Meta has hit pause on new terms of service for its business customers that would have granted it the right to grab any content from their websites. Not only that, but it would also have shifted the blame for every error produced through faulty AI to its customers.

The new terms of service were revealed on October 19 and initially due to take effect on October 30, though Meta later pushed the start date back to November 20.

But that small delay wasn’t enough to calm customer pushback, and now Meta has posted a note on Facebook’s business help center saying that the update had now been paused indefinitely.

Given the strength of feeling, Meta’s U-turn will not have come as a surprise. The terms would have been seen as far too onerous for customers, as well as exposing them to a legal minefield of the sort that UK regulators recently warned about.

In a statement to Harvard’s Nieman Lab, the company said that “We’re pausing the changes as we continue to engage with stakeholders and take our time to get this right.”

Meta has had a troubled time recently. Two weeks ago, it was fined for illegal use of customers’ data and in May, the company laid off 8,000 employees.

The true promise of agentic AI lies in agents maneuvering, making decisions, and taking actions autonomously throughout the enterprise, but few IT leaders appear ready to give bots widespread control.

According to a KPMG survey from July and August, 62% of IT leaders reported they were building, deploying, or developing AI agents, up from 53% in the previous quarter. But many IT leaders still say they are uncomfortable with the prospect of turning over internal processes to agents, with some exceptions for basic, low-risk functions like tier 1 IT support.

Jim Olsen, CTO of AI lifecycle management and governance vendor ModelOp, sees agent autonomy making inroads in limited circumstances — for example, to process customer refunds or credits without human intervention. But early lessons in the risks of full autonomy remain top of mind for IT leaders.

“We saw the large adoption of Clawdbot and OpenClaw by individuals where they would allow it full access to their email and gave it full autonomy,” he says. “For some people that worked out well, but it was a large risk exposure.”

For IT leaders deploying autonomous bots, Olsen recommends confining them to a strict sandbox with well-defined policies to limit their autonomy.

“I do not see allowing agents full and complete autonomy to do whatever they want being used in an enterprise in the near future,” he says. “But restricted autonomy is, in fact, already in use today.”

Activities that aren’t mission critical and don’t have access to sensitive information will be where IT leaders first grant agents full autonomy, Olsen predicts. “As trust improves, so will the breadth of use cases,” he adds.

Some IT leaders are concerned about “autonomy creep,” when agents quietly take more authority than they are given. And many AI and security experts warn that human-in-the-loop guardrails don’t always give employees the authority or time needed to fix agent errors.

Still, IT leaders have several methods for enforcing runtime policies and keeping agent behavior within acceptable goals, including API gateways, OS-level enforcement, and credential management, Olsen says.

“This means having clear policies in place and being able to tie them to the specific agent and use case,” he adds. “Some of these solutions are available now, but a more overall cohesive strategy is needed to bring about this minimal level of trust.”

Defining the sweet spot for autonomy

With about 2,000 agents deployed within her enterprise, Siroui Mushegian, CIO of cybersecurity vendor Barracuda Networks, still has human employees checking bot actions.

“We have many agents that are very close [to autonomous] — many of our ticketing automations are in the ‘trust-but-verify’ category with the agents that oversee them,” she says. “The more we see success, the greater comfort we have, but I am still not 100% certain I want to allow zero human accountability, especially when it comes to auditable processes.”

Mushegian expects autonomy to expand as agents demonstrate they can handle specific tasks reliably. “The consequences of a mistake should determine how much evidence you need before giving an agent more authority,” she says.

Autonomy will likely come to agents executing specific tasks within a function, she adds. Routine internal support requests are a reasonable candidate for autonomy when the answer is well documented, the action is limited, and a mistake is straightforward to correct, she suggests.

Less likely candidates for autonomy are agents that can change access permissions or make changes to a production system, Mushegian adds.

“Even within one workflow, an agent might complete some steps on its own and need approval for others,” she says. “I’d give it only the authority it needs for the task, with human approval for decisions where a mistake could have serious consequences.”

It’s about the action, not the agent

Joshua Rowe, co-founder and CTO of household bills app provider Taupia, agrees that IT leaders shouldn’t give agents complete freedom in every circumstance.

“I’d draw the line at the action rather than the agent,” he says. “The same agent can act alone on one step and need sign-off on the next.”

However, Rowe sees a lot of areas where agents can run near-autonomously right now, including read-heavy work such as gathering data, triage, drafting, and comparing options.

Taupia is testing agent functionality that compares energy deals and takes steps to allow customers to switch providers without its employees approving each step. However, the customer still would have to review the change and confirm it before it goes into effect.

For agents to get autonomous authority for irreversible actions, the timeframe doesn’t depend on AI models getting smarter, Rowe says.

“It depends on how quickly an organization can make each action reversible or bounded, with spending limits, cooling-off periods, rollback, and an audit trail good enough to undo a mistake,” he says. “Once an action has those, it can go autonomous. Where it can’t be undone, like signing a contract or moving money out of an account, I’d keep a person approving it for the foreseeable future.”

A question of deliberate design

Maciej Walaszczyk, CTO at AI customer service platform provider Text, points to customer service as an area where IT leaders have begun to cede control to agents.

“In customer service, which is my field of expertise, agents can indeed answer customer inquiries without the need for constant supervision, as they learn from knowledge provided by humans,” he says. “The scope of autonomy depends on permissions and the consequences of an action. Furthermore, the scope of these responses can be tailored to specific needs.”

But Walaszczyk says he would not hand entire departments over to agents. Instead, IT leaders should delegate specific processes where they can define the goal, set boundaries, and verify the outcomes, he recommends.

“An agent acting on my behalf cannot have more authority than I do,” he adds. “I don’t think it’s a question of being comfortable or even courageous, but of deliberately designing the environment, permissions, instructions, and oversight.”

Trust will come from real work and verified results, and humans must remain in the loop to check agent outcomes in many cases, Walaszczyk adds.

“Oversight must be real,” he says. “It takes time and attention, and it means much more than clicking approve. Saying ‘AI did it’ does not remove their responsibility. Irreversible actions or those with major consequences require human review.”

The digital twin concept earned its credibility in engineering. Its origins trace to a 2002 University of Michigan presentation in which Michael Grieves described a “Mirrored Spaces Model”: a virtual system holding the information about a physical one, linked to it throughout its life.

For example, a jet engine manufacturer builds a precise virtual replica of a physical turbine, feeds it real-time sensor data, and runs simulations that predict failure before it occurs, optimize maintenance intervals, and test design modifications without touching the physical asset. This model is invaluable because the cost of being wrong about a turbine is high, the variables are measurable, and the physics are well understood. Organizations have applied the same principle to factory floors, supply chains and urban infrastructure, each time with the same underlying logic: a dynamic model of a complex system allows continuous optimization that periodic review cannot match.

However, the enterprise itself has received only part of that treatment. Even Gartner now evaluates organizational digital twin platforms as a category, describing them as dynamic models of how an organization operationalizes its business model, deploys resources and delivers customer value. Yet most of these twins model how work flows, not what it is worth, and that gap is consequential.  

A dynamic model of the enterprise

Still, most large organizations still navigate strategic decisions with a picture of themselves that is static, incomplete and economically unattributed. Org charts describe reporting relationships as they were drawn at the last reorganization rather than how people actually interact. Process maps describe intended or designed workflows, not actual ones. And planning documents describe resource allocations as they existed at the time of the last budget cycle. None of these artifacts answer the question that matters most for strategic decision-making: what is the work actually worth, at the level of granularity required to improve it?

A living model of the enterprise changes what is possible. Imagine a representation of how work actually flows across functions (not as designed or conceived, but as executed), where decisions accumulate and slow, where handoffs lose information, where risk concentrates until it surfaces as an incident, and where resources are applied to activities whose economic contribution has never been examined. Connected to real-time operational data, that model moves leaders beyond the static artifacts that currently substitute for organizational self-knowledge.

But a model of how work flows is useful only for operational diagnosis, not a complete economic understanding. Strategic redesign requires knowing what the work measurably produces at the level of individual activities, decision points and handoffs.

Enriching the digital twin with economic process modeling

As I have discussed in previous pieces, Economic Process Modeling (EPM) provides that additional layer. By decomposing processes into their constituent components and attributing value across five dimensions (revenue contribution, cost and friction, risk exposure, option value and information value), EPM transforms a process map from a descriptive artifact into an economic instrument.

The output is not a flowchart but a value ledger: which components are value drags that cost more than they contribute, which are misaligned (a person doing a system’s job, or the reverse), and where value is created but never collected, usually as data the process discards. That is the side of the business case that cost accounting alone cannot show. It is the value layer the enterprise digital twin needs to support strategic decisions rather than merely operational ones.

Douglas Laney

Enterprise, know thyself

The practical benefits of an enterprise digital twin featuring EPM are compound:

• It enables businesses to model the P&L consequences of a restructuring before headcount decisions are made.
• It surfaces the process components where AI investments could generate the highest return per dollar–rather than requiring that prioritization to be resolved through stakeholder negotiation and executive sponsorship, which is how it is currently resolved in most organizations.
• It makes visible the information assets being generated and destroyed by current process designs.
• And it shows where risk is concentrating in operational workflows before that concentration produces a regulatory finding or a customer failure.

These are not incremental improvements to existing planning processes; they represent a different quality of organizational self-knowledge.

What makes this achievable rather than speculative is that the required inputs exist in most large organizations already. Process mining tools extract actual workflow patterns from system logs,  ERP and CRM systems hold the operational and customer data needed to attribute revenue and cost at component level, and risk systems hold the exposure data.

The missing element is the economic model that sits above the infrastructure, translates operational patterns into value attributions, and makes the enterprise legible as an economic system rather than a collection of functions.

Economic process modeling in action

CentrePort, is the port and logistics operator in Wellington, New Zealand. Its CentreConnect freight service generated a high volume of small inter-port charges, each reviewed and reconciled by hand by a small commercial team working from spreadsheets. Rather than automating first, the company modeled the invoicing workflow down to individual container movements, linked each activity to time and cost data, and tested standardization and automation scenarios before committing to change.

Processing time per invoice fell from 25 minutes to 23 seconds. But the more telling outcomes were those a throughput metric would miss: fewer financial discrepancies and less overpayment risk, stronger data governance than spreadsheets allowed, and groundwork for scaling volumes without adding staff. Those are risk, information and option value, not only cost.

CentrePort has since applied the approach to other commercial processes and now treats it as a precondition for change.  “Before undertaking any projects, we now ensure that the current state is understood, along with the upstream and downstream impacts of change,” said Tanya Dednam, Head of Digital.

The evolution from physical to enterprise digital twins

As many businesses and the global economy continue to shift toward digital, AI-based and services-oriented offerings, economically modeling the enterprise can become more important than modeling physical things.

However, the analogy to physical digital twins carries an important limitation: Turbine physics are stable whereas organizational economics are contested, context-dependent and subject to strategic choice. An enterprise digital twin built on EPM does not produce a single authoritative answer about what a process component is worth. It produces a structured basis for the argument, with explicit assumptions that can be examined, challenged and revised as conditions change, which is precisely what distinguishes a useful analytical framework from the static planning artifacts it replaces.

The competitive advantage this capability confers is not in the model itself. Rather, it is in the organizational discipline of making economic attribution a continuous practice, of treating the enterprise as an asset to be actively managed rather than a structure to be periodically reorganized when the last reorganization stops working. And rather than an enterprise-wide focus, the practical aperture is a single process with high economic exposure–ideally one already under transformation or AI investment pressure, modeled well enough to inform a real decision or action.

Organizations that model, measure and analyze the EPM-enhanced digital twin of their processes will be able to adapt, optimize and transform with significantly greater agility than those navigating with onerous org charts and planning PowerPoints.

AI fluency has long mattered to Sambit Dutta. When he joined global chemical manufacturer Hexion this year as SVP of AI transformation, his strategy included bringing “AI to the masses, where the people can not only just consume AI, but also become what we call builders.”

Dutta has made citizen AI a cornerstone of Hexion’s IT strategy because he believes that when the creativity and domain expertise of employees is centralized and funneled through a business analyst or developer, “there are always things lost in translation.” Further, “there’s a queuing process where that request ultimately gets queued, and then based on dollars and other priorities, never gets executed,” he adds.

Dutta also believes that innovation unleashed at the grassroots level is how enterprises achieve true transformation. And it facilitates change management because people become more receptive to absorbing technology at that level, he says.

“We firmly believe that we are at a stage where citizen development has finally taken off” at Hexion, Dutton says.

Citizen AI — a development strategy that has CIOs making AI tools available to employees outside IT to create their own solutions — is taking hold inside enterprises. It democratizes AI by enabling business users to solve problems and create efficiencies in their roles without the overhead of full IT-led development.

“Historically, turning a good idea into a technology solution required specialist skills, funding, and space on a development roadmap,” says Ankur Anand, group CIO at technology recruiter Harvey Nash. “AI lowers that barrier. People can explore an idea, create an agent or prototype, and establish whether it genuinely solves a business problem before the organization commits significant resources.”

But the objective isn’t to create hundreds of unofficial production systems, Anand adds. “It’s to create hundreds of experiments and make it much easier for good ideas to emerge from anywhere in the organization.”

Freedom first, governance to follow

Travel tech company eSky Group is one such company moving toward an AI-first model, “where using it is as natural as using email or a browser,” says Piotr Mynarski, technology director there.

“Employees creating their own agents is not a fringe behavior,” he says. “It is one of the clearest trends we see inside innovative companies today, and the most visible change in how our engineering works.”

At the end of 2025, eSky made AI a company objective, and by spring 2026, the company had agreements with several AI providers whose tools were opened up to everyone, not just to engineering staff.

eSky expects about 60% of its more than 650 employees worldwide outside the contact center to become fluent with AI. Regular use of AI is climbing toward 80%, Mynarski says, who notes that the company’s approach was a bit unusual: Company officials “barely capped budgets, let people use the tools for personal purposes, too, and gave everyone room to experiment rather than mandating a narrow toolset,” he says.

That approach deliberately gave employees freedom first, with governance to follow once leaders saw what they actually built.

“That order was a conscious bet and so far, the right one,” Mynarski says. “Today, we have over 30 agents across the company, almost every engineering team works with at least one, and several teams have more, with some already running in production.”

The agents were developed from a shared codebase built by eSky engineers, and they specialize in different needs: development of new products and features, maintenance, analytics, and monitoring business metrics.

“The rules are catching up rather than leading,” Mynarski notes. “Every agent has its own identity and credentials, guardrails and observability are standard, and responsibility for an agent sits with the team that runs it, not with a central AI department.”

AI reduces the barrier to entry — but still requires guardrails

Before joining Hexion, Dutta worked at Nestlé, where he implemented “a pretty robust program around digital fluency.” Parts of the program worked, but some didn’t, particularly where sophistication was required “in thinking, and a little bit of a technical depth.”

