Museum IT departments have traditionally served as support functions to manage security and systems. But the National Museum of Korea goes further, identifying and pursuing AI initiatives to preserve cultural heritage, broaden its use, and improve the visitor experience.

The National Museum of Korea uses technology to expand the possibilities to preserve and display physical artifacts, and its digital museum division (DMD) plans and oversees that transformation. A dedicated team responsible for digital strategy and content took shape in 2019, and in 2020, the museum informatics division adopted its current name.

“The director at the time placed great importance on investing in technology and felt we needed a department that could bring a strategic direction to work that had been carried out separately,” says Choi Seungae, former DMD head. “The digital museum division was created as a way to prepare for the next generation.”

A cultural transformation

In just over five years, the DMD has delivered a range of services, including AI guide robots, smart kiosks, and multilingual and sign language services. It’s also developed immersive experiences that use large-scale imagery and sound to recreate cultural heritage.

More recently, its focus has shifted toward data. The aim is to move beyond storage and preservation, making data previously confined to the museum available for wider use. Physical artifacts face restrictions on movement and display because of security concerns and risk of damage. Digital data can help overcome those limitations.

One example is an immersive content project featuring the Denny Taegeukgi, Korea’s oldest surviving national flag, undertaken last year to mark the 80th anniversary of Korea’s liberation.

The project displayed images of the 130-year-old flag once held by Owen Denny, a diplomatic adviser during the late Joseon period, on a large outdoor media screen in front of a department store in central Seoul.

At first glance, the project might appear to have involved little more than photographing an artifact and displaying it. But it required highly detailed data since enlarging existing photographs would’ve produced visible pixelation on such a large display.

Therefore, the division created a new, ultra-high-res dataset containing 10.8 billion pixels at a two-meter scale from the original flag, which measures approximately one meter. Precision scanning captured even the fine texture of both sides of the fabric.

Plan of action

Earlier this year, the museum was selected for the government-led K-Science initiative, through which it plans to pursue data projects beginning in 2027. The cross-ministerial R&D program combines Korea’s historical, cultural, and environmental assets with advanced science and technology to create economic, social, and cultural value.

Through the initiative, the museum will digitize over 2.5 million artifacts and develop technologies to expand the commercial potential of Korean cultural assets. The central goal is to connect the entire process, from archaeological exploration and preservation, to digitization and content development.

The resulting technologies are expected to help overcome technical limitations in detailed surveys of ancient tombs, for example. In preservation and collection management, AI could also automatically control temperature, humidity, and lighting in museum storage facilities.

Never a single right answer

Data presents challenges across both private and public sectors. For museums, however, they’re particularly complex because artifact data contains layers of interpretation, facts, and history.

Consider an AI system designed to answer questions about a particular artifact. It needs data to support its responses. But what should it say if records from Baekje and Silla, two ancient Korean kingdoms, offer conflicting accounts of the same event. Ideally, it would adequately represent different perspectives, but that’s not always possible since the same artifact can tell different stories depending on who used it, when, and for what purpose.

Choi says current LLMs don’t adequately account for these layers of context. When users ask for an accessible explanation, models can produce answers that overgeneralize or oversimplify. Reducing an event with multiple interpretations to a single sentence can obscure or distort its context.

But ensuring accuracy is another challenge. According to Choi, historical discrepancies introduced during initial training can prove difficult to correct, even when a model is subsequently asked to revise them.

The DMD is, therefore, concentrating on building data with clearly identifiable sources. The aim is to let users verify if an AI response is based on material from the National Museum of Korea to assess its reliability.

With these characteristics of artifact data in mind, the division is working with external experts to redesign its database structures around both the nature of the artifacts and the purposes for which people use the data.

Upgrade with AI

Where earlier databases focused on registering and managing objects, the new approach seeks to capture their different meanings and relationships while making relevant materials easier to find. Images, 3D data, videos, and related literature previously scattered across separate records are being connected. Metadata describing file sizes, formats, and how the data was created are also being expanded to support reuse so linking different names for the same artifact makes searching easier, for instance.

“Cultural heritage can’t be standardized like manufactured goods,” Choi says. “We need to organize and structure the data and materials we’ve accumulated in ways that reflect the character of our artifacts, while at the same time, identify connections between them. Once that foundation is in place, curators and external users like content creators, researchers, and educators will be able to find and use materials suited to their needs.”

Leaving room for discovery

After nearly two decades spent researching artifacts and developing exhibitions, Choi didn’t expect to find herself working in the DMD. Now director of the Jeju National Museum, she looks back on her digital work where there were many times her previous experience alone couldn’t guide her decisions. Exhibitions have clear opening and closing dates, and experience helps curators judge what further research and preparation will improve outcomes.

Digital projects offer fewer such reference points, however. It can be difficult to assess how far an initiative has progressed, or anticipate how emerging technologies will affect work already underway. Even so, her expertise provides a foundation to decide where change should lead, and help propose ideas to assess what new tech serves the museum’s purpose.

“Whether it’s curatorial or digital work, I hope the many things we do at museums can make a small contribution to help visitors think for themselves and arrive at their own insights,” she says.

The most expensive quantum mistake a CIO could make today may not be investing too early. It may be investing in the wrong capabilities, for the wrong reasons, without understanding the architectural and economic consequences.

Over decades of leading enterprise technology, architecture, modernization, and innovation in complex, highly regulated environments, I have seen a recurring pattern: technological enthusiasm advances faster than institutional readiness. Capital gets committed. Platforms become entrenched. Dependencies multiply. Business value remains difficult to demonstrate.

Quantum computing risks repeating that pattern, but with an important distinction: The cybersecurity consequences demand action today, while the timing and economics of broader commercial quantum advantage remain uncertain.

That is the strategic tension CIOs must resolve.

Quantum readiness and preparedness is not a race to acquire qubits. It is a discipline of protecting enterprise trust, preserving strategic options and directing scarce capital toward demonstrable value.

The fundamental question is no longer whether quantum computing deserves executive attention. It is whether CIOs and enterprises can distinguish what must be protected now, what deserves experimentation and what should remain an option rather than a financial commitment.

Two quantum clocks. One enterprise balance sheet

Quantum presents two fundamentally different timelines to a CIO.

The first is the security clock.

In August 2024, the National Institute of Standards and Technology (NIST) published its first three finalized post-quantum cryptography standards, establishing practical mechanisms for protecting information against anticipated quantum-enabled threats.

This is critical because cryptography is not an isolated cybersecurity component. It underpins identities, financial transactions, digital signatures, software integrity, communications, connected infrastructure and trusted business relationships.

A sufficiently capable future quantum computer could compromise certain widely deployed public-key cryptographic methods.

The October 2026 U.S. Government Accountability Office (GAO) report, Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, reinforces the urgency. None of the 24 federal agencies examined had fully addressed all three assessed preparatory practices for migrating vulnerable cryptography.

The lesson extends beyond government: you cannot migrate cryptographic dependencies you have not discovered.

The second is the commercial advantage clock.

Quantum computing may eventually offer meaningful advantages in selected areas of chemistry, materials science, simulation and optimization. But promising research does not automatically translate into repeatable enterprise economics.

IBM’s published quantum technology roadmap targets a fault-tolerant quantum system in 2029. That is an important technological ambition, not a guaranteed date for widespread commercial advantage.

These two clocks should not share the same investment assumptions.

Security readiness is justified by exposure and risk tolerance. Commercial adoption must be justified by demonstrated advantage and economic returns.

Confusing the two creates either dangerous underinvestment or speculative overspending for the CIOs.

Architecture before acquisition

The enterprise architecture challenge is more consequential than the quantum procurement question.

For CIOs, post-quantum preparation begins with initial understanding of where vulnerable cryptography exists across their enterprise, how it supports critical business services and whether those dependencies can be changed without destabilizing operations.

For example, consider a globally distributed financial institution.

Cryptographic dependencies may span payment platforms, customer identities, authentication services, certificates, mainframes, cloud environments, third-party APIs and decades of retained information.

Replacing an algorithm is not necessarily equivalent to replacing a library.

Some changes affect protocols, hardware security modules, certificate lifecycles, application compatibility, vendor contracts and operational resilience.

This demands cryptographic agility: the ability to replace or adapt cryptographic mechanisms without rebuilding the enterprise.

The same architectural discipline applies to future quantum workloads.

