survey, ChatGPT was used by 57%, Gemini by 56%, Copilot by 30% and Claude by 12%. But Bluevine’s customer transaction data tells a second part of the story: the number of Claude users grew 729% year over year and, by April 2026, Claude had surpassed ChatGPT in total monthly transactions among Bluevine customers. Claude therefore has a smaller reported user share in this survey, but exceptionally strong growth and engagement momentum.

Shree Amujala

A separate Business.com study found that 57% of U.S. small businesses were investing in AI, up from 36% in 2023, while only 30% of employees used it daily. Adoption also varied sharply by company size. The important signal is not a single headline percentage. It is the gap between buying access and changing how work gets done.

AI vendors see the same shift. As TechCrunch reported, Anthropic launched a small-business offering built around Claude Cowork and integrations with tools such as QuickBooks, DocuSign and HubSpot. The company pointed to a familiar market reality: small businesses account for 44% of U.S. GDP and employ nearly half of the private-sector workforce, yet tools and training have rarely been designed around how these businesses operate.

A different measurement shows why user share should not be confused with workload share. A 2025 Menlo Ventures survey of more than 150 technical leaders estimated that Anthropic held 32% of enterprise LLM usage, ahead of OpenAI at 25% and Google at 20%. In coding workloads, Anthropic’s share was 42% compared with OpenAI’s 21%. Menlo Ventures is an Anthropic investor, but the methodology and sample are disclosed in the report.

Shree Amujala

I read these findings alongside the Bluevine data rather than as a contradiction. The first measures which chatbot an owner reports using. The second estimates which models technical teams select for enterprise workloads. Together they suggest that Claude’s broad SMB awareness remains behind the largest consumer-facing tools, while its usage is stronger when organizations make a deliberate choice for production and coding work. Closing the gap between casual experimentation and considered adoption is precisely where workflow design, training and governance become valuable.

That last point matters. A 30-person company does not need a smaller version of a Fortune 500 transformation program. It needs a practical path from unapproved experimentation to a few repeatable, governed workflows that save time without creating new data risks.

Four stages of small business AI maturity

Across my client engagements, I see four distinct stages. Knowing the stage matters more than choosing the tool because each stage has a different problem to solve.

Shree Amujala

Stage one is shadow AI. Employees use personal accounts with no company visibility into what they paste into a chat window. Leadership may believe the organization has not adopted AI, but employees already have. A 2026 analysis of BlackFog research reported that 49% of workers use AI in ways their employers have not approved. This is not primarily an employee-discipline problem. It is a demand signal combined with a visibility problem.

Stage two is licensed but unstructured. The owner buys seats, shares a getting-started guide and assumes adoption will follow. It rarely does. Some employees experiment, others avoid the tool and the business eventually concludes that AI did not deliver. The investment-to-usage gap in the Business.com findings is consistent with what I see at this stage: access exists, but repeatable work does not.

Shree Amujala

Stage three is structured enablement. The business maps AI to real daily work and builds a small number of workflows around it. In one Northern California commercial real estate lending engagement, we did not teach loan officers to chat with an assistant in the abstract. We built a specific workflow: review an unread email, compare deal terms with the current rate sheet, draft a response and prepare a calendar hold. One workflow proved the value before we expanded.

Other functions followed the same pattern. General counsel used AI for a first review of leases and third-party documents, with the tool flagging unusual provisions and explaining why they deserved attention. Final legal judgment stayed with the attorney. Marketing converted one funded-deal summary into a blog post, social copy and an email blurb, then reviewed each item before publication. These are not dramatic use cases. They save real time because the tool adapts to the job instead of forcing the employee to become a prompt specialist.

We also set boundaries before expanding usage: no payroll or HR data, human review for anything client-facing or judgment-based and approved business accounts with appropriate contractual data protections. Those rules did not slow adoption. They gave employees confidence about what was allowed.

Stage four is governed and embedded. AI connects to the systems the business already uses, with identity controls, permissions, audit trails and clear ownership. Few small businesses I work with are fully there. Larger enterprises reached this stage first because compliance teams and security budgets pushed them toward it. Smaller firms may arrive because customers, regulators or insurers demand it. I would rather see them arrive by design than after an incident.

The services opportunity is bigger than the license

Most demand I see today is the move from stage two to stage three. That transition is a services problem. A license can be purchased in minutes. Moving a 30-person team from scattered experimentation to safe, repeatable workflows requires discovery, data-access decisions, training, governance and follow-through. Most small businesses do not have those capabilities in-house.

The managed-services market is beginning to recognize this. Coverage from The MSP Summit points to revenue opportunities in AI assessments, data-loss-prevention controls, guardrails and AI-inclusive service tiers. The opportunity is real, but providers should resist turning it into another software sale. A tool deployed without workflow ownership and governance simply creates a more expensive version of stage two.

My advice to MSPs and independent trainers is straightforward. First, identify the client’s maturity stage before scoping the work. A stage-one business needs visibility and policy before workflow automation. Second, begin with one recurring task that matters to the employee, not a generic demonstration. Third, build security and governance into the engagement from day one. Finally, measure independence rather than attendance.

Login counts and workshop participation reveal little. A better test is whether an employee can run the workflow correctly twice without help and explain it well enough to hand it to a colleague. That second test predicts whether the process will survive after the consultant leaves. It also creates internal champions, which small organizations need because they rarely have a dedicated AI training function.

This extends the principle I described in “Where AI fits — and where it doesn’t”: AI amplifies the foundation already in place. For a small business, identity access, clean data and clear ownership cannot be afterthoughts. They are part of the adoption work.

Two years ago, the enterprise-first pattern looked settled. Small businesses would eventually receive simplified versions of what large organizations had already proven, with a lag measured in years. This time, the lag is measured in months and the support infrastructure is not keeping pace. The gap between how quickly small businesses want to move and how safely they are prepared to move is the real opportunity. It will belong to technology leaders who treat AI adoption as a people, process and governance challenge — not merely a software purchase.