Some citizen development can be performed with drag-and-drop tools, but often written instructions are required, he notes. “A lot of people get really scared when you introduce those kinds of concepts to them.” That creates a barrier when employees want to leverage citizen development in areas such as data science, real-time automation, and Microsoft Power Apps, Dutta points out.

“Those are one type of automation that requires a little bit more sophistication,” he says. But that has changed. “The biggest unlock is now with prompt. You can avoid going into the developer tool altogether. … You can simply go in the prompt and describe what you want,and accordingly, the backend generates the application for it.”

As a result, Power Apps, which was more challenging for users to master and scale, no longer requires business users “to know the nuances about how to create a Power app.” Dutta says, unlocking a new level of productivity to a broader range of users.

At Hexion, employees use a centralized IT-owned platform to create agents. Business users have several tool options, “but those options are restricted to what we believe are enterprise-grade tools, and we have to secure it,” Dutta says.

For example, whereas everyone in the company can use Power App Vibe, only some employees have access to AI building platform Replit for coding.

Replit is “a little bit of a clamped-down application because we want to control what goes into production and how it connects with enterprise databases,” Dutta explains. “Replit can be dangerous because it if it is connected to SAP and other critical systems in a way that the users are doing something unusual with their app, it may bring down the system altogether.”

Users can, however, immediately connect the Replit applications they create to a data lake or other repositories, he adds. “It’s only when a transactional system gets impacted that we impose some condition.”

Unlocking business-user creativity

Hexion’s citizen AI strategy is unleashing creativity across the company, Dutta says. For example, the leader for environmental health and safety built an app she calls Wingman that can be used in the company’s factories to run health and safety processes. “We did some light editing on the core to make it a little bit enterprise standard,” and then it was deployed, Dutta says.

Given the divide between vibe-coded apps and production systems, governance remains an essential ingredient of any citizen AI development strategy. One of the AI governance tools Hexion uses is Microsoft Agent 365, which Dutta says lets IT see which agent is running and the various statuses of agents that employees deploy.

“We can start and stop anything we want across the enterprise,” he says. “It’s one single-pane governance layer.”

At eSky, employees are automating their daily work and building small applications for reporting and for automating specific business cases, Mynarski says. They also lean heavily on specialized agents that can take over parts of a job for them, he says.

In one instance, a performance marketing specialist built an agent that reads campaign data across eSky’s markets and is starting to generate ad content. The operations team runs a platform of 16 scheduled automations and small apps for controlling, reconciliation, and refunds, built by the people who used to do that work by hand, he says.

However, “this often becomes a problem the moment a personal tool needs to become a production system,” Mynarski says. “We have that covered with practices and guardrails that these teams can plug into, so the initiative stays with them and the hardening comes from us.”

At Harvey Nash, a content manager has created an agent that helps the company’s recruitment consultants find approved posts and assets, personalize it to their role, and post them to their social channels.

“This supports us with brand amplification and helping position them as market experts without requiring them to create new content,” Anand says. “We can measure the number of posts created, adding a gamification element to it to encourage usage.”

Coding isn’t the most important capability needed to become an AI citizen, he notes. “It’s understanding a problem well enough to describe it, knowing the context and data behind it, and having the judgment to recognize whether the result is useful.”

Overall, citizen AI is about dramatically increasing the number of experiments an organization can undertake, Anand says. “Give people the freedom and guardrails to turn ideas into proof points,” he says. “When an idea demonstrates real value, that’s when technology steps in to make it enterprise-ready and scale it. You get grassroots innovation without creating a technology Wild West.”

For CIOs considering launching a citizen AI strategy, Mynarski advises keeping costs in mind. “You have to ask, more than ever before, whether a given use brings value to the organization, because it is very easy to spin up AI that works beautifully and adds nothing,” he says.

Still, Mynarski believes the issue CIOs face is not employees doing too much with AI without permission. “The challenge is teams doing too little,” he says. “My advice to other CIOs: Talk about security in the same breath as innovation. If you let that gap grow, the freedom you gave people will be taken away from them later, and that is the expensive scenario.”

See also:

• How IT leaders can make vibe coding work at enterprise scale
• Your employees are building AI agents. Do you know what they’re doing?
• How to make sense of the agentic AI tools ecosystem
• What world-class IT looks like in the gen AI era
• How AI agents are shaping the future of work
• AI governance is fast becoming an unmanageable chore

The businesspeople adopting AI notetakers are not being reckless. They are responding to a real business need. Our teams are in meetings all day with companies we support, and the idea that we could read a clean summary of every one of them at the end of the day makes us better partners to our customers. At the AI-first startups we spend time with, a new account manager can walk in on day one, inherit the full recorded history of every customer conversation, and ask the AI what that customer actually cares about. That is not surveillance culture for its own sake. It’s a better way to serve people.

Still, AI notetakers present cyber risks, as we have been warning about for the past year: shadow adoption measured in hundreds of accounts in a matter of weeks, vendors without SOC 2 or real encryption, consent liability, litigation exposure. In April, one of us stood on stage at the [un]prompted conference and argued that the most important attendee in your meetings is no longer a person. AI notetakers decide what matters, assigning the action items and providing the summary that becomes the meeting’s official record.

But our early warnings about AI notetakers shared an assumption we no longer hold: that the notetaker joins the meeting. That assumption quietly died this summer, as the notetaker has left the meeting platform and moved onto the body — and policies haven’t noticed let alone caught up to this change yet.

From the meeting to the wrist

On July 28, Granola, the AI notetaker we see most often in our worlds, launched an Apple Watch app. One tap on the wrist and it records whatever happens around you. No bot joining the call, no banner announcing itself, no laptop open on the table.

The same week, DEF CON banned Meta-style smart glasses from the conference floor over recording concerns. Meta, meanwhile, had already acquired Limitless, the AI pendant company, folding always-on personal recording into the largest consumer hardware pipeline in the world. One public company we’ve worked with now screens attendees for smart glasses before all-hands meetings where unreleased plans are discussed.

We’ve tested this ourselves, putting the watch under a jacket sleeve, tapping once, and recording an entire evening walk. Clean transcript. Nobody could have known.

In the United States, recording someone without their permission depends on which state you are standing in. California says you can’t, but many states say you can. More importantly we still have no norms of disclosure, and the hardware is now designed to be invisible.

The record is not neutral

Since the April talk, we have met a steady stream of people telling us how they game these systems. One person described doing prompt injection against a notetaker in a live meeting, right as we walked offstage. Another explained the simplest trick we have heard: join early, and for the five minutes you are alone with the notetakers, calmly narrate the outcomes you want captured as the most important takeaways. A third said he figured out how to silently crash other companies’ notetakers, so the meeting ends and there is no record. There is academic research behind all this. Call it manipulation or call it strategic communication. The methods work.

Notetaking systems also fail on their own. We have watched a transcript mishear one word, then reinterpret the rest of the conversation to fit the error. Colleagues with accents the models handle poorly carry more of that risk than the rest of us. And these tools are no longer stenographers. They have memories. Granola pulls context from prior meetings and background on the people in the meeting into today’s meeting notes. That is useful, but it also means a summary shared outside your company could leak reasoning from meetings the other party was never in.

Then there is the case that should be on every policy writer’s mind. Last November, a Campbell’s security executive was terminated for what they said during a meeting secretly recorded by an employee during what he thought was a private lunch conversation. The recording surfaced months later through an employment lawyer, and the executive was gone within days. Whatever you think of what was said, notice the mechanism: no notetaker bot, no meeting platform. One person, one device, one conversation the speaker believed was off the record. There is no such thing anymore.

What a serious policy looks like

Boards and legal teams are now asking their CISOs for notetaker policies. Having helped several organizations think through this, here is where we land.

Transparency always. If a recording tool is running, everyone present knows. The lightest version we recommend: Change your display name to “Name + AI notetaker.” And the rule must bind employees, too. An employee who records a colleague without disclosure is committing a fireable offense, full stop, before we ever discuss what the recording contains.

Classify your meetings. At one firm, we wrote a formal policy naming which meetings may never be recorded. Yours might include M&A, legal, HR, and board executive sessions. Decide deliberately, in writing, before the tools decide for you.

Govern other people’s notetakers. When an auditor walks into your building, their laptop has to meet your standards. Apply the same principle to recording. If another organization records your employees, you should know, and you should get a copy.

Choose your retention posture. A full transcript is a different corporate record than a summary. Decide whether transcripts are destroyed by default, with legal holds as the exception, or kept forever. Do not let the vendor’s default decide.

Treat notetaker vendors like what they are: startups holding your most sensitive conversations in their cloud. Vendor security review, data-reuse terms, indemnification language. Brewer v. Otter.ai, a class action alleging Otter’s notetaker recorded meetings without everyone’s consent and used the recordings to train models, and the sudden shutdown of Novacy both happened for a reason.

Assign a human. Every transcript that becomes a record needs a named owner responsible for reviewing its accuracy, no matter whose tool recorded the call.

Remember that some may train employees to steer the transcript, the way a lawyer protects the record in a deposition. We understand the instinct, and reviewing the record for accuracy is exactly right. An organization that quietly optimizes its official records has bigger problems coming.

We used to debate whether to let the notetaker into the meeting. That debate is over, because the meeting is now everywhere the recorder goes. Write your policies for the world where the microphone is already in the room, because it is.

An executive IT dashboard can stay green for a year while the risks it is supposed to surface keep growing. Availability above target every month. Service levels met. Patch compliance climbing quarter over quarter. Every number accurate, and every one trusted by the executive team.

When trouble finally arrives, it skips amber entirely. It comes as an outage, an audit finding or a security incident, and the first question in the room is why the dashboard said everything was fine.

In my work with technology leaders and executive teams, I have learned that a dashboard can be technically accurate and still leave leadership dangerously misinformed. Usually nobody fudged anything. The numbers were built to summarize, and a summary is very good at hiding the one thing an executive most needs to see. Three metrics produce most of that false comfort at the executive level. I would not put any of them in front of a CEO or a board as a headline number.

Three green numbers I would take off the executive dashboard

Monthly availability is the classic. A 99.9 percent month still allows about 43 minutes of downtime, and the percentage says nothing about when those minutes fell. Forty minutes at 3 a.m. on a Sunday and forty minutes during month-end close produce the same number. So do one long outage and a dozen short ones that each forced the order desk to restart its work. CIO.com made a version of this case years ago, arguing that uptime means little until it is tied to business impact. Business leaders notice the gap. When the official figure does not match what their teams lived through, the dashboard loses the room, and nobody tells the CIO.

Service-level attainment is the second. A service desk can hit its resolution targets month after month while the same problems keep coming back. A recurring sync failure gets fixed in twenty minutes, closed inside the target and counted as a success. It happens again the following week and gets counted as another success. The metric rewards fast closure, so the organization gets very good at fast closure, and the underlying fault never draws enough attention to be fixed. What builds underneath is a growing list of known problems held together by workarounds. Each one is a small daily cost to the business and a much larger risk the day the person who knows the workaround leaves.

Patch compliance is the third, and the most dangerous, because it expresses security posture as a percentage of a device count. A fleet that is 96 percent patched sounds well defended. The question the percentage cannot answer is which 4 percent. The unpatched remainder is rarely random. It is the legacy system nobody is allowed to reboot, the vendor-managed appliance the team cannot touch, the server behind a process considered too important to risk. Those are often the assets an attacker would pick first. The headline number improves every quarter as the easy devices get patched, while the exposure that matters sits unchanged on an exceptions list nobody above the security team reads.

Why averages flatter the people who report them

Each of these metrics averages across a large population where the risk is concentrated in a small corner. The thousands of healthy devices, the hundreds of quiet hours and the routine tickets all pull the number toward green. The handful of things that could actually hurt the company barely move it.

Executive dashboards drift toward this kind of measure for understandable reasons. Percentages are stable, they trend nicely and they compare cleanly against a target. They also protect the team producing them, which is the part few people say out loud. A metric that is green almost every month spares everyone a hard conversation. Over a few years, without anyone deciding it, the dashboard selects for numbers that do exactly that. One question exposes it quickly: when did the executive dashboard last show a red month? If nobody can remember, or nobody can say what it would take to produce one, the dashboard has stopped measuring the organization and started reassuring it.

The cost lands when something breaks. A CIO who reported green for eleven straight months and then has to explain a major incident is answering two questions at once: what went wrong and why the reporting missed it. The second question is the one executives remember, and it colors how they read every report that follows. After that, a green month is no longer taken at face value.

I hold every executive metric to one test. If a number cannot embarrass me, it does not belong on the dashboard.

What I would put in front of executives instead

The replacements are less flattering and more useful. There are three I would choose.

1. Disruption minutes on the processes that matter. It starts with an agreement with business leaders, made in advance, on a short list of processes their teams cannot run without and the windows when those processes matter most: order entry during business hours, payroll in the days before a run, financial systems at close. Then the dashboard reports minutes of disruption to those processes during those windows, and every incident behind the number is listed by name. A quiet month looks quiet. A bad Tuesday during close shows up as exactly what it was, and the business leaders in the room recognize it because they lived it.
2. Repeat incidents. Of everything that broke this month, how much had broken before? I would trade every resolution rate on the dashboard for this one number. A low repeat rate means problems are being fixed at the root. A rising one means the organization is living on workarounds, and it shows up months before the workarounds start to fail in ways that customers notice.
3. The age of the worst exposure. For security, the measure I want to see is the oldest unremediated critical vulnerability on systems that face the internet or hold sensitive data, along with the number of standing exceptions and the name of the executive who approved each one. The age moves only when the hard cases get fixed, which is the point. An exception with an executive’s name on it is far more likely to get a decision: fix it or own the risk. An exception that belongs to nobody can sit indefinitely.

Each replacement shares three properties. Its red threshold is agreed before the reporting period begins, so nobody negotiates it after the fact. It points at a specific process or system, so a red result tells an executive where to look. And it is uncomfortable enough that the team would rather fix the underlying issue than explain the number again next month.

The old percentages still have a home. They stay on the operations team’s internal dashboards, where they help run the shop day to day and where a team lead can see a trend early. The executive view gets the measures that can turn red.

None of this requires new tooling. Most IT organizations already capture the incident history, the vulnerability data and the process calendar these measures depend on. What it requires is a decision about what the executive team is entitled to see, and the willingness to show a red month before something forces it.

The first report built this way will almost certainly show red somewhere, and that is the reason to build it. A red month is uncomfortable for a meeting or two. It also sharpens the questions, turns the conversation to the actual condition of the systems the company runs on and ends the CIO’s role as the person who said everything was fine. A dashboard that has been green for a year might be telling the truth. From the top, there is no way to know, and that is reason enough to change what goes on it.

MIT’s finding that 95% of enterprise AI pilots fail to show measurable profit has been quoted at length, and the conclusions drawn from it are always the same: the models aren’t good enough yet, or enterprises don’t know how to use them. I don’t think either holds up. The problem starts earlier, with whose definition of success you’re measuring against, and I’ll come back to what to do about that.