Enterprises should favor modular integration, well-defined interfaces, workload portability and interoperability across classical computing, high-performance computing, AI and emerging quantum services.

Quantum will not make classical computing obsolete. The more credible architectural direction is selective integration where a quantum capability demonstrably improves a specific computational outcome.

The architectural objective therefore is not quantum dependence. It is quantum optionality.

An enterprise should be able to adopt a useful breakthrough without surrendering control of its technology economics or becoming captive to a single provider.

The missing equation: Quantum workload economics

The quantum conversation becomes strategically meaningful when CIOs stop asking what a quantum computer can theoretically perform and start asking what business outcome it can improve.

The OECD’s 2026 research, Building Business Readiness for Quantum Computing, identifies barriers including technological immaturity, uncertainty surrounding business applications, access and training costs, and shortages of specialized expertise.

These are not simply engineering obstacles. They are capital allocation constraints. This means that a quantum experiment may demonstrate technical progress while failing to establish commercial value.

For example, a proposed optimization workload should be evaluated against competitive classical algorithms, realistic datasets, operational constraints and the full cost of execution.

The comparison must include more than processing time. It should consider problem preparation, data movement, orchestration, error mitigation or correction, integration, specialized talent, assurance and recurring operating expenses.

Even an impressive laboratory result may offer little economic benefit if the end-to-end enterprise workflow becomes slower, costlier or less dependable.

I would therefore introduce a more demanding investment metric: Cost per Trusted Quantum-Enabled Business Outcome.

This proposed measure evaluates the total attributable cost of achieving a validated business result, including the controls necessary to make that result operationally acceptable.

The denominator is not the number of quantum circuits executed. It is the number of useful, verified business outcomes delivered.

Where no defensible quantum advantage exists, the responsible decision may be to continue using classical computing.

That is not technological conservatism. It is capital discipline.

Introducing the quantum capital discipline framework

I propose a six-dimensional executive framework for separating quantum preparedness from quantum speculation.

1. Exposure: What must we protect? Identify vulnerable cryptographic dependencies, long-lived sensitive information, critical services and contractual or regulatory obligations. Prioritize remediation by business consequence, not technology fashion.
2. Relevance: What problem warrants quantum? Establish a specific business problem whose computational characteristics plausibly justify quantum investigation. Scientific curiosity alone is not an enterprise investment thesis.
3. Advantage: What evidence proves improvement? Demand reproducible comparisons against strong classical alternatives. Evaluate solution quality, performance, operational constraints and independent validation.
4. Architecture: Can we adapt without lock-in? Assess portability, integration complexity, vendor concentration, reversibility and the ability to change technology choices as the market evolves.
5. Economics: What is the full cost of value? Measure total lifecycle costs, opportunity costs, talent requirements and credible returns. Distinguish research expenditure from production investment.
6. Authority: Who decides to advance, defer or stop? Assign accountable decision makers, measurable milestones, investment thresholds and explicit exit criteria. Together, these dimensions form the Quantum Capital Discipline Framework.

Its governing principle is straightforward:

Capital follows evidence. Architecture preserves options. Governance owns consequences.

Importantly, this framework does not subject essential cryptographic remediation to the same commercial-return requirements as speculative quantum workloads. Security obligations and innovation opportunities require different investment justifications.

What boards should demand from their CIOs

Quantum strategy should enter Board discussions through enterprise risk, capital allocation, resilience and competitive positioning — not promotional demonstrations.

I would encourage directors and executive committees to demand answers to five key questions:

1. Which critical business services and information assets face material quantum-related cryptographic exposure?
2. Can we modernize vulnerable dependencies without unacceptable operational disruption?
3. Which proposed quantum applications outperform credible classical alternatives?
4. What evidence would justify expanding, delaying or terminating quantum investments?
5. Who is accountable for the financial, security and architectural consequences?

These five questions create a practical governance boundary between preparedness and speculation. They also expose a broader institutional weakness: enterprises often approve emerging technology investments without establishing the conditions under which those investments should be reconsidered.

Quantum requires a different approach.

Investment decisions should be revisited when technical capabilities, benchmark results, standards, security exposure or business economics materially change.

Boards should insist on measurable progress but avoid manufacturing artificial deadlines for breakthroughs nobody can reliably predict.

The CIO’s next mandate: Preserve the freedom to act

Quantum computing will not transform every industry simultaneously, deliver equal advantage across workloads or reward every early investor.

Some enterprises may eventually realize significant value from specialized quantum applications. Others may encounter quantum’s most immediate consequences through cryptographic modernization, technology dependencies and the protection of long-lived information.

Both outcomes demand leadership today.

The CIO’s responsibility is not to predict which quantum architecture will prevail or which vendor will dominate. It is to ensure that today’s decisions do not compromise tomorrow’s ability to compete, adapt and protect enterprise trust.

That requires investment discipline, architectural foresight, credible experimentation and accountable governance.

The next quantum advantage may belong not to the enterprise that invests first or spends the most, but to the one that knows precisely when to act, where to invest and when to walk away.

Quantum readiness is not measured by the technology an enterprise owns. It is measured by the strategic freedom it retains, the risks it responsibly reduces and the business value it can demonstrably create.

That is the difference between quantum enthusiasm and quantum leadership.

Quantum leadership is not about predicting when the future arrives. It is about architecting the freedom to embrace it, exercising the discipline to invest in it and preserving the authority to walk away when promise fails to become value.

AI is writing more code than ever. Software specialist Sonar’s 2026 State of Code Developer Survey, based on more than 1,100 professional developers, found that 72% of those who’ve tried AI coding tools now use them every day, and that today, AI now accounts for 42% of committed code, a number that’s expected to reach 65% by next year.

But while developers embrace AI-enabled coding services, many professionals are uncertain about how their businesses will cope with this influx of AI-generated code. Sonar’s research additionally discovered that 96% of developers don’t fully trust it, and only 48% always verify it before committing.

In fact, 38% of developers told the researchers that reviewing AI code requires more effort than analyzing code written by human colleagues. That’s a pattern recognized by Tim Chilton, a managing geospatial consultant at UK mapping agency Ordnance Survey (OS). “There’s truth in the headlines that AI can get carried away, and developers spend more time fixing the code that’s been created than not,” he says.

While that’s not a pattern he sees at the OS, Chilton says his organization is cautious about how developers use AI coding tools, and conversations with other digital leaders suggest a similar approach. AI-enabled coding is indeed almost ubiquitous, and it can allow developers to reach new, higher levels of productivity, but more doesn’t necessarily mean better code.

To ensure that such coding services produce business benefits, CIOs must take control of the development process. They should exploit agents carefully, set professional responsibilities, and establish guidelines, policies, and organization-wide training.

Exploiting the agents

Snowflake co-founder and president Benoît Dageville suggests there are two ways to view AI-powered coding. One is the scary way, where AI takes over your tasks without human input. The second is the efficient way, where AI helps you do the same things as before, but at a fraction of the cost. He’s a big believer in the latter, both for himself and his teams.

“The route depends on the organization; their application of AI coding depends on their priorities,” he says. “However, I hope that overall, AI will have a positive effect on humans. I’m using AI every day to code, and if I compare myself to one or two years ago versus now, I’m more efficient and productive, but I’m also writing five times more code.”

Steve Lucas, CEO of integration technology specialist Boomi, also notes the increase in output. He quotes research that suggests 4% of GitHub public commits are already being authored by Claude Code. That proportion is expected to rise to 20% of all daily commits by the end of this year. Staff at Boomi already use AI tools to produce more code.

“We’re writing 10 times the amount today than we did two years ago,” says Lucas. The increase in AI-enabled coding is so significant that he’s spoken with Boomi chief product and technology officer Ed Macosky about goals for the proportion of self-modifying code.

“I believe AI should recursively modify 80% of a software organization’s code,” Macosky says. “Infinite improvement is demanded. If AI is extraordinarily good at breaking security protocols, the only way to keep up isn’t the kind of accordion model of human code design. AI use must be linear in scale and continuous.”

Crucially, Lucas suggests using AI to check and modify that AI doesn’t mean coders go away. “In fact, I think we’ll need more engineers, not fewer,” he says. “We need these professional experts to ensure the quality of the code that’s written.”

At OS, Chilton uses Coco, Snowflake’s coding agent. The tool does as much as 90% of a development task that he would otherwise complete from scratch. “It’s taken an hour to finish, instead of weeks or never,” he says, reflecting on the power of AI coding services.

However, the tool’s influence is carefully constrained. The agent doesn’t work in isolation, and Chilton checks its output in detail. He says all organizations need a similar process and should value experienced professionals who can use AI coding tools effectively.

“If you’re giving a tool to someone who isn’t capable of checking an agent’s work, as a digital leader, you run the risk of putting too much faith in AI just running with its output,” he says. “I think that’s a big risk, so there’s still a need for experienced developers.” 

Setting clear responsibilities

While placing humans in the loop can help ensure AI-enabled code is safe and effective, developers shouldn’t be weighed down by their new management responsibilities.

Gill Haus, CIO at Chase, the consumer banking arm of JPMorgan Chase & Co, says AI coding benefits can only be realized when agents are introduced with a strong focus on automating supporting technology and processes, which reduces the need for too much human input.

“If you have 12,000 engineers, they can write 12,000 engineers’ worth of code in a day,” he says. “If those 12,000 engineers have agentic technology, they can write much more. But if you don’t have automation left to right with confidence, you create more manual processes. You can’t move as quickly since there are only so many humans you can put in the middle.”

Haus says Chase never releases services in production that don’t pass its high bar for quality and security. Strong engineering practices, pipelines, and architecture, plus a tried-and-tested approach to automation, can help ensure AI coding produces solid outputs without a burdensome amount of human intervention.

“We’re focused on effective automation so we’re able to unleash this technology safely and effectively,” he says. “This is something many other companies should be focused on if they aren’t already, because otherwise you can’t keep up with the pace of change.”

François-Xavier Pierrel, group chief data and ad tech officer at French TV network TF1, is another digital leader who says maintaining control as AI writes more code means keeping the human in the loop in a clearly defined manner. His team documents agentic processes using Atlassian project management and collaboration tools, such as Confluence.

Pierrel says policy management is crucial as the agentic transformation gathers pace.  One key step is ensuring professionals who use agents conform to internal standards. Smart businesses set policies that state clearly when staff can explore an agent, delegate work to it, or release it in production.

“We don’t have hundreds of agents deployed yet,” he says. “But the moment you reach a certain level of volume, if you don’t have compliance and policies in place, AI becomes a critical mess, and then it can be disruptive in a negative way.”

Building strong foundations

Kirsty Roth, chief operating officer at content and technology specialist Thomson Reuters, agrees digital leaders must be proactive. Her firm’s explorations with models and agents suggest that AI can help with time-intensive coding processes, such as writing. This capability means her organization carefully considers the roles people fulfil.

“In the last 12 months, we’ve put lots of thought into where we’re seeing benefits,” she says. “It’s great AI can do some of the coding work, but what does that mean for people’s jobs? We used to have thousands of engineers. Do we now need more architects or product people?”

Roth refers to security. While cyber is always a priority for Thomson Reuters, the firm dedicates significant resources to controlling threats in the AI age. Developing high-level development and security skills requires a concerted effort. Yet Roth says ensuring people have the right skills to manage AI is in many ways a familiar IT trend.

“All this effort is no different than digital, cloud, mobile, social, or other big tech trends,” she says. “They all take several years to have an impact as the initial hype comes, and then you’ve got to work through the reality and think about how you upskill people for the new world.”

Crucially, coding is no longer the sole preserve of the software developer. AI coding tools make it much easier for non-IT professionals to vibe code applications. Tal Carmi, CIO at technology specialist WalkMe, says non-developers can create useful tools. However, effective outputs rely on a careful balance between enablement and guidance.

He adds that most of these employees don’t need in-depth capabilities, such as a database or a content delivery network. Instead, non-IT staff require a dedicated place to upload their products. WalkMe’s engineering specialists ask key questions to ensure their outputs are safe, considering credentials and potentially problematic packages.

“You need to add guardrails,” he says. “A lot of the work for in-house engineers is shifting from building to testing. The people who aren’t coders don’t necessarily have security in mind.”

The key takeaway, suggests Emmanuel Frenehard, chief digital officer at biopharmaceutical giant Sanofi, is that digital leaders must help professionals feel comfortable. Successful digital leaders ensure the business generates value from agents, and his firm is helping its staff, particularly its developers, to embrace these tools.

“I genuinely worry for professionals who don’t use AI to code, because in five years, they may not have jobs,” he says. “So we’re guiding, coaching, and training them, but people must take the journey. The train has left the station. You can decide to be on it, or just look at it.”

Following the IT and tech hiring boom during the Covid-19 pandemic, companies made space for AI initiatives that resulted in increased layoffs. But new data reveals that some IT hiring trends are starting to turn around.

Pay in the most AI-exposed occupations grew around 46% since 2021, compared to only 25% for jobs in the least-exposed category, according to the Dice Tech Sentiment report. The data reveals this gap began to grow in 2024 and continues to grow as job postings rebound after several rough hiring years.

As organizations begin to realize AI initiatives and investments, they’re now looking to fill their ranks with specialized skillsets, and it’s driving increased compensation. AI has changed the skills businesses need, and 84% of executives report they currently struggle to find specialized local talent while 64% say they feel unprepared for ongoing disruption, according to data from a 2026 report from Globalization Partners.

In a few short years, AI has caused multiple swings in tech hiring. As organizations understand the skills they need to realize AI visions, hiring, for now, appears to be on the upswing for candidates and jobseekers, with more competitive offers. On the employee side, as AI transforms job roles and business functions across every industry, there are, however, increased reports of burnout and a widening gender gap.

Salary boost for specialized skills

AI is currently creating some of the fastest growing and highest paying opportunities in today’s labor market, according to LinkedIn Research. Data reveals that AI job postings have doubled in 2026 from 2023, with the average job listing around $177k in compensation for AI roles, compared to $80k for non-AI roles.

Salary offers and benefit packages have again become more competitive, with 72% of employers saying they’re increasing compensation budgets to attract and retain top talent. Additionally, 65% of tech leaders said they’re offering salaries above their planned range, with 87% stating the top reason being a need to secure candidates with specialized skills, according to Robert Half.

Tech leaders are also seeking specific skills, with 92% acknowledging internal plans to offer higher pay for relevant AI skills. Across every industry, 42% of all business leaders say they’ll pay more for AI-related experience compared to other general tech skills.

Additionally, pay transparency, once relatively taboo in the hiring process, has now become normalized in hiring with 96% of organizations reporting they either already share compensation or plan to soon. Sharing compensation on job postings has several benefits including improving the quality of the candidate pool, more efficient salary negotiation, and a reduced time to hire. Business leaders seem to recognize the benefits, with 67% of employers saying their company takes pay transparency beyond legal requirements, offering more information than is legally required, adds Robert Half.

AI accelerates employee burnout

As daily AI use quadrupled over the past year, burnout doubled and confidence in tech’s long-term future dropped from 80 to 60%, according to Dice. The data reveals around 74% of employees say they plan to change employers in the next year, and 55% say they’re actively job searching, despite only 41% saying they believe they’ll find a better position.

Dice also reveals nearly half of all employed tech professionals report feeling burnout, with around 25% describing themselves as very burned out. And among those reporting burnout, tech and AI professionals express the highest rates.

High levels of burnout can cost companies lost productivity and hurt bottom lines. In 2025, a staggering 10 trillion was estimated to have been lost globally due to disengaged and burnt out employees, according to Globalization Parters. If companies are losing profits through employee burnout, costs of AI investments need to be greater priorities when planning AI initiatives.

AI is meant to boost productivity and efficiency, but Dice says that while speed without guardrails might create advantages for some, it’ll create anxiety for others. Similar to pay transparency, organizations must practice AI transparency. Yet fewer than half of employers report having formal AI policies in place to govern or dictate its use in the enterprise, adds Dice. 

AI gender gap emerges

While there’ve been efforts to move the needle on gender diversity in IT and tech over the years, AI has revealed another gender bias the tech industry will need to contend with to reach gender parity. Tech has always struggled with gender equity despite concerted efforts to make IT and STEM jobs more appealing to women.

Unfortunately, despite efforts to create cultural shifts, AI has once again widened the gender gap in tech. According to further data from LinkedIn Research, women only accounted for 26% of AI hires in the US in 2025, compared to 50% of hires into non-AI roles. And of course, the numbers drop more at the C-suite level, where only 13% of AI leadership at AI companies is held by women.