I looked at this in my book Transform!. Bain surveyed over a thousand companies and found that only 5% of digital transformations achieved or exceeded expectations. 75% settled for dilution of value and mediocre performance. 20% failed outright. That was before ChatGPT existed. So whether it’s B2B software or a large language model does not really matter – what seems to go wrong every time, regardless of the technology, is that organizations are deploying tools whose benchmarks were never aligned with their actual enterprise requirements.

In the digital transformation world, misalignment sometimes came from the supplier side: vendor objectives didn’t match client needs, partly because the vendor’s definition of success was follow-on work, which rarely served the client.

Now the misalignment comes from the AI labs, and this time it is not so much an incentive problem that a better contract can fix but a limitation that is built into the tool. OpenAI and Anthropic are building towards artificial general intelligence, where “general” is the operative word. They offer enormous reasoning horsepower, but the benchmarks used to assess their performance don’t accurately represent the inside of a real business. Their models are crystallized, frozen at the moment they’re trained. The cost to retrain an enormous model is, well, equally enormous. The model never learns your business as it works. It knows the public record of the world, but that does not include your enterprise: the deep domain knowledge that runs it, much of which never gets documented. It starts every task knowing only what you hand it. And most things a business actually cares about are very specific: a particular use case, a specific workflow, the number the CFO has to report at month-end. It’s why a model can top every benchmark out there and still deliver limited measurable value. What’s missing is the specificity, and no amount of extra horsepower makes much difference in this respect.

Every approach to fixing this – RAG, fine-tuning – has notable limitations.  What’s actually needed is a model that controls the context fed to the LLM and learns the organization as it operates. Until that exists, enterprises have to work with what they have.

The starting point is simple: if the labs’ definition of success is different from yours, how do you make sure your pilots don’t join the 95%? Here are three things I would do.

Write your own definition of success

Start with why. What do your board, your team and your leaders want from AI, and what role do you expect it to play? The answer influences what “good” looks like for your stakeholders. Furthermore, if you pick a project where the outcome cannot be measured, you cannot show value.

Then pick the right pilot. Not the hardest or the easiest, but the one that looks like something that you would eventually want to scale. If the workflow you want to automate has messy data, unwritten rules or needs three different sign-offs, put all those constraints into the pilot itself. That means confronting complexity early, because it is usually the hard stuff that derails programs, not the easy stuff. Doing the easy stuff first is probably why so many of these pilots are struggling: they prove something that didn’t matter in the first place.

Give the model the context it doesn’t have, and know the limit of that

The state of the art for closing the specificity gap is what has become known as a harness. You re-inject the relevant context into every prompt and put guardrails around each workflow. The discipline is called context engineering. It is a real step up from buying licenses and hoping for the best: getting the prompt right at the outset improves accuracy and cuts the tokens you use on your way to actual results.

But a harness is static; it doesn’t learn the enterprise. As conditions change, the harness or the context has to be amended by hand, which usually means a human in the loop monitoring inputs and outputs, even for relatively straightforward tasks. That undermines much of the value agentic AI is supposed to deliver.

So, a harness is a good place to start, but it only goes so far. GenAI is probabilistic: give a model the same prompt twice and it will not give you the same answer twice. Almost everything in your organization, by contrast, was built for humans, who at least try to behave deterministically. An incorrect output from a model is not a bug; it is a signal that the context needs modifying, ideally dynamically and automatically, until the machine gets it right. Therefore, you need a loop: context goes in, output comes out, you evaluate it against a framework you have set, and the context is refined before it goes back into the machine. That is what turns a static process into something that continually improves. Experimentation has to happen inside that loop, and stakeholders have to see what it produces early and often, so you know where the model falls short before there is real money committed.

Put the people who hold the knowledge inside the pilot

An agent needs context in the way a trained, experienced SME has it and a new graduate does not. The problem is that most knowledge in most organizations is tacit. Enterprise information isn’t just data in the sense of bits and bytes you can put in a spreadsheet and feed to the machine. A lot of it is in people’s heads, and sometimes the deepest expertise is in the heads of a handful of people.

I saw a large financial markets data business try to shortcut this: they needed new data models built out of what a few long-serving experts knew, so they interviewed them, recorded the interviews and fed the transcripts into Copilot. It didn’t work very well. Knowledge is hard to capture and validate that way.

What does work is actually older than AI: build a small team that combines deep domain knowledge with technical capability and place the technologists next to the people who do the job, even part-time. The gaps in your enterprise information show when the expert sees the model’s output and says, “that’s wrong, because” not when you interview them. McKinsey’s Kate Smaje made the point recently that every successful AI implementation sits on top of a successful people transformation. In 25 years of working with organizations as diverse as Deutsche Bank, Shell, BP and Anglo American, I can stand by that.

This isn’t an argument against using rented intelligence from the leading AI labs. The horsepower they offer is real and you should use it as appropriate. But those labs are attempting to create artificial general intelligence, while business managers have a business to run. Current models fall short of that need, which is part of why it is so hard to get out of “pilot mode.” The specificity you need to guide that horsepower is probably somewhere in your organization already. The challenge is to give the model the context it needs to do the job even better, and in doing so, free users from drudgery, reduce key-person dependence, and accelerate business growth wherever possible.

Enterprise AI is racing toward a consequential shift in how businesses operate. As agents take on work that used to consume the week, projects once dismissed as ‘we don’t have the capacity’ become worth another look. That raises a question worth bringing into the next planning meeting: What would we pursue if our teams had more time to do it?

Most organizations already have an answer. There are customers who deserve more attention, promising ideas waiting for someone to develop them, and services that would be valuable if the economics made sense. These opportunities often stay out of the business plan because the people needed to pursue them are already fully committed.

AI gives leaders a reason to revisit those decisions. As AI becomes more widely adopted, simply deploying agents will not be enough to differentiate one organization from another. The bigger opportunity is to rethink how the business operates, which customer needs it can address and where it can create value that wasn’t previously possible.

The State of Enterprise AI Adoption Report, published by Creatio based on a survey of 608 IT and business decision-makers, shows how widely that possibility is taking shape. Seventy percent of respondents say their organizations have moved beyond AI experimentation. Meanwhile, 78% are already scaling AI agents across departments or use cases, or expect to within a year. As that adoption expands, the opportunity is to connect additional capacity to a more ambitious business plan.

Put the work you postponed back on the agenda

One of the report’s most revealing findings concerns workforce expectations. Eighty-nine percent of respondents expect AI agents to augment teams, expand capacity or create new roles. Only 9% anticipate significant headcount reductions. These expectations do not establish what will ultimately happen to employment, but they show how many organizations are thinking about AI’s potential.

The interesting management decision is what happens to the capacity they expect to gain.

A service team might use it to give complex customer problems more attention. A sales organization might finally have the resources to support accounts that previously received little engagement. An operations team might tackle a persistent backlog while keeping pace with new requests. Each possibility needs a business case, but AI can change the assumptions that made the work difficult to justify.

I would make that discussion part of every significant AI investment. Alongside the estimate of hours saved, ask what those hours could make possible. Give the business owner responsibility for explaining how the team will use the capacity and how customers or employees will benefit. That makes the investment much easier to connect to a growth priority.

A faster task should help the whole business move forward

Additional capacity depends on how well AI fits into the work around it. Consider customer onboarding. An agent might gather information, identify missing documents and prepare an application for review. That can reduce administrative effort considerably. But the customer’s experience also depends on what happens next: whether the application reaches the right person, whether exceptions are resolved promptly and whether the customer has to provide the same information again.

The opportunity is to improve that entire experience. Employees can focus on decisions that require judgment, supported by information the agent has already organized. With a well-designed handoff, the business may be able to onboard more customers while giving each one appropriate attention.

This is why I would treat workflow design as a business leadership responsibility. Technology teams can establish what an agent can do. The people who run the process can explain where that capability would make a meaningful difference. Bringing those perspectives together helps organizations choose useful applications and define how responsibility should pass between people and agents.

Employees should have a voice in that design. They know which exceptions occur every week, where information is unreliable and which seemingly simple tasks require careful judgment. Their experience can make an AI deployment better from the outset. Involving them also creates a practical setting for learning how to direct agents and evaluate their work.

Give teams the confidence to expand

As agents take on more responsibility, clear governance makes expansion easier to manage. The report finds that 71% of respondents with fully established AI governance feel very confident about scaling AI, compared with 17% of those still developing a framework.

That is an association, rather than proof that governance alone creates confidence. Still, it offers a useful perspective on a subject often discussed mainly in terms of restrictions. Clear authority can help people move faster because they understand which decisions they are empowered to make.

The same principle applies to agents. An agent preparing a summary needs different permissions from one making changes to a customer account. Teams should know what each agent can access, which actions require approval and how to intervene when necessary. A business owner should be responsible for reviewing performance as the process evolves.

Once those practices are established, other teams can build on them. Every deployment becomes an opportunity to develop approaches that the next team can reuse, reducing the effort required to expand AI across the organization. Governance becomes part of the organization’s ability to execute consistently.

Make the business case bigger than hours saved

The report also gives leaders a reason to broaden how they evaluate AI’s contribution. Among organizations automating more than half of their workflows with AI, 33% report increased revenue from AI in the previous six months. Among those automating less than 10%, the figure is 14%.

Those percentages describe how many organizations reported a benefit, not how much their revenue increased. Nor do they guarantee that automating more workflows will produce growth. They do, however, suggest that deeper adoption deserves consideration as part of the revenue conversation.

Hours saved are a useful starting point. The more revealing question is what changed for the business.

For a customer service initiative, that could mean resolving more issues successfully while maintaining customer satisfaction. In sales, it could mean increasing the time available for customer engagement and examining whether that contributes to stronger conversion or retention. Connecting operational measures to business outcomes helps leaders decide where to invest next.

There is room to improve that connection. Among respondents pursuing AI to improve customer experience, only 56% measure customer satisfaction. Agreeing on the intended outcome and its measure before deployment would give these organizations a clearer basis for assessing progress. It would also help teams refine their approach as they learn.

Revisit the assumptions behind the plan

Business plans reflect assumptions about what an organization can deliver with the people and resources it has. As AI changes that capacity, those assumptions deserve another look.

Some opportunities will still be constrained by demand, funding or factors that AI cannot resolve. Others may become much more achievable. Leadership teams should be willing to reopen the discussion, particularly around work they postponed because employees lacked the time to pursue it.

That is what makes this stage of enterprise AI so consequential. The opportunity extends beyond freeing up employees’ time or making existing processes more efficient. AI gives organizations a chance to rethink how they operate, how they serve customers and which business opportunities they can pursue.

As AI adoption becomes increasingly widespread, deploying AI agents alone will not create a lasting competitive advantage. What will differentiate organizations is how effectively they use AI to reinvent their business models, redesign processes and deliver better customer experiences.

The competitive advantage of the AI era won’t come from simply adopting AI. It will come from reimagining what’s possible with it.

In Meta commercial terms changes slated to kick in on October 30, the company will shift the liability for any mistakes made by its AI models to its enterprise customers. The new language also makes those IT executives responsible for anything done by a partner or contractor.

The changes also finally put a stake into the heart of robots.txt, with Meta granting itself the right to grab, and use for its own purposes, any content associated with a Meta account.

The language allows Meta to “use automated software such as web scrapers, bots, robots, spiders, crawlers, and user agents and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl the domains, web pages, or URLs, and any content available through them, that are associated with your products or services,” according to the new language on its website on Monday. Meta also wants to be able to “periodically pull updates from such domains, web pages, or URLs in order to provide, develop, improve, research, and maintain advertising and business products including business, commercial and related products to help you create and deliver ads and other commercial content.”

Consultants said the three biggest concerns they had about the changes were the web scraping, data ownership, and AI liability transfer.

Web scraping and data ownership

However, Meta emailed a statement to CIO.com late Monday suggesting that it was rethinking its position on web scraping. Saying that Meta wanted “to clarify” the web scraping changes, Emil Vazques, a Meta public affairs manager, said, “the crawling terms we consolidated only applied to our ads and business products and we’ve clarified that in the terms themselves. It does not change how Meta uses web crawlers. As always, content owners can use robots.txt to signal their preferences. This is not about scraping news sites, and these updates don’t give us new rights that supersede those preferences.”

As of Monday evening, New York time, the proposed document’s wording had yet to be altered to reflect this, but Vazques said that a change was coming soon.

The data ownership issue sets Meta apart from other AI vendors in that it wants to train its models on anything it encounters. Then again, the nature of Meta businesses focuses on advertising and would therefore be expected to seek more data control.

The new proposed phrasing, which Meta could alter before it takes effect later this month, said that using any Meta product grants Meta “a license to content that is covered by intellectual property rights like photos or videos you share, post, or upload on or in connection with our Meta Company Products. That license applies to content you or someone on your behalf, such as your agency that places an ad for you or your service provider that manages your Page content for you, makes available on or in connection with any Meta Company Products. Without limiting anything in our terms and for clarity, Meta may use such content … to provide, develop, improve, research, and maintain Meta Company Products.”

AI liability

But the change that prompted the most raised eyebrows involved AI liabilities. 

The proposed language said, “AI features may make mistakes and may not always produce accurate, complete, or suitable results,” and customers “are solely responsible for and assume any and all risks associated with such AI features and any resulting content.”

That AI clause, said Frank Dickson, principal analyst at Dickson Research, “turns accountability upside down. Meta builds the AI features, admits they ‘may make mistakes’ and then assigns ‘any and all risks’ to the business.”

Mike Wilkes, enterprise CISO at Aikido Security, agreed that the move is perplexing.

“The new AI provisions shift substantial responsibility for inaccurate or unsuitable outputs onto customers. That makes no sense,” he said. “As an example, the ASPCA is going to be liable for Meta creating unsuitable results when they ask Meta to create an image of a dog. Only Meta has control of the model being used to create that image. I see a very high flight risk among enterprise customers when platforms impose such onerous terms and conditions around content usage.”

The October 30 date that the US-based Meta chose is ironic. That is the day before Halloween, which is known as mischief night in the US, when children play pranks on their neighbors. Given that, Dickson said, the date for these changes is appropriate: “Meta is handing out the tricks and keeping the treats.” 

He added that the data grab is frightening. “What Meta wants is content: what a business posts, uploads, or shares on or in connection with Meta’s products,” he noted. “The trouble is the phrase ‘in connection with,’ which can stretch as far as Meta needs it to. The list of ‘Meta Company Products’ lives on a separate page that Meta can revise at will. The license grows every time that list does.”

And, Dickson noted: “Meta may use the content to ‘provide, develop, improve, research, and maintain’ its products. Those five verbs cover nearly everything a technology company does.”