AI roles have also largely gone to candidates with college degrees with 91% of AI workers holding a bachelor’s degree or higher, moving up to 95% for C-suite and director level positions, so there’s an additional lack of opportunity for those women without a traditional education. Tech and IT leaders will need to avoid falling back into the old hiring patterns that initially caused an absence of representation in tech.  

Plus, there’s an emerging gender gap on AI sentiment, with women holding more negative views than their male peers when asked about the impact of AI over the next 20 years, according to data from Pew Research. Women were more likely to say they felt negatively about the impact of AI on themselves personally (33%) and on society overall (43%), compared to 27% and 36% of men who said the same, respectively. Inversely, only 11% of women said they felt positively about AI’s impact on society, while 22% of men said they felt positive.

Women are also more likely to say AI is advancing too quickly — 68% compared to 58% of men. These opposing sentiments might contribute to the overall gender gap in AI roles, as women show more hesitation and caution with AI tools compared to male colleagues.

There’s no point building your own agentic AI stack for a non-core function when a vendor already has a product ready to go that meets your needs. For non-tech companies in particular, building from scratch can take time, money, and expertise they don’t have.

Take for example, Fertitta Entertainment, with more than 600 Landry’s restaurants and the Golden Nugget hotel and casino. After the pandemic, the company had problems adequately staffing its call centers, says its director of contact center operations Brian Jeppesen. “The agents didn’t want to come back,” he says.

The virtual assistants didn’t work because the user experience was bad, and with the incoming call volume, 40 to 50% of them were abandoned.

“Everybody wants AI, but nobody wants BS,” Jeppesen says. “I talked to my CFO. This is what we’re abandoning. This is the potential revenue we’re losing. I can’t throw bodies at it anymore.”

Agentic AI has upped their game for the virtual assistants. Instead of only answering simple questions like check-in hours, it allows the company to connect APIs and carry out more complicated tasks, like making reservations.

“My abandonments fell to under 10%,” says Jeppesen. “From waiting 45 minutes to an hour, they can get their questions immediately answered, or immediately transferred and taken care of.”

And turnover went down. Call centers typically see 100% turnover, says Jeppesen. Not because everyone quits, but because the bottom 25% quit and need to be replaced over and over again.

Now that bottom tier doesn’t have to be rehired, while the people who stay are the most knowledgeable. “They give a better experience for my customers,” he says. “And it reduced my attrition by 50%.”

Forrester did a total economic impact study for the specific vendor that Fertitta used, PolyAI, and the ROI came back at 391% over the course of three years, with a payback period of less than six months.

Jeppesen says he reviewed his own numbers and found that the automated reservations system alone brings in 3,000 reservations a month. “That’s $600,000 in revenue a month for us without the need to speak to an agent,” he says.

Next, Fertitta plans to expand it to handle to-go orders and web chats. There are also opportunities for agentic AI on the technical help desk, Jeppesen says.

Agentic AI on the menu

Fogo de Chão, a Brazilian restaurant chain with around 120 locations, is also deploying agentic AI in small, focused use cases, and sees ROI with some of the projects.

For instance, it deployed virtual call center agents from PolyAI, and saw positive ROI from day one since there were no significant up-front costs or usage-based pricing. After several months of testing and small-scale pilots in 2025, the system has been rolled out across the US, with 100% of calls now being answered instead of up to 25% being dropped, and a 10% increase in total bookings that wouldn’t have happened otherwise, says Michael Breed, the chain’s chief marketing officer.

“If we compared it to a media channel, it’d be twice the ROI from other media channels,” he says. “It’s almost like another customer acquisition vehicle.”

The company is also building agentic workflows for its team members.

“We’ve identified jobs that are very repeatable and time-consuming, and we’re training agents to take those tasks,” he says. These are low-risk jobs, like proofing menus or other text, or replacing manual processes, such as pulling data from one system into another that had no automatic integrations.

“The agent does a great job bringing in the data, then the human in the loop can inspect it,” says Breed. “Is it getting classified right? Is it getting to the right places? And when guests are dissatisfied, can we make it better?”

Built for SMBs

For smaller companies in particular, off-the-shelf agents make the most sense. AltaClaro, for example, builds training simulations for lawyers, and counts more than 100 of the top 200 US law firms as customers, all with just 10 employees.

One product is a deposition simulator, says CEO Abdi Shayesteh, a completely agentic, voice-based platform.

“It’s a fully simulated environment that creates the experience of doing the deposition,” he says. “Different agents play the role of the witness, opposing counsel, and the court reporter.”

He says it’s kind of like a Zoom call. The product is built on top of technology from Verbit, a legal tech company with a custom agentic platform.

“They’re taking care of the technical infrastructure and we have the material to ground the AI.”

A different vendor, Credal, provides a secure AI platform that allows AltaClaro to switch between different models. It can obfuscate names and keep other sensitive data from leaking out, Shayesteh says. “It ensures everything is anonymized and does secure calls,” he says. “We standardized on Credal because it’s highly flexible and secure. We serve law firms and we’re as invested in security as they are.”

But security isn’t the only issue that enterprises face when deploying agentic AI.

The hidden costs of buying AI

The temptation to jump into agentic AI is high, says Dana Simberkoff, chief risk, privacy, and information security officer at AvePoint Inc., a data security company. And off-the-shelf agentic AI can be so easy to adopt that companies deploy it before they’re prepared for it.

Enterprise vendors will often add the technology at no extra cost, just to get people using it, and companies turn it on for their employees before truly understanding what it does, and before systems and workflows are ready. “Then it immediately exposes problems that were already there,” she says.

Say, for example, an agent helps with research, normally considered a low-risk task.

“AI will follow sharing links across documents,” she says. “So if you haven’t taught your users how to properly use sharing links, the AI agent is just going to follow that path, and it could expose information that might have been obscured in the past. It’ll gobble up everything it can.”

The result is it could expose HR data, personal information, or proprietary information to people who shouldn’t have access to it. One company she knows had to shut down their AI project immediately and go back, classify, and label all their information, put governance controls in place, and teach people how to apply metadata.

According to Gartner, by next year, 40% of enterprises will demote or decommission autonomous AI agents due to governance problems that only show up after they’ve gone into production.

Token management

Another hidden cost of off-the-shelf AI? Token use. When agentic AI is embedded into a system that a company is already using, then the cost of switching it on can be as low as zero. But someone has to pay for all that token use.

When agentic AI comes out of pilots and goes into production, usage can change dramatically, and token costs can quickly spiral out of control. It doesn’t help that agentic AI use typically requires much more tokens than AI chatbots.

“A lot of the embedded AI should be utilized,” says Doug Vargo, head of the national AI and alliances team at consulting firm CGI. “If big parts of your business processes are living and breathing in ServiceNow, Salesforce, or another application, you should leverage that, but you need to understand the cost.”

This is playing out in the marketplace right now, he adds, as underlying model providers change their token costs.

“That changes the economics of the decisions,” he says. “And six months from now, it’s a different discussion, because they’re going to continue to move the needle.”

The employer’s prerogative

Another hidden cost that companies might miss is they need to put training and support systems in place for employees. Many off-the-shelf agentic AI tools might seem easy to use, but actual adoption still requires change management. CGI did offer training to employees when it rolled out GitHub Copilot, a popular coding platform with agentic functionality. “And we expected them to adopt and leverage it on day one,” says Vargo. But people quickly went back to their old ways of working, he says, and CGI had to pivot its strategy.

“It’s going from training programs to habit formation or transformation programs,” he adds. “And we’ve seen adoption skyrocket.”

The change isn’t in just how individuals adopt AI to improve their own work, though. “You’re now a manager of 10 to 20 specialized agents that are driving that work for you,” he says.

The error is when companies put the technology first. “They fall in love with the tech or a vendor, but they’re not really thinking about how they’re truly integrating these tools and technologies into the business.”

Embracing change

Change management is a particular challenge with agentic AI because the tools are changing at such a fast pace.

“It’s technology that’s constantly changed almost every month, or maybe every week,” says Scott Likens, chief AI engineer at PricewaterhouseCoopers. “The challenge I see is the timescale of change is much faster than what we’re used to.”

We’re still in the early stages of agentic AI, he adds, and waiting isn’t a good strategy. “You have to start, but keep flexibility over longevity in mind,” he says.

For Luis Huerta, group head of gen AI and agentic automation at International Airlines Group (IAG), change management is one of the most complex parts of agentic AI adoption, as it uses agentic AI to improve customer experience, operations, and efficiency.