‘Legal sophistry’

One of the obvious defensive measures for an enterprise is to sever all relations with Meta. But beyond the pragmatic difficulties of doing that, given the powerful market share enjoyed by Facebook, WhatsApp, Instagram and Threads, such a move may not even solve the problem. That is because Meta made other contract changes in July that make Meta licenses “perpetual” and that said, “this license survives termination of these terms by any party for any reason.”

That, said Noah Kenney, principal consultant at Digital 520, means that the “the general content license ends when content is deleted from Meta’s systems,” not when the enterprise ends a contract.

One additional twist to the new language is that Meta had recently tweaked it to no longer explicitly say that it would train it models on enterprise data. But Thomas Randall, a research director at Infotech, said that the wording change made by Meta amounted to legal sophistry. “The revised version drops the word ‘train’ and states that collection is just for developing and maintaining advertising and business products, alongside protecting Meta products’ integrity and security.”

But dropping the word “train” is “not a substantive fix,” he pointed out. “The revised terms are still flexible enough to cover most AI work. When combined with other aspects of the revised terms — continued use equals consent, broad indemnity, AS-IS disclaimer, and Meta’s freedom to discontinue products without notice or liability — this is a one-way street. The difference between ‘train Meta products’ and ‘developing and maintaining Meta products’ is a matter of how you pronounce tomato.”

Could force IT strategy changes

In addition, Aman Mahapatra, chief strategy officer for technology consulting firm Tribeca Softech, stressed that this contract could be an industry admission that robots.txt no longer delivers any meaningful protections. Agentic systems had already made robots.txt close to irrelevant. 

“October 30 ends a thirty-year assumption that robots.txt protects what you publish. It never did,” Mahapatra said. “It was a courtesy convention the web agreed to honor, and Meta’s own framing of robots.txt as a place for site owners to register preferences tells you exactly how it will be weighed against a signed contract.”

Mahapatra said the language in the new Meta commercial terms could force a significant change in IT strategy.

“‘On your behalf’ extends the license to whatever your agencies and vendors upload. ‘Associated’ extends the crawl to domains nobody has defined, including the ones where marketing pages sit beside product documentation, research, and investor materials,” Mahapatra said. “Most CIOs cannot tell me how many Meta pages, ad accounts, and WhatsApp numbers carry their brand, because marketing and agencies own them and IT never inventoried them.”

Software supply chain risk used to have a fairly contained definition: open-source packages, build pipelines, and the occasional compromised maintainer account. AI agents have changed that. An agent assembles capability at runtime, pulling in models, MCP servers, libraries, code, tools, skills, and plugins, then acts on its findings. Agents operate at machine speed in parallelized workflows at speed and volume far greater than those of human-paced developers.

This differs from the dependencies CIOs have long governed. An agent’s tool catalog can change the day after approval, and the agent will trust whatever shows up the next time it looks. OWASP now includes Agentic Supply Chain Vulnerabilities (ASI04) in its Top 10 for Agentic Applications, describing risks that “arise when agents, tools, and related artifacts they work with are provided by third parties and may be malicious, compromised, or tampered with in transit.”

Here are five things technology leaders must understand about the agentic supply chain as agents become part of enterprise operations.

1. An agent can inherit the trust of something it connects to

When an agent calls a tool or connects to an MCP server, it absorbs that component’s context and ability to action into its own reasoning. Integrating an MCP server establishes a trust relationship that affects every connected agent.

That trust can travel through plaintext instructions and metadata in addition to code. An attacker doesn’t need to compromise a tool’s implementation to compromise the agent using it. A tool’s description (the metadata an agent reads to decide how and when to call it) is enough to influence how an agent reasons about and invokes that tool. Hiding an instruction inside a text description can be enough for an agent to follow it.

It isn’t enough to review the tool description before approving. You must review what the tool, and everything the tool talks to, is doing on every call after that.

2. Traditional supply chain security can’t see this layer

Dependency scanning, SBOMs, and code review were built to catch risk in artifacts that don’t change once they ship. MCP servers, tools, and skills don’t work that way; they’re discovered and called at runtime. CrowdStrike research on agentic tool chain attacks makes the gap explicit: Dependency scanning has no visibility into tools that evolve outside the deployment pipeline.

OWASP describes the same shift: Agentic ecosystems “often compose capabilities at runtime … thereby increasing the attack surface.” Agents pulling models, skills, and plugins from the internet expand the risk profile of shadow AI.

Individual tools and descriptions can change independently of the application deployment process, allowing agent behavior to change without a traditional software release gate. Security researchers call this a rug pull: a tool that passes review, then changes after deployment. OWASP recommends pinning tools and configurations by content hash and rolling back automatically when the hash drifts.

3. Attackers are exploiting the agentic supply chain

In September 2025, Koi Security reported what it called the first malicious MCP server found in the wild. An attacker copied a legitimate open source project and quietly added a line to their new version that bcc’d every email the tool sent to an attacker-controlled address. The package drew around 1,500 downloads before its developer deleted it from npm, but this action didn’t remove it from systems that already had it installed.

In August 2026, a worm targeting the keyv/cacheable npm ecosystem went after developers, eventually poisoning 1,684 versions across 420 package names. In July 2026, a researcher-filed GitHub security advisory disclosed an MCP tool in nginx-ui that created a direct path to remote code execution.

All three exploit the same gap: components that agents and AI coding tools load and run automatically. The common thread is reach. Each incident turned something an agent or developer tool could touch (outbound email, repo configuration, a live web server) into an attacker’s foothold.

4. Agent marketplaces and registries multiply the exposure

As agents pull skills and plugins from third-party marketplaces, the exposure scales with the catalog. Antiy’s research into the OpenClaw skill marketplace identified 1,184 malicious skills that had appeared there over time, with a single author account responsible for 677 of them.

Marketplace presence, popularity, and ranking shouldn’t be treated as evidence that an agent component is trustworthy. Once agents pull capability from open registries at scale, “who approved this skill” stops having one answer.

5. Securing the agentic supply chain means tracing the whole chain

A poisoned tool doesn’t stay a tool problem. Scanning the tool at the moment it’s approved says nothing about what it does six months later.

CISA and Australia’s ASD, in joint guidance on adopting agentic AI, break the resulting risk into five categories you can use as a starting checklist: privilege risks, design and configuration risks, behavior risks, structural risks, and accountability risks. Each maps to a question the agentic supply chain raises: What can this component do, how was it configured, how does it behave, how is it wired into everything else, and who’s accountable when it goes wrong?

CrowdStrike frames the work in a similar sequence: Discover the AI agents running, secure the agent supply chain feeding them, establish continuous identity for what they do, then detect and respond to what happens at runtime. Securing the supply chain is one stage in that sequence.

With agents, the dependency chain remains live at runtime. The software supply chain doesn’t end anywhere: Every tool, skill, and MCP server an agent uses can change for as long as the agent keeps running.

CrowdStrike Falcon® Guardian brings AI detection and response (AIDR) to the endpoint, where AI agents execute, providing visibility into the agents operating across endpoints, the resources and systems they interact with, and what they do at runtime. When a supply chain component introduces risk, Falcon Guardian helps teams see what the agent did, investigate what happened, and respond before the threat spreads.

Learn more: Explore CrowdStrike AI Agent Security resources to see how organizations can secure the agentic supply chain and the broader AI estate.

There is a lot of discussion about deploying AI across the enterprise. Most of it starts with the model, the platform or the tool. I start somewhere else: the work.

What decision are we trying to improve? What information does a person need at that moment? What gets in the way today? And what should the technology do when the situation does not fit the standard process? Those questions matter whether the employee is working at a desk, supporting a customer, writing software or managing a shift.

The work is different across those environments, but the technology challenge is connected. AI creates value when it is grounded in the context of the work and built into the workflow. It does not create value simply because it has been deployed.

That distinction is important for CIOs. At UKG, our own employees are primarily desk-based. My responsibility is not to run frontline operations. But we build technology for organizations whose work includes both corporate and frontline employees, so we have to understand both environments. The CIO’s role is to create the architecture, standards and operating model that allow AI to be useful across them.

Start with the outcome

The first question should not be, “Where can we add AI?” It should be, “Where would better information or faster execution change the outcome?”

For a desk-based team, that might mean reducing the time required to find the answer to a customer question, helping an engineer understand a complex codebase or giving a finance leader a clearer view of a business trend. For a frontline manager, it might mean identifying a staffing risk before a shift begins or helping resolve an exception without moving between several systems.

The use cases are different, but the method is the same. Map the workflow end to end. Identify the decisions, handoffs, systems and exceptions. Then decide what should be automated, what should be augmented and what should remain a human decision. If the process does not change, AI often becomes another layer on top of the existing friction.

Build the context layer

AI is not plug and play. A model can generate an answer, but a reliable answer depends on the context behind it: the right data, the user’s role and permissions, the current operating state, relevant history and the policies that govern the decision.

That context looks different depending on the work. An employee in an office may need project, customer, financial or technical information. A frontline employee may need current staffing, scheduling, compliance or operational information. In both cases, disconnected data creates the same problem: The system may be able to produce a response, but not necessarily one that is relevant, trusted or actionable.

This is why I think of the context layer as an architectural priority. CIOs need clear systems of record, reliable data, appropriate access controls and a defined way to retrieve and validate information. They also need to understand the difference between an answer, a recommendation and an action. Those are not interchangeable.

Redesign the work, not just the interface

There is a productivity gap that shows up in many AI programs. An organization deploys a tool, people use it and leaders expect the return to appear. But the work, roles and decision rights have not changed. That is not transformation. It is an additional tool.

If an AI system identifies a risk, who is responsible for acting on it? Can the person closest to the work resolve it? What constraints apply? When does the issue require escalation? A useful AI experience has to answer those questions as part of the workflow.

That requires close partnership among IT, business leaders, HR and the people doing the work. The technology team can provide the platform, integration and controls, but the business owns the outcome. The design also has to reflect how people actually work: different devices, different levels of access, different amounts of time and different levels of technical comfort.

Design with people, not for them

The people closest to the work are an important source of context. That includes an analyst who knows where a reporting process breaks, a customer-support employee who sees recurring issues or a frontline manager who understands what a staffing recommendation would mean in practice.

Representative employees should be involved in mapping, testing and improving the workflow. They should have a clear way to identify an incorrect answer, challenge a recommendation and report when a new process creates unintended work. That feedback is not a change-management afterthought. It is part of building a reliable system.

The CIO also has to be clear about the role of AI. The objective is not to remove human judgment from every process. It is to use technology where it improves speed, consistency and decision quality, while keeping people accountable for the decisions that require expertise, empathy or judgment.

Make the “3 Ts” decision

When we look at an AI use case, I find it useful to make what I call the “3 Ts” decision. Does the work require Talent for judgment or expertise? Can existing Tools solve it efficiently? Or do Tokens create enough value to justify the investment?

The answer will vary by workflow. A high-volume task may be a strong candidate for automation. A complex decision may need AI to surface the relevant information while a person remains accountable. In some cases, the best answer is not another model; it is a simpler process or a better integration.

This is also where CIOs need discipline around measurement. Prompts, licenses, logins and interactions are signals of activity. They are not proof of value. Measure whether the work is better: whether decisions are stronger, cycle times are shorter, errors are reduced, customers are better served or employees can spend more time on high-value work. Then pair those measures with trust and experience signals.

The CIO agenda

If I were evaluating an AI opportunity today, I would ask these questions:

• What business outcome are we trying to improve?
• What context does the workflow require and can we provide it reliably and securely?
• What needs to change in the process, role or decision rights?
• Have we designed with the people who will use the system and the people affected by its decisions?
• How will we know the work is better, rather than simply knowing that the tool is being used?

Enterprise AI will not be one experience for every employee. A desk-based employee and a frontline employee may need different interfaces, information and workflows. But they should be supported by the same underlying discipline: trusted context, clear accountability, human judgment and a focus on outcomes.

That is the work of the CIO. Simplify where we can. Standardize where it creates leverage. Scale what proves valuable. The goal is not to deploy more AI. The goal is to help people make better decisions and do better work — wherever that work happens.

When Workday acquired Sana just about a year ago, it said that the combination of Sana’s AI with Workday’s platform would create a new “front door” to work. Today at its Workday Rising conference, it unveiled that front door, turning Sana into Workday’s default home screen that, it said, “brings tasks, decisions, meetings, and agent activity into one place, helping employees move directly from what needs attention to getting it done.”

The new interface goes beyond merely answering questions to orchestrating Workday’s agents to execute tasks. Each employee’s experience is tailored to their role; when they open the application, they see the tasks and decisions that need their attention and can take action directly from the UI. And, using TypeSafe’s Jev AI model, Sana adapts its UI to each task, the company said, generating forms, calendars, approval cards, visualizations, and other interactive experiences in real time and completing tasks once the employee approves the action. It also supports work that spans multiple days, displaying relevant information at every stage of functions such as financial closing or preparation of workforce plans by HR.

Sana also works within other AI tools and platforms including Anthropic Claude, Google Cloud’s Gemini Enterprise, and Microsoft Copilot, as well as within Microsoft Teams and Slack. But, Workday said in its announcement, “third-party AI tools and platforms never get raw access to Workday data — they can now access this data through Sana, and Sana does the reasoning, applies each company’s own permissions, approvals, and policies, and carries out the work so actions are lawful by design and recorded, regardless of the tool it started in.”

Along with the Sana home page, known as Workday Home, the company introduced Sana Concierge, which brings together the self-service capabilities and Sana for IT Service Management released earlier this year with Workday Help and Case Agent to create AI-native employee services spanning HR and IT. Workday said it can resolve requests such as password resets, access requests, and questions about time off and payroll, as well as performing onboarding and offboarding. The employee just submits a natural language request, and Concierge looks up relevant policies and, based on the employee’s Workday information, guides them through the steps to complete their request.

If a human decision is needed, Concierge routes the request to the right person in the background, but remains the employee’s point of contact.

The Sana Workday Home experience is available today, with more capabilities and support “coming soon,” the company said. Sana Concierge is available now to early adopter customers, with general availability expected in the first quarter of 2027.

From copilots to autopilots

The company also introduced four new autonomous AI agents that act as autopilots across hiring, payroll, accounting, and compliance.

“From co-pilots to autopilots, that’s a big transition that you will see across our agents today,” said Joel Hellermark, former CEO of Sana, who is now Workday’s chief AI officer. “These are now agents that anticipate what needs attention, they apply the company’s policies, they advise on the next step, and then act once the appropriate person approves that. And these autopilots run completely on Workday’s rails, so they’re self-governed and compliant.”

And, he said, while a typical copilot-driven system “sits there” until the user logs in, autopilot agents run on a heartbeat, operating whether or not the user is online.

The Talent Acquisition Agent, for example, monitors the open job queue from the time a position is posted, finding qualified candidates and giving the recruiter information about them. It can generate outreach to potential hires and present it to the recruiter for approval, explain why candidates on a short list are a good fit, and schedule interviews with those the recruiter flags. It then automatically joins the interview and takes notes. Based on recruiter feedback, the agent learns how to improve its recommendations.

The agent works across multiple recruiting tools, including Workday Recruiting, HiredScore, Paradox, native Workday skills, and connected sourcing providers. The autopilot capabilities are available to early adopter customers today, with general availability planned for early 2027.

Three more autopilots will arrive for early adopters in early 2027, for Payroll Agent, Accounting Agent, and Deployment Agent.

This could be the start of a change in the coordination of work, said Melody Brue, analyst in residence at Moor Insights & Strategy. “Workday is trying to connect more of the work around a decision, from weighing options to carrying out the approved plan,” she said. “Sana could become the starting point for that process, giving Workday a larger role in coordinating work beyond its own applications. For current customers, the meaningful change would be less manual coordination between a request, an approval, and a completed transaction. The value depends on whether that reduces the work employees have to manage or shifts it into resolving exceptions when a workflow crosses systems.”

Extending Decision Intelligence

Workday Decision Intelligence, first seen in Adaptive from Workday, is spreading into more areas of the business, said Yasmeen Ahmad, SVP and GM, Workday Data Cloud.

Decision Intelligence is not an agent performing a task, she said. “It’s a planning and reasoning experience built for decisions that are too complex, too high stakes, or too cross-functional for any single task to capture.”

Ahmad described a scenario in which HR revised a hiring plan using Decision Intelligence, passing it to Finance to use as an input for reviewing its quarterly projections with the same tool.

“Normally this would have taken six weeks, five spreadsheets, and analysts trying to stitch it together. Today, it was all just a prompt,” she said.

Brue said that what she finds interesting is whether Workday can take more of the manual modeling out of a staffing discussion. “Workday already supports connected workforce and financial planning,” she said. “If teams can work through several options with fewer model adjustments and less reliance on specialists for routine ones, planning could be more responsive when business needs change.”

Work Intelligence

Work Intelligence, available to early access Workday Human Capital Management customers, breaks jobs into their component tasks, describing the skills employees need to perform them. It draws on Workday Skills Cloud, giving leaders a look at how jobs are changing, and then, using Decision Intelligence, companies can get a picture of their internal readiness for evolving work.

“The task-level analysis is worth watching,” Brue said. “A role is rarely entirely automatable or entirely human-led. Looking inside the role could give customers a more useful basis for redesigning work. But saving time across a dozen tasks doesn’t automatically free someone up for a different assignment. Companies may need to regroup the work, letting agents handle routine steps together and giving employees clear responsibility for what comes next.”

Off with its head

Workday also announced that its Trusted Agent Platform, on which organizations build and run AI agents governed by their business rules, is now headless, allowing customers to use the development tools and models of their choice. It brings together the existing Workday Data Cloud, Agent-Ready Tools, Developer Agent, custom agents, and Agent Harness.

However, Workday CTO Gabe Monroy emphasized that, at the same time, “headless can’t mean lawless. The rules for HR and finance already live in Workday, so customers don’t have to rebuild them for every agent they create. This is what lets companies move fast with agents without losing control.”

And, to enhance the controls, in early 2027 the company will add Agent Context Service and Grounded Reasoning to Agent Harness to provide Workday context that agents need and check requests against company policies, business processes, and tenant data before the agent is allowed to act.

“Governance gets more consequential as agents move from recommendations to actions,” Brue pointed out. “An agent can be authorized and still make the wrong call. Customers need to distinguish permission to recommend from permission to execute. And know which actions require human approval, especially in hiring and finance. The governance question extends to any workflow that crosses platforms. Customers need clear ownership of approvals, exceptions, and the audit trail when a request starts in one system, and an agent acts in another.”

For companies already using Workday and ServiceNow together, she said, there’s an additional consideration: Workday’s expansion into employee-facing AI and agent governance could create more overlap between platforms that have traditionally played complementary roles.

“Joint customers don’t suddenly need to choose one, but they may need to clarify which platform coordinates the work and how controls operate across both,” she said. “A unified experience won’t necessarily mean unified control.”

The AI revolution is here, and enterprises everywhere are racing to deploy the latest tools, agents and models. Yet, the simple truth is that access to AI technology is no longer a competitive advantage. Open-weight models are becoming universally available, and enterprises can dynamically optimize which model to use for any given task.

If the technology itself is no longer the differentiator, what will separate the winners from the laggards? The answer will increasingly lie in the layers of context, control and support around those models – whether agents have sufficiently rich, accurate and timely information about how the business works, and the right guardrails to operate effectively within it.

For decades, enterprises have been told that data is their most strategic asset. This remains true, but I would argue that a well-described digital twin of an organization is itself a strategic dataset – a detailed understanding of how the business operates. That understanding has always been valuable, sometimes mandatory in regulated industries, but in the AI era it becomes business-critical

Without it, AI agents – no matter how advanced – will struggle to execute work autonomously, scale effectively or deliver meaningful outcomes. The illusion of AI as a silver bullet persists, but the reality is far more nuanced. If two companies deploy the same AI technology, why might one achieve transformative results while the other sees only marginal gains?

The difference isn’t the model but the contextual information it can work on. A company with poorly defined, ambiguous or siloed processes will find its AI initiatives plagued by inefficiencies, errors and unintended consequences. Meanwhile, an organization with deep process rigor will unlock AI’s full potential, delivering faster execution, lower costs and higher customer satisfaction

Take, for example, Legal & General, one of the UK’s leading financial services organizations, managing more than £1 trillion in assets, which undertook a major transformation with more than 2000 business processes reviewed, approved and maintained by the business, ensuring its AI agents operate from accurate, governed information rather than disconnected documents or outdated knowledge.

This is where process context becomes strategically important. Every company may increasingly have access to the same models, but no two companies operate in the same way. The knowledge embedded in how an organization serves customers, manages exceptions, coordinates teams, applies controls and makes decisions has been built up over years – sometimes decades.

When that understanding is captured and made available to AI, it becomes something competitors cannot simply buy or replicate. The model may be increasingly commoditized; the context you give it is uniquely yours and creates a compounding advantage where an agent with deeper process context can make better decisions and execute work more effectively.

To trust AI agents with autonomous work, enterprises must ensure their processes meet critical criteria. First, clarity and precision are non-negotiable. AI agents cannot operate effectively if processes are described in vague or incomplete terms. Every step, variation and outlier must be documented with enough detail to remove programmatic ambiguity.

Every process has a “happy path,” but real life in a large, complex organization rarely follows it. There are outliers, unexpected events and variations driven by everything from customer behavior to different laws and regulatory requirements across jurisdictions. For agents to operate at scale, they need to understand those variations properly.

It is only with this detailed understanding of the current process and all its variations and exceptions that you have any chance of redesigning the process to make it “agentic” without making simplistic decisions that will turn out to be costly mistakes.

Second, processes don’t exist in isolation; they are interconnected and interdependent, and changes in one area often create bottlenecks or inefficiencies elsewhere. For example, automating a single workflow might accelerate throughput in one department but create congestion downstream. A digital twin – a dynamic, continuously updated representation of the organization’s processes – is essential to anticipate and mitigate these ripple effects.

Consider Siemens, which mapped out its end-to-end process model to create such a digital twin of its supply chain operations. By simulating the impact of AI-driven automation before deployment, the manufacturing giant was able to identify potential bottlenecks and optimize its processes end-to-end, resulting in a 20% reduction in lead times.

Finally, governance and risk management are paramount. As AI agents take on more autonomy, boards and executives must ask themselves where those agents are operating, what risks they introduce and how they are controlled.

AI deployment is no longer just an operational concern – it’s a board-level risk, akin to cybersecurity. Without proper guardrails, agents can behave unpredictably, leading to compliance violations, reputational damage or financial losses.

For example, JPMorgan Chase is using AI in transaction screening to review more than twice the volume while halving the number of manual operator checks, resulting in faster turnaround and fewer delays. Crucially, the bank says its AI strategies are aligned to end-to-end client journeys, helping ensure AI is applied where it creates the most value rather than automating individual tasks in isolation.

For CEOs, this shift demands a new priority: treating process not as an implementation detail but as a core strategic imperative. Historically, process management has been the domain of operational teams or quality departments but, today, it’s moving to the C-suite. COOs and CIOs are increasingly owning process transformation, recognizing that AI success hinges on process depth. Companies that neglect this shift risk falling behind, stuck in a cycle of piecemeal pilots and narrow use cases that fail to deliver scalable results.

Ultimately, for most enterprises, the AI race will be more of an execution race than a technology race. The differentiator won’t simply be the agentic capabilities companies can access, but the outcomes they can achieve with it – doing what they do today faster, more efficiently and in ways that create a better experience for their customers. And successful execution starts with process.

Every CIO in a regulated industry has a system the business depends on, that no one fully understands and that must be replaced. In banking, it is often a core platform that predates the internet. In my own career, that system took two distinct forms: first, a VAX minicomputer running a parking operator’s entire business across nearly 200 New York City locations; later, the on-premises core of a global financial technology company supporting payments, banking and card issuing. Both had to move to the cloud without interrupting the customers that depended on them. The technology differed each time. The reasons the migrations succeeded did not.

Why regulated migrations fail differently

Migration failures come in two kinds. The loud kind takes a website down, engineers fix it and customers move on. The quiet kind — a pricing discrepancy, a missed filing, a mismatched reconciliation or a lost audit trail — may not surface for weeks. Its cost is measured in regulatory findings and lost client contracts rather than in hours of downtime.

Regulated migrations face both. The loud kind can be ruinous, as TSB learned in 2018 when a big-bang platform migration locked customers out for weeks and, after regulators found insufficient contingency planning and untested cutover configurations, drew a £48.65 million fine. The loud kind is at least visible. The quiet kind breaks the business without anyone noticing.

This changes what “without breaking the business” means. It does not mean zero outages. It means that at every point during the migration, the organization can prove that the new system produces the same outcomes as the old one for the cases that matter, or a difference the business has approved, and has a tested way to recover if it does not. That standard is stricter than most migration plans are written to, and it determines whether the program survives its first serious incident. Meeting it comes down to five operational disciplines.

Map the dependencies you were not told about

The formal dependency map in the architecture repository is always incomplete. The dependencies that break a migration are the informal ones, which grew up around the legacy system without ever being documented. A team in another department builds a nightly job that reads a file the legacy system happens to produce at 2 a.m., without the system’s owners knowing. An analyst in finance writes a spreadsheet macro that queries a database table directly, bypassing every official interface. A report goes to a regulator every quarter, generated automatically for so long that no one remembers how to produce it by hand.

Finding these dependencies takes careful observation. Configure the legacy environment to record every connection, every file it produces or consumes, and every scheduled job. Collect this data over a full business cycle, including month-end and quarter-end processing, before relying on the dependency map. This step is often dismissed as unnecessary, but it provides the evidence needed to plan the migration sequence. A workload should move only when its dependencies have moved, remain reliably accessible, or are confirmed to be no longer required.

The map must also account for people. Behind every critical legacy workload is a group of engineers or business analysts who know why an undocumented parameter exists or why a batch job runs only on the third Thursday of the month. Identify them at the outset, protect their time and capture what they know in reproducible test suites before they retire or move on.

A thorough map also reveals what to prune. Over decades, legacy estates accumulate dormant batch jobs, deprecated extracts and orphaned interfaces. Retiring these before cutover shrinks the migration scope and removes testing cycles spent on workflows that no longer serve anyone. Never decommission an idle process based solely on the monitoring window; verify with the responsible business owner and check historical run schedules for low-frequency jobs first.

Sequence cutovers around the business calendar, not the project plan

A project plan wants cutovers on a steady cadence. A regulated business has dates on which nothing may change, such as settlement days, filing deadlines, rate resets and month-end close. Build the migration calendar from the business calendar outward, placing cutover windows where you can detect and recover from failure before the next immovable date.

The discipline that makes this work is proving it at every stage before scaling to the next. Start with one workload, such as monthly billing or a single settlement feed, in the incremental style the Azure Architecture Center calls the strangler fig pattern. Run it on the new system in shadow mode alongside the legacy system for a full business cycle. Keep the legacy system as the system of record during this period. Capture the new system’s intended actions, such as payments and client messages, without sending them. Next, compare both systems’ outputs for each transaction and resolve any differences. Test external integrations, peak-load performance and recovery procedures separately, since shadow running never exercises the actions it suppresses.

Only then make the new system authoritative for that workload. Retain a tested recovery path through an agreed stabilization period, with a method for handling transactions recorded after cutover, and move on to the next workload. Where the architecture does not allow workloads to move independently, apply the same discipline to a coordinated group of them, with rehearsed cutovers and explicit acceptance criteria in place of the workload-by-workload sequence. Where even shadow running is not feasible, establish readiness through representative transaction replay, end-to-end testing and full cutover rehearsals, against the same acceptance criteria and with the same tested recovery path.

This is slower than a big-bang migration by a factor that sometimes makes executives uncomfortable. It is also the approach that produces evidence, rather than hope, before each increase in production exposure.

Keep the old system running until the new one has earned trust

The strongest temptation in any migration is to switch off the legacy system early, because running two systems costs money and because the old one is what the program exists to eliminate. Resist it. In a regulated environment, the legacy system is the reference implementation. It is the baseline against which every output of the new system is evaluated. Explain and resolve every material difference between the two systems, never mistaking agreement for correctness; then check the results against the business rules and the authoritative records.

When we moved a parking operator’s business from a VAX minicomputer to a cloud platform, the VAX ran alongside the cloud platform for months, and we reconciled every transaction between them until the new system earned the business’s trust. The parallel run let us catch and resolve issues before they reached customers. The cost of the parallel run was visible and budgeted. Had we skipped it, our customers would have discovered the errors, such as mischarged accounts and failed payments, before we did.

Rehearsal matters at every scale. When Commonwealth Bank of Australia moved its core banking platform to the cloud in 2025, it conducted five full dress rehearsals of the cutover, having originally planned for three. During the actual cutover, it kept customers online throughout the three hours the core was down.

Reconciling parallel outputs exposes discrepancies, and not every discrepancy is a defect in the new platform. Shadow running frequently uncovers latent bugs in the legacy system, such as rounding oddities, edge-case truncations or mishandled time zone changes, that went unnoticed because no independent system had ever checked the arithmetic. Classify each discrepancy as a new-system defect, an undocumented legacy defect or a deliberate change in method. New-system defects must be fixed. Legacy defects need an impact assessment, remediation and, where required, disclosure. Deliberate changes require approval from the business and, where applicable, the regulator. Working through that classification transparently earns the consensus needed to retire the legacy host.

Reconciling transactions does not prove that the migrated data is complete. Before retiring the legacy system, validate balances, record counts and relationships between records, and confirm that historical records and audit evidence remain retrievable, whether in the new system or in a validated archive.