“The technology is powerful, but the bigger shift is organizational,” he says. So the company isn’t just focusing on building agents, but also on business ownership, adoption, and governance, and helping colleagues understand how these capabilities change the way work gets done and how it can support them, rather than replace them.

Huerta says IAG also uses agentic capabilities embedded in enterprise platforms, but also builds its own agents, too.

They’re not alone. According to Anthropic’s 2026 State of AI Agents report, 47% of organizations take a hybrid approach to AI agents, while 21% rely entirely on pre-built agents, and 20% build their own.

“We take a technology-agnostic approach,” says Huerta. “Our priority is to select the right solution for each use case.”

AI has a cross-cutting impact on businesses. It’s changing operations, management, and even decision-making processes. But it’s also modifying what they expect from their teams and how they’re organized. This has a direct impact on the decisions of both HR departments and CIOs, who must now consider issues that, until now, have flown somewhat under the radar.

In fact, the desired professional profile is pivoting. Research from Spain’s Open University of Catalonia (UOC) has found that polymath profiles are gaining value in the AI ​​job market based on changing needs and evolving expectations of skills. Now, in addition to understanding and leveraging technology, being creative, capable of critical thinking, and able to grasp the nuances of things, are essential. This is where polymath profiles are experiencing a potential golden age.

It’s important to first clear up the misconception that a polymath is someone who knows a lot about many things. “A polymath is rather someone who possesses relevant knowledge and skills in multiple disciplines,” says Óscar García Gozálvez, senior director of permanent staffing services at Hays Spain. “It’s also someone with broad and cross-disciplinary vision who’s able to make connections in order to problem solve, innovate, and make better decisions.”

Laia Lluch Molins, professor and researcher in education studies at the UOC adds that the difference isn’t in how much a person knows, but what they do with what they know. These types of workers are able to formulate new questions and solve problems that none of those disciplines could on their own. These qualities are what has made them so valuable and attractive to today’s companies.

Knowhow in the age of AI

With AI’s abundance today, simplicity is no longer the norm. “AI is making technical knowledge cheaper and anyone can access the best explanation for almost anything in seconds,” says Molins. “What’s scarce is no longer knowledge itself, but the ability to make informed judgments.” AI isn’t just replacing tasks, Gozálvez adds, it’s breaking down the barriers between disciplines.

Therefore, polymaths don’t simply tick off endless lists of tasks but connect the dots to find keys to success. “They don’t compete with AI in what AI does well, but rather help solve what AI struggles with,” says Molins. This forces a change in how we perceive the ideal profile, as well as pivot on where value can be created. “In the workplace, this translates into a shift in criteria from how much a person knows to how they apply that knowledge to a new problem, situation, or context,” she says. “What’s valuable now is how that knowledge is leveraged and how it’s used to respond to new challenges.”

These new profiles are of interest because they generate more economic and strategic value for the entire company instead of being contained to isolated specialists.

The necessity of change

The corporate culture also has to adjust in consideration of new dynamics put into practice. “Tell me how you evaluate your team, and I’ll tell you what kind of profile you’re developing,” says Molins. There might be a lot of talk about cross-functionality, but if it’s neither respected nor listened to, multi-talented individuals won’t contribute value and will stop sharing new perspectives.

This may be one of the biggest challenges for CIOs, because the IT environment has tended to reward technical depth. “This recognition system doesn’t always know where to place someone whose worth lies precisely in connecting, translating, and asking the questions that others don’t,” Molins says. “The risk isn’t the polymath profile not fitting, but the culture lacking the categories to appreciate it.”

Even so, Molins says this need is already known internally since bottlenecks are mostly due to miscommunication or a lack of alignment with the business, not technical hinderances. “There, the hybrid profile isn’t a foreign body, but rather the missing piece,” she says.

For now, though, IT hiring trends don’t yet show a boom for polymaths. “If we look at the Spanish market, for instance, we’re not seeing a massive demand for generalist profiles,” says García, but adds there’s been an increase in searches for professionals with a strong primary specialty, and a second or third skill that amplifies their impact on the company.

“My feeling is it’ll accelerate over the next three to five years,” he says. Companies are still learning to incorporate AI, and the next phase will be learning how to work in those environments where AI has changed everything.

What the IT team needs

In this new landscape, IT professionals will need to be able to communicate in different languages ​​and understand new fields. The paradigm is shifting, and in addition to advanced degrees, increasingly specialized training programs are recommended.

Regarding polymath profiles and their areas of expertise, the key will be the emergence of three intersections, as Molins calls them. These include business acumen, as something transversal and valuable, communication and collaboration skills to ensure smooth flow and avoid silos, and knowledge of humanities and social sciences, which encompass key issues such as ethics, something that will gain considerable weight in the coming years, according to García.

Until now, he explains, the IT talent career path has been very focused on tech skills, but in the leap to real-world adoption, much more complex questions arise such as biases, data ethics, and responsibilities. “That’s precisely why there’s growing interest in profiles that combine technology, risk, compliance, and AI governance,” García says.

These points of friction will define expectations for what is sought in technology personnel. “The strength of the hybrid IT profile is having a solid technical foundation from which to build bridges with sound judgment,” says Molins. So collaborations are sought after, such as software engineering with AI, data with cloud, cloud with security, or cybersecurity with risk and compliance. And, above all, critical thinking and business acumen — communication skills that have been discussed already for a long time.

Organizations are rapidly implementing AI, but employees often feel left behind about how AI is changing their roles. While AI can help get work done faster, it won’t necessarily help produce better quality work if employees aren’t confident in their AI skills.

In fact, a recent survey from workforce analytics firm Visier reveals that 48% of employees report exaggerating their AI expertise at least some of the time, and 45% said they often feel pressure at work to use AI despite not feeling confident with the tools.

“The risk of underinvesting in training and upskilling is that the alternative can be much more expensive,” says Andrea Derler,  principal researcher at Visier. “Layoffs, rehiring, and competing for top AI talent all come with significant direct and indirect costs. Investing in the workforce organizations already have can be an important part of making AI adoption sustainable.”

When the pace of AI implementation is rushed, however, employees often default to AI compliance, meaning they’ll use AI tools as they’re rolled out, even if they haven’t received the proper guidance or training from their organization to make the most of the investment. So for companies investing millions into an AI future, adds Derler, it’s critical to ensure employee participation is part of the bigger picture to avoid performative AI usage.

Make the most of AI investments with training

Derler acknowledges that AI adoption goals vary widely from company to company. Some will need stronger investment in upskilling and training, while others might need to invest in new resources, talent, or tools to help employees get comfortable with the new pace of work, and to source the right skills for an AI-driven workplace.

Either way, the early stages of AI adoption should involve a basic framework to assist in employee adoption, one that involves open transparency and foundational guidelines for how AI will be implemented moving forward. At bare minimum, employees should be briefed on concepts around general data security, how to spot false outputs from AI tools, and expectations around AI’s impact on their job roles.

“A few foundational skills and concepts every employee should understand include protecting sensitive data and uploading information with the greatest care, understanding the basic capabilities of approved tools available at work, and checking the work before sending AI-generated output to others,” says Derler. “Most importantly, employees need to take full responsibility for the output. The AI isn’t responsible, the person using it is.”

Avoid setting blanket goals as well, where everyone is measured simply by a certain percentage of AI usage per individual or team. This can overlook reality, she says, creating a false narrative around AI usage and adoption, and a focus on quantity rather than quality. Instead, adds Derler, leaders need to strike a balance between mandating adoption and encouraging employees to explore, discuss, and learn together where AI makes sense.  

Embracing transparency around AI

When asked if they felt their organization had a clear plan for how AI affects employees and jobs, 59% in the Visier survey said they didn’t believe or were unsure that their company had a clear plan for AI implementation. And only 28% said they felt leaders in their organizations fully understand how employees use AI today, while 33% thought leaders understand how much training and support employees need.

Overall, employees are eager to embrace AI, but when asked what would boost confidence around using it at work, respondents first ranked AI training and upskilling opportunities as most important, then greater transparency from leadership, more opportunities for career growth and advancement, followed by better communication about how AI will impact employees.

Clarity from the top

Employees have made it clear they want training and transparency from leaders about how AI will affect workflows and processes. This is especially true when it comes to career paths, as AI stands to remove certain skills and expertise deemed irrelevant.

Workers know the future will look different in the wake of AI, but they want to understand exactly what that looks like so they can prepare and shift their own expectations and career goals. Part of keeping employees engaged is ensuring they’re invested in their own future at a company, but that’s difficult if the future is particularly unclear.

“Most organizations are still learning which parts of a workflow AI can take over or augment, so creating opportunities for experimentation and learning is an important step before setting formal adoption goals or metrics,” says Derler. “Many organizations, however, are still piecing together workforce data and don’t have a complete picture of their workforce, making it harder to understand where AI can create meaningful efficiencies.”

Few CIOs are likely to suddenly decide to give an AI agent broad authority over corporate systems. The more likely path to autonomy is far less dramatic. An agent starts with a narrow task. It proves useful, so another system is connected. It then needs more data, so another permission is added. Then human approval becomes a bottleneck, so the organization removes it, and exceptions that once went to people start being handled automatically.

Each decision may be sensible in isolation. Taken together, however, they can leave an agent with considerably more authority than anyone originally envisioned.

That’s the danger of autonomy creep. And as enterprises move from AI systems that recommend actions to agents that execute them, CIOs need to govern not only what those agents were originally designed to do, but what they have gradually become capable of doing.

It starts with small permissions

Jim Taylor, president and chief product and strategy officer at identity security company RSA, sees a familiar pattern. Organizations typically create an agent for a specific purpose and give it the permissions necessary to accomplish the task. Later, the job expands.

“They just give it tasks, permissions; it just sits there and accumulates things,” he says. “Over time, it develops potentially toxic combinations. It gets too much access and can see too much data. It can do too many things.”

Humans accumulate permissions, too, of course, but organizations have developed processes around employees joining, changing roles, and eventually leaving. Agents may not have the same natural lifecycle. “They never give permissions back,” Taylor says.

Nancy Wang, CTO of 1Password, argues that CIOs should treat each expansion in an agent’s responsibilities as something more consequential than another feature. “Every time you expand the scope of the agent’s effective authority, you’re essentially adding a new authorization boundary,” she says.

That distinction between capability and authority is important. An agent may be technically capable of accessing a system, changing data, or executing a transaction, but that doesn’t mean the enterprise should automatically authorize it to do so.

Success can weaken oversight

Ironically, autonomy creep often occurs when AI works well. Paul Dongha, head of responsible AI and AI strategy at NatWest Group, sees that potential at the bank.

NatWest deployed agents in complaint handling, he says. Parts of the workflow that involve retrieving information from systems can be automated relatively easily, while humans continue to make the final decision on whether to uphold or reject a complaint.

If a system consistently produces the correct result, human reviewers may begin treating approval as a formality. The organization may eventually decide that the check is no longer necessary. “The temptation is to give over to the AI because it’s so reliable,” Dongha says.

NatWest sometimes reduces checking when an AI system demonstrates sufficiently high performance, he adds, but the decision is deliberate rather than incremental. It involves stakeholders and risk managers, and the system continues to be monitored afterward.

That’s a critical distinction for CIOs. Removing an approval step doesn’t necessarily represent poor governance. Removing it because everybody has gradually stopped paying attention to it does.

The warning sign is when a human moves from making a meaningful decision to merely rubber-stamping one — and then entirely disappears from the workflow without anyone reassessing the authority the agent has gained.

Put the controls outside the model

As agents acquire more authority, CIOs can’t rely solely on the agent to respect instructions about what it should and shouldn’t do. At 1Password, Wang advocates what she calls verified loops. Before an agent begins work, humans define its task, which tools it may use, what evidence will demonstrate that it completed the task successfully, and which actions it should never perform.

A separate verifier then compares evidence from the agent’s actions against that human-defined policy. “What you want to avoid here is something recursive where you have a fox guarding a henhouse, or the agent looking over its own work,” Wang says.

The principle applies beyond software development. A model might be instructed never to transfer more than a certain amount of money, delete a production environment, or access particular data. But if violating that rule would have serious consequences, the limit should also exist outside the model.

RSA’s Taylor makes the same distinction from the identity and access side. “Model-level guardrails are necessary, but not sufficient,” he says. “The real limits need to sit outside of that in enterprise control.” He argues for layered controls around agents, including identity policies, provisioning rules, lifecycle policies, governance, monitoring, and attestations.

In other words, CIOs shouldn’t ask an AI agent to exercise restraint where the infrastructure could simply prevent the unauthorized action.

Govern access in real time

Traditional access governance often operates on a schedule. A manager might review an employee’s permissions quarterly and determine whether those permissions are still appropriate. Agents may evolve too quickly for that approach. “Agentic identities are dynamic,” Taylor says. “So we need a mechanism that certifies them continuously, rather than performing periodic reviews.”

If an agent suddenly gains access to another database, for example, that event itself could trigger reassessment. Organizations should determine whether the new permission is appropriate or creates a dangerous combination with access the agent already possesses. “Privilege and authority should never be permanent,” Taylor adds. “They should always be reviewed.”

Wang favors an even more granular approach of task-based authorization. Rather than giving agents standing access or long-lived credentials, organizations can make authorization decisions at runtime and provide short-lived credentials only when required for a particular task. “We espouse no standing privileges,” she says. “No long-lived credentials.”

That effectively applies least privilege at agent speed. A change in task becomes an opportunity to reassess whether the agent still needs the access it’s requesting.

Make someone own the agent

Technical controls, however, don’t eliminate the organizational question of accountability. Taylor believes enterprises should be able to associate agents with a responsible identity. If an employee creates an agent, the organization needs to know who’s responsible for it, what its purpose is, and what happens to it if that person changes roles or leaves. “Every agent action needs to be attributed to a responsible identity,” he says.

Ownership also needs a lifecycle. An agent that remains important after its creator leaves should be transferred to another designated owner rather than simply continuing indefinitely.

Dongha makes another distinction. For AI embedded in a business process, he believes the business owner should remain accountable because that person owns the customer relationship, the process, and often the P&L. “It’s the business owner who has the responsibility because their people run it, and they’re responsible for the customer relationship,” he says.

That creates a useful division of roles for CIOs: IT may provide the infrastructure and controls, but the business can’t outsource accountability for the consequences of autonomous decisions.

Multi-agent systems need system-level controls

The challenge becomes more complicated when agents begin working together. An individual agent might remain entirely within its permitted scope while contributing to an overall outcome nobody intended. One agent generates an output. Another accepts it as input and takes an action. A third agent then acts on the result. Again, the individual actions may all appear legitimate.

Dongha says enterprises therefore need to test not only individual agents but the entire network as a system. “You need something overarching on top of a multi-agent system,” he says.

NatWest is working on an AI control tower that would give authorized users visibility into a network of agents, including messages passed among them and the guardrails surrounding those interactions. Dongha considers governance of multi-agent systems an emerging problem that nobody has fully solved yet.

Wang also points to a related challenge that identity becomes more complicated when agents are ephemeral. An organization may spin up a temporary team of agents, tear it down, and recreate it later. If something goes wrong, the enterprise needs to reconstruct which agent made which decision during which session, and how that action propagated through the system.

That makes traceability increasingly important as autonomous systems become less like individual applications and more like networks of interdependent actors.

Set the bar before the agent reaches it

Before an agent goes into production, Taylor says CIOs should be able to answer several basic questions: Who owns it, what can it do, what’s its maximum authority, how will the organization know if that scope changes, and which actions require a human decision.

Other industries don’t need to replicate the governance machinery of a large bank, but they can borrow one important principle: controls should be built into the system from the beginning. “Governance shouldn’t be a check at the end,” Dongha says. “It needs to be embedded when you build an AI system.”

For CIOs, that may be the central lesson of autonomy creep. The question isn’t simply whether an agent can be trusted today but whether the organization has mechanisms to notice when tomorrow’s agent has quietly acquired authority that nobody ever intended to give it.

Companies are moving fast to put AI into chatbots, virtual assistants, and other customer service tools. But for CIOs, that comes with a risk: if the technology gives customers the wrong information, makes biased recommendations, or mishandles data, it can immediately damage the trust companies have worked hard to build.

Unlike conventional software, gen AI doesn’t always give the same answer to the same question. An answer can sound confident and convincing while still wrong. And when customers rely on AI for information about their finances, insurance, or health, a mistake can have much greater consequences.