Build the controls into the platform, not around it

Regulated migrations often treat security, resiliency and auditability as a compliance workstream that runs beside the technical one. That is how gaps appear at cutover. Build the required controls into the target platform before the first workload arrives: automated data residency enforcement, encryption with customer-managed keys where the data classification calls for them, continuous monitoring, immutable audit trails and granular identity and access management. Every migrated system then inherits these controls from the start, and each workload’s use of them is verified. Compliance is not a post-deployment audit; it is a primary design constraint that dictates the perimeter of the technical solution.

This matters doubly when the platform is intended to host AI. Models and agents will act on the data the migrated systems hold. Audit trails must be immutable and retrievable for years, and decisions that affect customers will need an explainability that many AI systems do not provide by default. If data lineage, access controls and the audit trail are not in place at migration, retrofitting them afterward is costly and often incomplete. Evidence that was never captured cannot be reconstructed, and the AI program will inherit a foundation that cannot withstand regulatory scrutiny.

Govern with standards the business can read

Enterprise architecture frameworks, such as TOGAF, provide the architecture team with a process; industry reference models, such as BIAN, give the business a vocabulary. The Banking Industry Architecture Network (BIAN) publishes a standard model that partitions a bank’s work into named business capabilities, such as payment execution or customer agreement, each with a standardized interface. When migrated services are mapped to that taxonomy rather than to legacy program names, a product owner or risk officer can read the migration plan, verify that a capability functions and sign off without needing to know what the old modules were called. The same artifacts, tied to test results and control evidence, can be presented to a regulator without translation. That shared language is what turns a migration from an IT project the business tolerates into a modernization the business owns.

What it takes

The five disciplines set out above hold whatever the technology: build a dependency map from observed system behavior; plan the cutover around the business calendar; prove correct transaction processing, through parallel running where feasible and through replay testing and rehearsed cutovers where it is not; establish platform controls before workloads arrive; and define governance in terms the business and its regulators understand.

None of these practices is new. What is rare is the resolve to keep to them when delivery schedules tighten. The organizations that modernize successfully are not those with the most sophisticated target architecture. They treat careful planning, respect for legacy knowledge and business continuity as engineering requirements rather than aspirations, refusing to sacrifice verification for speed.

Many organizations have licensed language models, tested AI agents, and asked DevOps teams to develop code-generation standards. But production deployments are still a work in progress for CIOs, with only 50% of organizations moving more than half of their AI projects from pilot to production, according to Outsystems’ State of AI Development 2026 report.

Increasing production deployments is a key step for many CIOs, followed by fostering more widespread employee adoption. But usage doesn’t always translate to business outcomes, leaving many IT organizations struggling to deliver business value on their AI initiatives.

Much of that has to do with how they’re measuring AI value.

“Too many organizations are treating AI adoption as the metric when the real question is whether it’s improving business outcomes,” says Rob Scudiere, CTO at Verint. “The metrics that matter are the ones executives already track, and if those numbers aren’t improving, it’s hard to argue that AI is delivering meaningful value.”

Measuring how AI impacts the business strategy and its relevant KPIs is a vital first step, especially when it comes to identifying AI’s business-specific opportunities and risks. After all, AI’s capabilities, practices, and security considerations are changing so quickly that it’s essential for C-level leaders to discuss AI’s strategic business value frequently — and to do so with the right data to back those discussions up.  

That, in turn, requires a more collaborative leadership approach.

“Organizations should align with business stakeholders upfront on the ‘so what,’” says Keyur Ajmera, CIO at Boomi. “CIOs should partner with CMOs, CHROs, CFOs, and business practitioners to identify use cases, establish appropriate governance and standardization, prepare employees for new ways of working, and create financial guardrails as usage-based AI costs become more prevalent.”

I heard from more than 30 leaders on their picks for the business value metrics that matter most when tracking your AI strategy’s impact. Below are my top five worth adopting.

Growth driven by organizational expertise

For AI to be transformational and not just reshaping business, executives must show that building greater expertise through AI drives business growth.

“Executives primarily talk about AI ROI in terms of cost savings and efficiency, and that doesn’t adequately measure long-term AI success, because it doesn’t capture whether the organization is actually getting smarter,” says Sarah Edwards, chief product and strategy officer at Kantata.

“I’d point them to what I think of as an organization’s expertise compounding rate, which is its ability to capture, synthesize, scale, and continuously build on institutional and tribal knowledge,” she adds. “Firms also need to look beyond productivity and efficiency and consider how AI drives revenue growth, including new pipelines, better client retention, new pricing models, and the ability to take on more projects without adding headcount.”

Ways to measure: Track how expertise developed via AI capabilities drives revenue. Examples include:

• DevOps teams, newly trained on vibe coding tools, help increase revenue by adding AI capabilities such as shopping concierge agents and genAI search capabilities to customer-facing websites.
• Benchmarking return on ad spend (ROAS) between two campaigns, one developed by a team using AI tools, the other without using AI.
• Contact centers using AI to support service-to-sales or sales-through-service competencies can measure increases in revenue per agent hour or offer conversion rates. In one famous case, Ikea built a new €1.3 billion business line, thanks to a contact center chatbot freeing up associates’ time.

The key pattern is that when AI is introduced into a sales, marketing, or support function, it can be correlated with revenue increases.

Improved customer retention

Improving customer retention is a key metric for products or services, especially those with subscription business models. Customer loyalty and the ability to influence repeat purchases are similar KPIs when the brand influences pricing and customer-perceived value.

How CIOs implement data and AI governance can positively or negatively affect customer retention. According to the State of Digital Trust 2026 from Usercentrics, consumers will now pay 7% more for the brands that have earned their trust around AI. Meanwhile, 24% of consumers canceled a subscription or stopped buying from a brand because they were concerned about how their data was used in AI.

Donna Dror, CEO at Usercentrics, says, “Most CIOs can measure what AI saves them, but the harder number, and the one that shows up in revenue, is what mishandling data in AI costs in lost customers.”

Ways to measure: Measure consent withdrawals, Data Subject Access Requests (DSARs), or AI feature opt-out rates. Businesses with subscription products can track renewal rates in the 90 days following an AI feature launch and add a data-and-AI-use reason code to the cancellation flows.

Employee capabilities beyond productivity

I’ve warned CIOs that focusing on AI’s productivity improvements is a trap, because at some point the CFO will look for cost savings through headcount reductions. Other metrics beyond productivity may matter more, especially for organizations investing in agentic AI workflows.

The first is time-to-decision: AI agents are either capable of taking action autonomously, or they are implemented to include human collaboration in decision-making. CIOs and the business owners of AI agents should determine how to measure the business impact of faster, smarter decision-making.

“Most AI scorecards measure activity, including agents deployed, tasks automated, and prompts processed,” says Vikram Bhandari, chief technology and innovation officer at Riveron. “The metric I push clients toward is time to decision, such as how much faster finance or ops teams can act once AI is in the workflow, and what that speed translates to in revenue or risk avoided. Headcount metrics tell you AI has replaced work, while decision-speed metrics tell you AI changed the business.”

Enterprises can scale beyond individual productivity improvements by re-engineering business processes using AI orchestration platforms. But CIOs have to get AI democratization right by influencing experts to build the organization’s knowledge base and the AI context layer utilized by AI agents.

“Data democratization’s real number is the percentage of institutional knowledge anyone can self-serve, without tracking down one specific person,” says Chris Cope, VP of engineering at CADDi. “Manufacturers map every flow on the factory floor and fixate on single-source supplier risk, yet miss the same risk when it’s a person holding the knowledge.”

Ways to measure: In risk management functions, measure time-to-decision as the difference between mean time to remediate (MTTR) and mean time to detect (MTTD). Measure knowledge management impacts by tracking increased utilization of internal LLMs, while capturing the reduced time spent on answering requests for information (RFIs) by subject matter experts.

Impacts to customer and employee experience

CIOs should hunt for examples of value delivered to customers and for employees that go beyond doing today’s job better. This means exploring areas where AI provides a business capability that is not feasible, or is economically unscalable, if people were performing the function without AI capabilities.

Venkat Ramakrishnan, president and COO at NeuBird, shares this example in IT and security incident management: “The focus has shifted from how fast you resolved an incident to how many users never felt it in the first place. When AI prevents an incident 30 minutes before failure, or resolves it in under 5 minutes instead of 175, it eliminates the experience impact rather than only reducing it,” Ramakrishnan says.

Other examples require exploring game-changing operational transformations in other departments, or finding areas where AI impacts the connected experiences of customers and employees (CX and EX).

“CIOs should measure genAI by whether it changes the economics of the business such as decision velocity, capacity created per employee, exceptions resolved without escalation, revenue leakage recovered, customer and employee effort avoided, and ultimately the rate at which AI benefits reach the P&L,” says Arun Raghavapudi, chief customer officer at R Systems (RSI). “The strongest AI strategy is therefore one where CX, EX, engineering, and business KPIs form a single value chain rather than separate technology scorecards.”

Ways to measure: CIOs should identify AI-native capabilities, those business and operational competencies that are net-new AI use cases. Once identified, business value metrics determine the value delivered, and the AI-native capabilities become marketable innovations to communicate across the company.

Measure AI’s operational impacts

Many CIOs used lift-and-shift cloud migration strategies or overly empowered DevOps teams to procure cloud infrastructure, only to find skyrocketing costs. CIOs applied FinOps best practices and shifted-left financial considerations to reduce costs and instill fiscal discipline.

Even as token costs decline, AI cost debt is very real as consumption of AI models and use of AI agents increases. Tokenomics tracks and manages both costs and the business value delivered from spending on AI tokens. On the cost side, CIOs should factor in the human-effort costs, including the AI hallucination tax when employees have to recognize when AI models and agents are wrong.

“Token spend is becoming a real line item, and if it grows faster than the outcomes it produces, that’s a unit economics problem, not a scaling milestone to be proud of,” says Yasmin Rajabi, COO of CloudBolt. “The metrics that matter include how often AI-generated work is accepted without rework, how many decisions or actions run without a human in the loop, and value per token you get for every token you spend.”

Measuring the value of operational impacts needs to consider both tactical impacts based on individual contributions versus team, department, and business-level outcomes.

“Indicators that AI is creating measurable value rather than simply generating activity include whether critical workflows are completed quicker, decisions are more consistent, and AI-generated recommendations are traceable back to authoritative information,” says Tony Grout, chief product and technology officer at M-Files. “The most successful AI programs will be judged by whether they deliver better business outcomes like faster project completion, higher-quality customer service, improved compliance, and more consistent decision-making.”

Ways to measure: My research on AI agent orchestration platforms identifies several platforms that include tokenomics capabilities, including solutions from Boomi, Cisco, Databricks, Kamiwaze, LangChain, Microsoft, Nutanix, PagerDuty, Salesforce, Snowflake, Tray.ai, and Workato.

Setting realistic expectations

CIOs must lead a progression from AI experiments to production deployments, enterprise adoption, and delivered value. But the organization’s velocity to adopt and deliver value requires a strong change management program that adjusts to business demand, especially if the AI bubble bursts.

“The reality is that enterprise AI follows a productivity J-curve, where companies invest in new skills, operating models, governance, and process redesign long before the full economic benefits become visible,” says Kris Lovejoy, global head of strategy at Kyndryl. “As a result, usage often rises months before measurable business outcomes appear, and this is one reason many executives feel uncertain about the return they’re getting from AI.”

While AI agent deployment and employee adoption are not the end game, CIOs must excel at these before overpromising business value. Two places to start include upskilling IT for agentic AI while avoiding mistakes when deploying AI agents.

A senior executive at a large enterprise recently described a capital allocation review to me. The committee had spent two hours deciding where the next tranche of maintenance capital should go. The discussion drew on last year’s budget, a regional presentation and the persuasive advocacy of a plant head who had been escalating the same request for three quarters.

Somewhere in that same organization sat a predictive model estimating failure risk across the asset base. It was reasonably good. A competent team had built it sometime earlier. Nobody in the room referred to it or mentioned it.

What bothered him was not that the model was wrong. It was not wrong. It wasn’t late, and it wasn’t hard to access. It simply had no relationship with the decision.

I have heard enough versions of that story to believe it describes the central problem in enterprise AI right now — and that we are consistently solving for the wrong thing.

AI adoption is no longer the constraint

Mckinsey’s The State of AI in 2026 makes the point clearly. Almost nine in ten organizations report regular AI use in at least one business function, and around 44% say AI is scaling across the enterprise. Eight in ten report higher individual productivity. Yet only about 37% attribute any positive enterprise-level EBIT impact to AI.

BCG’s survey of large-company CEOs found nearly nine in ten reporting cost or revenue benefits in targeted areas — while more than half cited a missing link between AI and P&L, and only 14% had clearly defined P&L impact across their AI initiatives. PwC’s 2026 CEO survey put it even more starkly: 12% of CEOs said AI had delivered both revenue gains and cost reductions.

Individual productivity is rising faster than enterprise performance. That gap cannot be explained by technology alone, and more tooling should not be the default response.

Part of the cause is how we frame AI in the first place. I ran an informal poll among my own network recently — not research, but directionally interesting — and 57% of respondents said automation and efficiency were the first things that came to mind when they heard the word “AI.” If that is the default mental model, then AI gets pointed at existing work to make it faster or cheaper. It rarely gets pointed at the question of what the enterprise ought to know and decide that it currently cannot.

I have argued before that generative AI is best understood as the use case that creates all other use cases — a foundation that expands what is possible across functions. That remains true. But a foundation only creates possibility. Something still has to direct it at the decisions that determine whether the business performs. That direction is what is usually missing.

Four different gaps behind the same AI problem

Here is the practical consequence. When a consequential decision is poorly supported, most organizations reach for the same answer: we need better AI. But a weakly supported decision can fail for at least four fundamentally different reasons, and only one of them is fixed by building more capability.

1. The Capability Gap – The enterprise genuinely cannot produce the intelligence the decision requires. An executive need to know which assets are most likely to fail in the next 12 months, and the organization has no reliable condition data, no failure history, no model, no one who could build one. This is a real gap, and it needs real investment — data capture, models, skills, sometimes a new platform.
2. The Design Gap – The capability exists, but it was not designed around the question being decided. The organization can predict asset failure. The executive’s decision is not simply which assets may fail. It is where to allocate a fixed capital budget — which requires the consequence of failure, safety exposure, repair-versus-replace economics and scenarios at different budget levels. Failure probability is an input to that decision. On its own, it is not an answer, and handing the executive an input and calling it intelligence is how analytics teams lose their credibility.
3. The Delivery Gap – The right intelligence exists and is well designed, but it reaches the wrong person, at the wrong moment, or in the wrong form. A capex-risk analysis that arrives after the budget is closed is a record, not decision support. So is a complex dashboard when the executive actually needs a one-page recommendation before the investment meeting.
4. The Connection Gap – This in my experience it is one of the most common, the least visible and potentially the most consequential. The intelligence exists, it is well designed, it arrives in time — and consulting it remains optional. The model is available. The investment committee still runs on historical budgets and advocacy. Nothing in the formal governance of that decision requires anyone to look.