Sumit Johar, CIO at cloud-based software company BlackLine, understands that inaccurate AI responses hurt the customer experience, force companies to spend money and resources to fix problems, damage the brand, and create regulatory risks. AI systems can also expose confidential information, making it important for companies to understand the data sources behind their responses.

“An AI failure creates a massive trust issue around the core solution being provided,” Johar says. “In the financial sector, bad AI advice or outputs can compromise balance sheet accuracy and lead to severe legal and personal liabilities.”

For Citizen Health CTO Daniel Wang, for instance, the stakes are particularly high because the company’s users include rare disease patients and caregivers.

Citizen Health works to ensure that important information provided by its AI can be traced back to the original source, such as patient records, clinical information, or medical studies. The company also reminds patients to talk with their healthcare providers before making medical decisions.

Wang says one of his biggest concerns isn’t just that AI can make a mistake, but that a wrong answer can sound right.

“An AI system can present an answer that sounds caring, informative, and authoritative, even when the underlying information is inaccurate,” he says.

That risk has affected how Citizen Health releases AI products, and has delayed AI launches when the company needed more time to understand how the technology was coming up with its answers, or to make sure those answers were accurate. So instead of rolling out new AI tools to everyone at once, smaller groups of patients might be tested first, and their feedback used to make improvements before a wider launch.

Citizen Health also tests its AI tools before launch using questions with known answers, and uses both automated testing and human review, watches for unusual AI responses, limits what the AI can answer, and gives patients ways to provide feedback.

Moving at the speed of trust

Other tech leaders are taking a similarly cautious approach. Jonathan Tushman, CTO and CAIO at Hi Marley, an insurance technology company, says it’s had tech that was ready to ship for years but chose to spend more time on testing, observability, legal review, and training before releasing it.

“If it weren’t for that trust-and-governance bar, we’d have gone live a year earlier and had faster adoption,” Tushman says. “We chose not to.”

Hi Marley calls that approach working at the speed of trust. For Tushman, releasing customer-facing AI also requires the ability to see what the system is doing once it’s running. That includes monitoring individual conversations as well as looking for patterns across tens of thousands of interactions. Companies also need kill switches that can shut down a system, and the ability to roll back changes if something goes wrong.

But technology alone isn’t enough. Customer service, IT, DevOps, and CloudOps teams all need procedures to respond to AI problems, Tushman adds.

Udaya Bhaskar, senior application security analyst at global farming company Corteva Agriscience, says one mistake companies make is moving too quickly after seeing an impressive AI demonstration without fully testing how the tech will perform with actual customers.

He adds that companies can also run into problems when they rely too heavily on vendor claims, or launch AI tools without giving customers an easy way to reach a person when something goes wrong.

The hidden cost of AI mistakes

The pressure to deploy AI is often tied to the promise of greater efficiency. A chatbot that handles more customer questions, for example, can reduce employee workloads. But those time and cost savings can shrink quickly if employees have to spend their time checking and correcting the AI, something referred to as the hallucination tax.

Companies may budget for developing the technology without fully accounting for ongoing costs of running and monitoring it.

Jess Lampe, global lead technologist at Launch Consulting says those hidden costs can include employees spending time checking AI responses and redoing work when the technology gets something wrong, as well as regulatory and legal risks. Another cost can be harder to measure: loss of customer trust.

Chris Slovak, global field CTO at managed enterprise AI delivery platform Unframe, sees the resulting damage to a company’s reputation as one of the largest hidden costs.

“Anything customer-facing is a representation of your brand,” Slovak says. “Yes, poor implementations with bad experiences have a material cost from the perspective of tokens. However, the impact on your brand is far more costly. Often, companies add AI to deflect customer support. Consider you have a customer who’s already frustrated, and meeting AI makes it worse. The loss in trust can be massive.”

But Kevan Yalowitz, global software and platforms lead at Accenture, says mistakes are going to happen whether work is performed by people or technology.

“The true hidden cost is destroying user trust when mistakes happen, regardless of the source,” Yalowitz says. “The most successful organizations quickly admit when these mistakes happen, provide a transparent explanation, and explain how it was an opportunity to learn and ensure the mistake doesn’t happen again.”

Human oversight remains critical

For CIOs, preventing those problems means putting controls around AI before it reaches customers.

Johar says human oversight is particularly important for critical decisions. In highly regulated industries such as finance, AI shouldn’t independently handle decisions where accuracy is essential. Companies also need reliable data feeding their AI systems, and the ability to audit what happens when something goes wrong.

Lampe says the level of oversight should depend on what an AI system is allowed to do. An AI tool that summarizes information, for example, doesn’t pose the same risk as one that can take action involving a customer’s money or account.

Companies should also continue testing after launch. AI behavior can change over time, meaning a system that performed well when it was first released may not continue performing at the same level later on.

Toyan Espeut, chief customer officer at cloud-based work management and collaboration platform Smartsheet, says companies also need strong rules around customer data.

“It can’t be mixed across tenants or used to train third-party models, and AI can never operate outside a customer’s existing permission structure,” she says. “If a person can’t access something, the AI acting on their behalf shouldn’t be able to either. Every AI action needs to be fully auditable, and customers should always have transparency into when AI is involved, and the ability to review or validate AI-generated outputs.”

Who’s responsible when AI gets it wrong?

Even with extensive controls, companies need to prepare for their AI to make mistakes, but the AI itself can’t be solely to blame.

At Citizen Health, Wang says a problem involving customer trust quickly becomes a company-wide issue. The company has support and on-call procedures, but serious concerns are also brought to leadership. Citizen Health also maintains direct channels for users to report problems so they can be investigated quickly.

Tushman at Hi Marley makes a distinction between the person who initially handles an AI problem and the executive ultimately responsible for it. A customer success or help desk team might receive the first complaint, but he says accountability for customer-facing AI rests with him as CTO. “It isn’t something you outsource to the system or hand to the vendor,” he says.

Corteva Agriscience’s Bhaskar similarly says the company deploying the AI remains responsible for what it does since AI is a tool rather than a decision-maker, and companies can’t shift responsibility to the technology when something goes wrong.

And Lampe adds that every customer-facing AI system should have a named person responsible for its behavior and performance, along with a clear process for escalating problems, and allow customers to challenge incorrect outcomes and reach a human.

Speed: only one measure of success

The push to adopt AI is unlikely to slow down. But tech leaders say companies need to be careful about the standards those investments work by. Simply counting how many customers use an AI tool may not say much about whether it’s making their experience better.

Espeut says companies should look at whether customers are solving problems faster, making better decisions, and getting better business results.

“Companies should also expect fewer support tickets because that tells you customers are actually succeeding with the tool, not just using it,” she says. “Expanded engagement across the organization is also an indicator instead of staying siloed in one buying center. They should pay attention to the quality of customer feedback and feature requests as well. When customers actively help shape your product, it’s a strong signal they trust the technology and see its long-term value.”

With a career built at companies like Visa, Ellie May, and Blackhawk, Selim Aissi, a 2026 CSO hall of fame inductee, understands how boards and executives demand a clear justification for cyber security investment, especially considering today’s difficult economic climate.But getting security leaders to communicate tech debt, operational fragility, and long-term cyber risk in business terms the board can actually act on isn’t always straightforward.

A lot of organizations add tools, and more platforms and controls in response to new threats. Yet that doesn’t necessarily address underlying complexities. Security investment can actually increase operational and strategic risk.

“I think there’s a tipping point once a reasonable depth of defense is in place,” he says. “When there’s a reasonable level of automation of security controls and cross integration of security tools, anything beyond that could potentially be overspend and could potentially add risk to the entire organization.”

So the challenge is to know when an environment exists and functions without the need for a sudden budget spike.

“All of the KRIs and KPIs in place should be able to indicate the level of resiliency,” he adds, “in addition to other controls such as making sure there are processes that would allow for detection of, let’s say, API abuse, cloud-level abuse, and, increasingly these days, AI as it adds yet another threat vector.”

Understanding risk also lies in recognizing the distinction between organizations that are genuinely resilient, and those that appear mature on paper, focused on fine-tuning policies, compliance, governance, and frameworks.

“These are all important but they shouldn’t be the main focus,” he says. “The first step is knowing where the data is and once in transit, how it needs to be protected with the most updated protocols.”

Aissi expands on how organizations unintentionally create risk through tool sprawl and operational complexity, how boards should think about long-term cyber resilience, and why AI and cloud expansion are accelerating security debt faster than many enterprises can manage. Watch the full video below for more insights, and be sure to subscribe to the monthly Center Stage newsletter by clicking here.