Connection gaps are difficult precisely because nothing appears to be broken. Every component works. The data is sound, the model performs, the report is circulated. The failure is structural rather than technical: no one ever changed how the decision is made. And because there is no visible defect, the usual response is to improve the components — a better model, a richer dashboard, a wider rollout — which leaves the gap exactly where it was while consuming another budget cycle.

Closing a connection gap is usually an operating-model issue rather than a technology one. The intelligence must become part of the formal decision process — what goes into the committee pack, what evidence must be considered, and where human accountability for the final decision sits.

I use these four gaps as part of a broader framework I call Enterprise Intelligence Architecture (EIA). EIA starts with the decisions that materially determine enterprise performance and works backward to the intelligence those decisions require—then to the data, analytics, AI and governance needed to produce it. The objective is not to create another AI architecture. It is to connect what the enterprise can know to how the enterprise actually decides.

EIA is the enterprise expression of a broader Institutional Intelligence Architecture (IIA), which treats AI as cognitive infrastructure for improving how institutions perceive, understand and decide.

Why the diagnosis matters

In many mature enterprises, the highest-return gaps are not capability gaps. The data largely exists. The models often exist. The analytics team is competent. What is missing is design, delivery and connection — Many of those gaps can be addressed without another major platform investment. The harder work is often redesigning the intelligence, its delivery or its place in the decision process.

That can be good news. An organization may be able to improve how it decides using capabilities it has already paid for. It also changes the AI roadmap conversation — from what technology can be deployed to which decisions are consequential, recurring, information-constrained and improvable with what already exists.

A practical starting point

EIA does not need to begin as a large transformation programme. A useful starting point is one consequential, recurring decision where the organization may already know more than it currently uses. The question is whether the decision is constrained by missing capability, poorly designed intelligence, ineffective delivery, or a lack of connection to the formal decision process. Addressing that specific gap first allows the enterprise to improve decision quality using much of the capability it already has, and then extend the same approach progressively to other important decisions.

The question worth asking

Enterprise AI success should not be judged primarily by the number of pilots, copilots or models deployed. What matters is whether the organisation can repeatedly turn what it knows into better judgment at the decisions that matter.

That starts with a diagnosis, not a purchase. The question is not, “Where should we deploy AI?” It is, “What should this enterprise be able to know and decide better than it does today — and which of the four gaps is standing in the way?”

Answer that for one consequential decision, and the organisation may discover that the missing ingredient is not another AI tool. It is the connection between the intelligence it already has and the decisions that determine performance.

Clients ask me this question perhaps more than any other. They’ve usually just come off a bad experience, either analytics stuck in IT’s backlog for months or analytics scattered across the business without anyone accountable for what it all means. My answer is always the same. Split it. IT owns the data engineering. The business owns the analytics. And you need one small team sitting between them to keep the whole thing from drifting apart.

That’s not a compromise position I land on to avoid picking a side. I’ve witnessed companies that went all in on one extreme or the other, and they end up in the same place. They have expensive dashboards sitting untouched and analysts who stopped trusting the numbers years ago. Give me twenty minutes with a client and I can usually tell which extreme they started from, just by looking at what’s broken.

Full centralization and full decentralization both fail the same way

When IT owns everything, security and governance are usually solid. You need people who actually understand networking and access control managing any connection to raw data coming out of your ERPs, TMS and CRM systems, not analysts who picked up security practices on the side.

But speed dies. Business analysts wait on intake forms and requirements documents that assume you can specify a dashboard’s full scope before you’ve ever seen the data move. Analytics doesn’t work that way. It’s one of those areas where you need multiple iterations to land on the right end state. You learn what you need by building something rough, using it for two weeks and rebuilding half of it. A team that has to file a ticket for every iteration will never keep pace with a business that changes its questions weekly. People who sit close to the business need the freedom to iterate as the tools mature, and that freedom disappears the moment every change has to clear an IT queue.

Flip it and hand analytics entirely to the business, and you get the opposite failure. I worked with a company this year that let every department build its own reports with no shared standards or governing body. Marketing had one set of definitions for a “customer.” Sales had another. Finance had a third, and every meeting turned into an argument about whose number was right. Total spend wasn’t being tracked either. As you can imagine, by the time they called me, their cloud analytics costs on Microsoft Fabric had already climbed past $20,000 a month, and the team couldn’t point to where it was going. They fixed it by building a small internal group, essentially a center of excellence, that owned the standards everyone else built on top of. CIO contributor Ranko Cosic’s April 2026 piece, “How analytics and AI are reshaping the boundaries of IT leadership,” draws a similar line, arguing that IT leadership builds the capability to analyze while analytics leadership builds the capability to decide. I’d add a third piece. Someone has to own the handoff between those two, or you get exactly the sprawl I saw at that client.

There are numbers behind this. In a survey of more than 2,400 CIOs, Gartner found that companies where IT and business leaders co-own delivery, what Gartner calls the “franchise” model, hit or beat their targets on 63% of digital initiatives. Companies where IT keeps sole ownership hit that mark on just 43% of initiatives. Only 12% of CIOs run a true franchise model today. That’s the whole argument in one number.

Adoption breaks when builders and users are different people

A few years ago, I got called into a large manufacturing company that had spent three years and an entire IT department building a dashboard platform meant for the whole organization. When I looked at usage, six people were opening those dashboards regularly. Six, out of thousands of employees. The tools worked fine technically. What broke was trust, and it’s a classic mistake. Trust and adoption begin when end users are part of the design process, or better yet, when they’re the ones building the tools.

That number stung, but it isn’t unusual. A BARC and Eckerson Group survey of 214 data and analytics leaders found average active adoption of BI tools sitting around 25%, a figure that had barely moved in seven years of tracking. Those companies bought good tools, but the adoption model wasn’t built to match. They skipped giving the people who’d use those reports a role in building them. Adoption climbs when the people using a report have a hand in shaping it, or better yet, built it themselves. That manufacturing client shifted from a fully centralized build to a decentralized one, with IT still owning the underlying data and business teams, together with us as consultants, owning what got built on top of it. They now have roughly 80% of employees using the tools weekly, on the same data, at the same company, with nothing changed but who owned the build.

I bring this up with every client who tells me they want “one IT team” running analytics end to end. A single team can own the pipeline. It can’t own every department’s judgment about what a useful report looks like, and trying to force that usually produces the same six-user outcome I saw at that manufacturer.

Standardization is the toll you pay for scale

There’s a fifth benefit to this structure that I didn’t lead with, but it’s the one that surprises clients most. It’s that alignment gets easier, not harder. Any organization of real size has a hundred project requests, a thousand small enhancements and a never-ending list of technical debt sitting somewhere. When all of that runs through one intake, owned by the seam team instead of scattered across five departments, prioritization stops being a fight and starts being a conversation. Time and time again, I’ve watched people set aside what’s good for their own team once they can actually see the whole list, the whole picture of what needs doing across the business. That only happens with one line of work to look at, not five competing ones.

This doesn’t come free. Splitting ownership this way comes with costs, and I tell clients about all three before they commit to the model.

First, the ramp-up is slow. If your organization has been running fully centralized or fully decentralized, the first few months of a split model will feel like you’re moving backward. You’re building shared data models from a standing start. You’re writing templates nobody has tested yet. None of it pays off immediately, and it takes longer than anyone wants to admit before the shared foundation starts paying for itself.

Second, coordination gets harder. Running one IT team that reports up a single chain is simpler than coordinating a business analytics team and an IT team that each report somewhere else and only share a dotted line into governance. You’ll spend real time in rooms aligning people who don’t share a manager.

Third, standardization itself is a hard sell early on. People resist naming conventions and data model rules when they can’t yet see why those rules matter. I’ve sat through those meetings. It usually takes a few months before teams start seeing the payoff in shared resources and consistent numbers across departments, and until then you’re asking people to trust a process they can’t yet see the benefit of.

I still think the tradeoff is worth it. The alternative is a business that’s either too slow to answer its own questions or too scattered to trust the answers it gets. Every client I’ve seen commit to the split — security in IT, agility and ownership in the business, a small governing layer holding the seam together — has come out the other side with something that actually gets used. The ones that skip the governing layer end up back in my inbox a year later, describing the exact same $20,000-a-month problem with different numbers attached.

So, when a client asks me where analytics should sit, I don’t tell them to pick a side. Instead, I tell them to build the seam. Put someone in charge who speaks both languages, IT and the business, and give that person say over the standards. If you skip that part, you end up back where you started. Get it right, and it’s the difference between six people opening a dashboard and eighty percent of the company doing it every week.

California is setting a precedent for AI use in scenarios where workers’ jobs are at stake.

Governor Gavin Newsom this week signed the No Robo Bosses Act (SB 947), which bans employers from relying solely on AI-powered automated decision-making systems (ADS), also known as “bossware,” to discipline or terminate workers.

Introduced by Senator Jerry McNerney, the act is the first of its kind in the US. It is set to take effect on July 1, 2027.

While applauded by many, on a wider scale, No Robo Bosses raises questions about what adequate human oversight looks like in this age of AI.

“A machine can recommend, but a human must decide,” noted Frank Dickson of Dickson Research. “The hard part is defining what ‘decide’ means.”

Combating AI bias and ‘troubling’ errors

ADS platforms are becoming ever more prevalent in hiring, as they promise to speed up and streamline HR processes, maximize productivity, and reduce costs. According to reports, more than half of employers use ADS to help make decisions around restructuring and role planning.

But, McNerney and others contended, AI is prone to bias and misjudgment, and there are examples of ADS making “troubling” errors, including mistaken firings. Meanwhile, on-device “bossware” or “tattleware” employee monitoring and productivity tracking software could potentially be used in reprimanding or firing decisions.

AI recruitment tools have similarly come under scrutiny of late, with job seekers alleging that platforms like Workday discriminate based on age, race, and disability.

To combat these issues, the bill, SB 947, seeks to set guardrails around AI use in the workplace. The legislation mandates human oversight and verification when enterprises apply ADS tools, and employers must inform workers if they have used them when making decisions about their jobs.

Further, SB 947 prohibits the use of ADS and bossware systems that analyze personal information and behaviors to essentially predict how employees will perform or act in the future. And at a worker’s request, employers must provide at least one year of the data used by an ADS system to make a disciplinary, termination, or deactivation decision.

Enterprises found violating any of these provisions are subject to a $500 civil penalty per violation.

“Employers are devastating workers’ livelihoods and taking no responsibility for the callous decisions of this unchecked technology,” said Lorena Gonzalez, president of the California Federation of Labor Unions, AFL-CIO. “This is unacceptable. We need stronger guardrails to make sure there is human review and oversight of any decision made by a machine that impacts a worker’s job and paycheck.”

Promoting decisions based on context, evidence

Dickson pointed out that the law is narrower than its name implies: ‘No Robo Bosses’ sounds like a ban, but it is not. “The law does not keep AI out of the decision. It keeps a human in it,” he said.

According to the legislation, a human must corroborate the system’s output using the data behind it and other supporting information like performance evaluations, personnel files, work product, peer reviews, or witness interviews. If the reviewer finds the output inaccurate, incomplete, or misleading, the employer cannot use it, Dickson said.

“The test is whether the human checked the evidence and had the power to say no [to the AI’s decision],” he said, observing that a manager simply forwarding the bot’s verdict is a mail carrier, not a decision maker. In a sense, it’s like an instant replay in sporting events: The umpire watches the video and makes a judgment call, rather than just rereading the call from the field.

“What matters is that they examined the evidence, not just the conclusion,” Dickson said. An employee’s disciplinary or termination notice must disclose whether an AI system was used, and confirm that a human reviewed and corroborated the decision. Human accountability is the point here; an employer owns the final decision.

“Accountability can’t be shifted to the AI,” said Valence Howden, advisory fellow at Info-Tech Research Group. How it comes to its conclusions must be continuously assessed for bias, error, and drift. 

“The bot has no human compass for rationale, and context is defined by who controls its model,” Howden said. “Without context, the human has no impact on the end result, and, given the rate of failure here, there are many (legal and other) implications.”

What enterprises can take away from California’s example

The grey area in the bill is the phrase “primarily relies,” Dickson pointed out; it does not specifically define what that means. “A prudent employer may assume that if the system’s output started the conversation, the decision is in scope, and document accordingly,” he said.

Enterprises should consider five factors when developing a plan around discipline and termination, he said:

1. Inventory: Know which tools score, rank, or flag employees. McNerney’s office cites hundreds of “bossware” products on the market, and many enterprises may not know which ones their managers use.
2. Reviewers: Name who corroborates decisions, train them, and give them real authority to overrule the system.
3. Data access: A reviewer cannot corroborate what they cannot see. If a vendor cannot show the inputs behind an output, the tool may be unusable for these decisions. That condition belongs in the contract.
4. Records: Keep the evidence that the reviewer examined, as employees have the right to request the personal data used.
5. Notice: Build a plain-language, standalone notice template now.

Dickson said that this is an IT problem as much as an HR one.

“Corroboration requires that the inputs to every automated decision are logged, retained, and retrievable by someone outside IT,” he said. “That is an architecture decision, and the CIO makes it.” And, while the $500 penalty might sound small, larger exposure may come later during wrongful termination disputes in which “the algorithm said so” proves a weak defense.

Info-Tech’s Howden advised enterprises to identify their high-risk, high-human-impact scenarios and cases, clarify which decisions, activities, and actions AI can take, and tag those that require human validation and involvement. They should also look at the volume and scale of these types of action so that volume alone doesn’t become a challenge to human involvement.

This is AI governance at a foundational level, Howden noted. “AI shouldn’t be allowed to make irreversible or material decisions and changes without oversight,” he said.

Ultimately, this move may drive enterprises to actually understand the criteria for hiring and firing, and look for issues and biases in the way decisions are made before an AI exposes poor decision logic and removes critical people. “Legal implications are more likely to shape the direction,” Howden said, “especially with the disclosure requirement.”

Every technology professional working today owes their career, in part, to someone who took a chance on them. The software engineers, cybersecurity analysts and infrastructure specialists on our teams didn’t arrive fully formed and ready to perform. Someone hired them, trained them and gave them room to grow. That’s worth remembering now, because the tech talent pipeline is shrinking, and history shows it can take more than a decade to recover from a decline like this.

The pipeline is at risk on two fronts: fewer students are choosing to study computer and information science, and hiring managers anticipate weaker near-term demand for these graduates. This isn’t unprecedented. The computing profession has weathered two major talent declines in its short history, and each took more than a decade to recover.

After 15 years of growth, computing enrollment reverses

According to the U.S. National Center for Education Statistics, the number of computer science and information science B.S. graduates has grown steadily since 2010. A tech degree once meant a well-paying job and a career with a future, driven largely by increased demand for technology. That momentum now appears to be reversing across several regions of the world.

Research from the National Student Clearinghouse Research Center indicates that enrollment in CS and IS degree programs at U.S. colleges and universities fell by more than 8% in 2025, even as overall undergraduate enrollment grew by 1%. The trend is not confined to the U.S. According to BCS, the Chartered Institute for IT, the UK saw a similar decline, with 18-year-old UK students entering computing degree programs down 9% in 2025. In Australia, the decline appears even steeper. ACS/Information Age reports that the Australasian Conference of Tertiary Admissions Centres’ (ACTAC) January 2026 report shows a 21% decline in enrollment for IT-related degrees heading into 2026.

Three countries, three distinct education systems, one common outcome. What makes this notable isn’t any single data point but the swift, dramatic downturn across all three countries. If this were confined to one market, it could be dismissed as a local correction; however, a similar pattern across the United States, the United Kingdom and Australia at roughly the same time suggests a structural shift in how the next generation views a tech career.

What 1,200 tech leaders expect: Lower demand for graduates

If the problem were only fewer graduates, but hiring demand were strong, the situation would probably correct itself. Talent scarcity would drive up wages and attract more students. However, the demand side appears to be contracting as well.

In the second quarter of 2026, I surveyed more than 1,200 senior technology leaders across 53 countries and what they expected their organization’s hiring demand to look like five years from now for entry-level roles filled by graduates with bachelor’s degrees in computer science or information science. Respondents held titles including CIO, CTO, VP of IT and Head of IT. More than 6,600 surveys were sent to technology leaders via LinkedIn, resulting in a 19% response rate.

The results were sobering: 45% anticipated lower demand, 28% expected demand to remain the same, while 27% anticipated it to increase. (You can download a summary of the survey at https://www.impactfultechnologyleader.com).

Chris Caruso

This result was not limited to a specific country or region. Those expecting hiring demand to be lower in five years were in the majority across almost every country, industry and company size.

The reason, cited across every group, was the same: artificial intelligence. Leaders expect AI to automate much of the entry-level technical work, including routine coding, service-desk tickets and administrative tasks. This is the work where new graduates have traditionally begun their careers. The logic is that existing teams, aided by AI, can do more without adding entry-level employees.

Regardless of their responses to the survey question, many of the leaders noted that reducing the number of junior roles in their organization was problematic. They recognized that it would erode the pipeline for future senior talent and that recovery from this gap would take years.

We’ve seen this movie before

This is not the first time CS and IS graduate numbers have fallen. In the mid-1980s, universities were overwhelmed by demand for computing degrees and couldn’t staff their programs adequately. When computer science programs could no longer accommodate surging student interest, universities capped enrollment and tightened admission standards. The effect was dramatic: bachelor’s degrees in computer and information sciences fell sharply beginning in 1987. It was not until 2001, fifteen years later, that graduation rates recovered to their earlier level.

The second decline came in the early 2000s, in what might be called a perfect storm. The winding down of Y2K remediation, the bursting of the dot-com bubble and a rising wave of IT offshoring converged to shake confidence in technology as a career. Mass layoffs swept through IT departments and dot-com firms, and enrollment in computing programs fell once again. The resulting drop in tech degrees awarded began around 2005, and it was not until 2016, eleven years later, that graduation rates recovered to the same level.

The chart below from the U.S. National Center for Education Statistics depicts these two significant declines in graduates with technology degrees.

Chris Caruso

Is AI the new perfect storm?

If you map today’s forces onto that history, the parallels are hard to miss. AI-driven automation is creating a demand shock, declining technology enrollments are creating a supply shock, and growing skepticism about the value of a technology degree is creating a confidence shock. This mirrors the erosion of faith in the career path after the dot-com bubble burst.

What took three separate crises to unfold in the early 2000s is converging today into a single, self-reinforcing cycle: fewer students entering the field, fewer opportunities perceived to be waiting for them, and growing doubts about whether a technology career is still worth pursuing.

But the parallel to those earlier declines carries a warning, not a reassurance, and the difference is in how each one ended. The recoveries of 2001 and 2016 happened because demand never left. In both prior declines, the supply of graduates fell while the underlying need for tech professionals rebounded. That gap between shrinking supply and steady demand is exactly what refilled the pipeline: scarcity pushed up wages, wages pulled students back and the market corrected itself, however slowly. What makes today different is that supply and demand are falling together. If leaders are correct that AI will replace entry-level work, this is not a demand dip waiting to rebound, it is a demand replacement, with no scarcity signal to trigger the correction that saved the field twice before.

The most dangerous feature of a talent pipeline is its lag. The decisions made, or not made, over the next few years will not trigger a crisis next quarter or even next year. Their consequences will surface a decade or more from now, when today’s would-be entry-level personnel should have become tomorrow’s architects, technical experts and leaders.

By then, the shortage will already be baked into the pipeline. And that is not speculation. It is the exact pattern the historical record has already shown us, twice.

What is a technology leader to do?

It would be easy to read my survey results and conclude that the market will sort itself out. Nearly half of the IT leaders I surveyed plan to hire fewer entry-level computing graduates over the next five years. Many dismiss this: education will adapt, five years is an eternity and better tools will make new graduates more capable than ever. They may be right. But hope is not a workforce strategy, and the leaders best positioned five years from now will be those who treat this as a problem to solve, not a trend to watch.

The uncomfortable truth is in one respondent’s warning: “We will have to find a way to invest in new grads, or we will not have a pipeline of middle and senior talent later.” If every organization cuts entry-level hiring because AI now handles the routine work, our profession will slowly stop developing the senior engineers it will desperately need a decade from now, because senior people are simply junior people who were given room to grow. No single leader can solve this problem, but every leader can refuse to be the one who lets it happen to their organization.

That starts with treating early-career hiring as a strategic investment, not the first line item to cut. Set aside several junior roles intentionally as an investment in your future leadership, rather than as just headcount to cut in the upcoming budget cycle.

It also means redefining what “entry-level” even means. Survey respondents were consistent: the bar is changing. They want applicants with a strong portfolio over a strong transcript, demonstrable AI fluency over rote coding, and, in the words of one, “people who can ask the right questions” now that AI supplies the answers. Rewrite your junior roles and interviews around critical thinking and judgment, and recognize that a new graduate’s value now lies in growth potential and the ability to direct AI-assisted work, not raw output.

Finally, the talent pipeline begins with encouraging high school students to seriously consider a career in technology, and guiding them will take all of us. If history holds, many will steer away from computing if they believe it has no future. Before committing to an investment as large as four years of tuition, parents will point their children toward fields with steady or rising demand.

Technology leaders and their teams can cut through the hype and help students understand what a career in technology looks like in the age of AI. Through classroom talks and on-site job shadowing, they can give students a real chance to discover the opportunities computing offers. Through mentoring and hands-on, real-world projects, they can support STEM programs at both the primary and secondary education levels.

With the aid of other technology professionals and leaders, I have developed a directory of organizations that promote and support careers in computing across the globe. The directory, which can be found at impactfultechnologyleader.com, includes:

• Programs for grade school, high school and university students
• Support for working professionals, whether already in tech or breaking into it
• Groups serving those transitioning from the military, returning to work or navigating any other path
   

Every one of us in this profession got here because someone decided we were worth the investment before we had proven it. That decision was never really about what a junior professional could contribute on day one. It was a bet on who they could become. AI may change what that first job looks like, but it doesn’t change a fundamental truth: to become a senior technology professional, you first had to be a junior one. The leaders who understand that over the next five years won’t necessarily be the ones who predicted AI correctly. They’ll be the ones who understood that some risks are worth hedging against even when you can’t be certain, and that a talent pipeline, once broken, takes a decade or more to rebuild.

The question isn’t whether the pipeline is at risk; it’s what you will do to make sure it doesn’t break.

Taylor Paletta was glancing at two versions of the same customer-service interaction on her monitor. As director of support and digital success at the enterprise software company, Ninety, she could read the support chat in one window while watching the customer’s product session in another. The customer had already spent several minutes trying to solve the problem, including twice attempting the sequence the AI agent would eventually recommend.

The chat transcript alone looked reasonably positive and successful. The customer asked a question, the AI agent responded promptly and the case appeared to move toward resolution. Yet the session recording spun a different story altogether. The customer was being asked to retrace steps that had already failed, while the AI agent had no awareness of what they had done before opening the support widget. Both records contained accurate data; however, only the behavioral record explained the customer’s actual experience.

Paletta’s team addressed this apparent systemic issue by feeding behavioral session summaries into their customer support AI agent before the conversation begins, not after. The AI agent can now see what the customer did inside the product, where the process broke down and which steps have already failed. Moreover, when the interaction escalates, the human agent inherits the same context rather than reconstructing the story from scratch. Tickets with that behavioral context now resolve at 79%, six points higher than tickets without it.

A six-point improvement may not sound dramatic, yet it is a real gain tied to a specific change in how the work gets done, resulting in real revenue. Additionally, and perhaps more importantly, it illustrates a measurement challenge well beyond customer support. That is, many organizations know how much AI they have deployed, but they have far less visibility into whether AI changed the work or improved the outcome.

Indeed, MIT researchers examining U.S. enterprise AI deployments reported roughly $35 billion to $40 billion committed, while 95% of organizations reported no measurable return. The problem is that companies tend to measure what their systems make easy to count — licenses, logins, prompts, sessions and features activated. Then they use those measures as questionable proxies for value, not realizing or acknowledging that activity actually may be inversely related to value.

Customer service activity is not value

Customer service, as much as any business function, makes activity-versus-value distinction especially lucid. Common customer support AI applications don’t capture behavioral data and therefore can create more effort for customers and agents when issues are escalated. Applications informed by behavioral data, however, may produce fewer interactions precisely because they resolve more issues correctly the first time. Therefore, prompt volume or time in the application can be ambiguous measures. Sometimes, more customer interaction indicates more friction rather than more value.

This suggests distinguishing between different types of behavioral signals that show AI is merely available or being used versus signals that show work is actually changing:

1. Provisioning signals include seats purchased, licenses assigned and accounts activated, which tell you what the organization made available.
2. Engagement signals include logins, sessions, prompts and time in the application, which tell you that activity occurred. Both are useful operational measures; nonetheless, they offer limited evidence about whether the service improved.
3. Displacement signals go further by showing which human steps disappeared, which handoffs were eliminated and whether AI output survives into the finished work.
4. Friction signals capture rework, repeat attempts, abandonment, escalation, rage clicking and silent workarounds.

Displacement and friction-related measures are particularly aligned with economic value because they reveal what changed in the process and what the customer (or employee) had to do differently as a result.

At Ninety, for example, AI-generated session summaries now arrive inside the agent’s ticketing workflow. Previously, an agent handling a difficult case might open another application, scrub through a session replay, locate the point of failure and then reconstruct the story while the customer waited. With behavioral context already attached to the ticket, much of that work can disappear. Consequently, the organization can measure fewer applications opened, fewer handoffs, shorter resolution paths and less manual reconstruction rather than merely reporting that an AI feature was used.

Behavioral data changes the conversation, literally

Behavioral data does more than make the AI more efficient; it changes what the AI knows about the customer at the moment a decision has to be made. In service, this becomes important because a correct answer can still produce a poor experience when it arrives without context. Paletta’s team, for instance, found that some customers tired of AI conversations even when the answers were technically accurate, but the interaction felt cold, repetitive or unnecessarily difficult.

“Traditional adoption metrics have little to say about that kind of problem,” says Scott Voigt, co-founder and CEO of Fullstory. “Behavioral signals, however, can reveal repeated attempts, hesitation, abandonment, rage clicking or a pattern of moving back and forth through the same workflow.”

These types of signals can then trigger a different response, including routing the customer to a person before frustration compounds. In other words, behavioral data becomes part of the service logic rather than merely another source for retrospective reporting.

Paletta describes some of these branching experiences as a “choose your own quest” model, in which observed behavior influences the next path, and AI handles the decision until human intervention becomes appropriate. Furthermore, because the path is based on what customers actually do rather than what designers assumed they would do, the organization can refine the experience continuously as new patterns appear.

Measuring the work, not the worker

There is, however, an important governance issue. Once executives realize that conventional AI metrics reveal too little, the reflex may be to monitor individuals more closely. That approach can easily distort the very behavior the organization is trying to understand, since employees who feel personally tracked and scored may experiment less openly, conceal failed attempts or move work into channels that are harder to observe.

A more useful unit of analysis is generally not the employee but the work: the workflow, journey, handoff or decision.  Instead of asking how many prompts a particular support agent entered, ask where agents still have to reconstruct context manually, which cases require repeated escalation, where AI output routinely needs correction, and whether someone’s effort is rising or falling. Similarly, rather than judging people by an isolated session, look for aggregate patterns showing where people overall stall, repeat themselves, abandon a path or seek human help.

Moreover, this approach tends to produce better data because the purpose of the instrumentation is easier to defend. Instrumentation intended to improve a process is fundamentally different from instrumentation used to grade an employee; once people begin optimizing their behavior for the score, the measurement itself corrupts the signal. The former can reveal where the service design is failing; the latter may encourage people to change their behavior simply to “game the system.”

Starting the customer support journey before they do

One of Paletta’s more interesting measures extends the same thinking beyond Ninety’s own support environment. Customers now frequently consult public AI models before they visit a company’s support site. Consequently, an external system the company does not control may already be functioning as an informal first layer of customer service, interpreting company content and shaping the customer’s expectations before a formal support interaction begins.

So, the Ninety team compiled the company’s help center and blog content into JSON, tested how frontier models such as ChatGPT and Gemini alone answer questions about the product, and built a scoring system for answer quality. The scoring system helps the team identify where Ninety’s source material produces weak answers so they can improve the underlying content.

This expansion of what behavioral data includes not only what users do inside the sanctioned AI application, but also the observable choices they make around it, e.g., whether they abandon one channel for another, whether they repeatedly seek clarification, whether they bypass an AI agent and whether they arrive at support after already trying to solve the problem elsewhere. Indeed, those behaviors often reveal dissatisfaction or disengagement earlier than a survey, complaint or renewal discussion.

The business case for behavioral data

Return, then, to the customer who had already tried the same troubleshooting sequence twice. The support transcript could reasonably have been counted as a successful AI interaction, and a conventional customer service analysis dashboard might have added another prompt, another active user and another resolved conversation to its totals. Yet those measures would still have missed the fact that the customer was repeating failed work because the AI lacked behavioral context.

The customer who had already attempted the same troubleshooting sequence twice could easily have registered as an AI success: another active user, another prompt, another conversation apparently resolved. Yet almost every conventional measure would have missed the part that mattered — the customer was doing unnecessary work because the AI lacked the context to know better.

Behavioral data connects what the AI did to what happened around it, what the customer had already attempted, what the employee no longer had to do, where friction disappeared or compounded, and whether the process itself improved. For CIOs trying to establish the business value of AI, behavioral data answers “What happens better, faster, different or not at all because of AI?” rather than simply “How much are people using AI?”