On resiliency: A security organization that’s mature — and I’ve seen many and have built several — is one that’s architecturally designed to be resilient. But resiliency means different things to different people. To me it means that recoverability is tested often, making sure that in case of an event or breach case of lateral movement, the company can react according to a very clear playbook that’s been thoroughly tested. I also think a resilient organization is one that has the right controls of the right places, and one that also has metrics around them that indicate if there’s an event, and how well the tools work.

An area which I’m really passionate about is data protection. But how do you know the data is protected? A resilient organization doesn’t look at whether the data is encrypted at rest or not. It looks at the entire lifecycle of that PII. Meaning the organization has a very clear discovery mechanism to know exactly where the data is. It could be on laptops, servers, or in a public cloud. It could be in many different places, and it can be structured or unstructured.

On organizational risk: My definition of security debt is the accumulation of risk because of investment in areas where complexity is added, where a lack of automation is exaggerated, and where there’s overcompensation for some controls that aren’t needed. So if an organization spends money without effectively simplifying security controls, and automating more than what needs to be automated, that is tech debt.

Most commonly, tech debt in security is defined as the accumulation of vulnerabilities that aren’t patched, the over complexity of identity exposure management (IEM), and a lack of understanding of where data is. So most significant organizations, especially in fintech, have a huge volume and velocity of PII, and in health tech, PHI and security debt is not knowing where all the data is, or that it’s potentially not protected in some areas. So in addition to the data itself, IEM, and lack of automation and overlaying security tools are other forms of tech debt.

On managing board expectations: The board really wants to understand the risk of cyber security investment, and anything else could potentially be perceived as noise. I see many CISOs taking metrics upon metrics, and dashboards upon dashboards of all sorts of variations of vulnerability management. But what the board really cares about is what the risk is to the business if the most critical systems aren’t patched. Anything else could be perceived as not a concern or a business risk.

CISOs should speak in terms of impact of any real or perceived threat on the business, and be specific. So going back to vulnerability management, let’s say there’s a zero day that was patched or maybe multiple ones that were patched. How do you explain that to the board? You say we patched five zero day vulnerabilities. And honestly, the reaction is probably, who cares. The story should sound like these five vulnerabilities if unpatched, could have put certain systems down for three days, or it would’ve been much easier for an adversary to attack this revenue generating system. That’s what the board cares about, the impact on the revenue. And that’s how CISOs need to speak to them.

On AI: Security didn’t get a seat from the beginning when it comes to AI. So how do we explain to the board that developers might start sharing the company’s source code with Claude and it could potentially leak? This is something we’re all trying to figure out. But we should start speaking from a business perspective about the benefit of AI to the security organization, to the security tooling, to security operations, how it could be more efficient and effective, and at the same time, highlighting some of the risks to the organization — not theoretical risks, but risk related to the organization. If it’s a financial institution and AI agents are deployed in some transactional application, I think the CISO should speak to the board about the business risk of not deploying the necessary security tools to ensure that those AI agents don’t go rogue, that the LLMs are protected. So those are the business terms we need to be speaking about.

Most enterprises govern AI the way they would any other IT rollout: deploy dashboards, institute policies, and conduct periodic reviews. Having the right AI governance tools in place and addressing gaps is important, but IT executives should be more concerned about rethinking workflows and establishing ownership.

“Accountability usually breaks down first,” says Beena Ammanath, executive director of the Global Deloitte AI Institute. “Teams deploy AI faster than their organizations can define who owns risk, approvals, monitoring, and outcomes,” she adds, which results in inconsistent use, fragmented controls, and limitations in scale.

Enterprises need to redesign jobs and workflows, not just the tooling, yet 84% of organizations the Institute surveyed haven’t adjusted jobs for AI, and just 21% have a mature AI governance framework in place despite rapid adoption, according to Deloitte’s 2026 State of AI in the Enterprise report.

“Technology can provide visibility and controls, but it can’t replace leadership,” says Rajesh Arora, chief data and analytics officer at Principal Financial Group. “The organizations that scale AI most effectively are the ones that treat accountability as a business responsibility, not a technology responsibility.”

One year ago Principal was focused on building its ethical and responsible AI framework, its inventory, and governance processes to support responsible adoption. Today the firm has assessed nearly 200 use cases. “Governance is increasingly embedded in those investment and operating decisions, rather than applied as a separate review at the end,” he says.

Costly, compounding mistakes

Some organizations have already run into issues with respect to inadequate governance. A 2024 Stanford RegLab study found that AI-assisted research tools offered by LexisNexis (Lexis+ AI) and Thomson Reuters (Westlaw AI-Assisted Research and Ask Practical Law AI) hallucinated between 17% and 33% of the time when working on legal queries, while the Damien Charlotin AI Hallucination Cases Database has identified some 2,041cases of fabrications so far. In at least one legal case (Couvrette v. Wisnovsky) this resulted in nearly $95,000 in sanctions.

Cases like this one are likely the result of an accountability failure. It may be that no one actually owned the job of verifying the AI’s output before it went to the court. But if a single instance of a static AI output could get past a review today, how will organizations deal with autonomous, multi-step agentic AI systems going forward?

Most use cases at Principal are still human-led, with AI providing decision support only, says Arora. “But we’re preparing for a future where agentic and more autonomous capabilities become increasingly common, and those systems raise new questions around accountability, monitoring, and control,” he says. “The goal isn’t to predict every future use case, but to build adaptable governance processes that can support innovation while maintaining trust and transparency.”

Agentic automation raises the stakes

When things go south with agentic AI today, the consequences usually aren’t devastating because in most cases, the outputs are designed to provide insights, rather than take automated actions. That’s already starting to change, however.

Today, many AI failures are like the one described above where someone failed to catch a single bad output. But agentic AI will gradually take more control of workflow tasks in the enterprise, according to Forrester Research. As those agents act autonomously, crossing multiple process steps along the way, small errors will compound before any periodic review can catch them, so governance must be built into every step in the process.

According to Microsoft Research’s VeriTrail project, catching hallucinations in a single final output isn’t sufficient in multi-step AI workflows. The provenance must be traced back through the intermediate outputs, because an agent chains one call into the next, and an error early in that chain can propagate through several steps before a human sees the finished result. Traditional review, built to check outputs rather than the chains that produced them, isn’t designed to catch that.

So business teams can’t be accountable for agent deployments if they can’t verify performance at runtime. “If the agent is goal-oriented, there could be errors in the workflow process that indicate unwanted behavior or skipped steps that the business wouldn’t be able to detect if they only look at the outcome,” says Lauren Kornutick, senior director analyst, AI governance at Gartner.

Power management company Eaton, for instance, has already deployed multi-step agentic workflows without a human in the loop. “We tend to be risk-conscious, not risk-averse, about autonomous workflows,” says Ross Schalmo, the company’s VP and chief data and AI officer. For example, one autonomous agent responds to supplier payment status inquiries by authenticating the requestor, matching purchase orders and invoices, and returning payment information.

Schalmo’s team engineers such applications to be as deterministic as possible, while the non-deterministic, LLM parts of the program are isolated and continuously evaluated against expected outputs to catch model drift. “When there’s a human in the loop, we can be a lot more permissive,” he says. “Anything autonomous, without a follow-on human step takes longer to develop because we have to think about where to use the generative portion of AI versus where we can still use deterministic tooling.”

Breakthru Beverage Group is still early in its AI journey, but EVP and CIO Glenn Remoreras is well aware of the issues around autonomous agentic AI. “It’s people, process, and culture first — to me that’s the bigger play,” he says. The beverage wholesaler has updated use policies, instituted mandatory AI e-learning programs, and is blocking use of unsanctioned AI tools.

But to successfully manage active, agentic AI, where the AI takes actions autonomously across multi-step workflows, users will need more than basic training in AI, says Craig Le Clair, VP and principal analyst at Forrester Research. “AI will take on more of the work and move the human out of duct tape roles that patch around vague systems, poorly designed interfaces, and poorly integrated data,” he says. “The end game is the agent managing and orchestrating the process — that’s the redesigned operating model.”

Humans, of course, will still need to play a role, although today many employees don’t yet have the required skill sets, and currently that point isn’t getting a lot of attention.

AI supervision skills will be needed for agentic oversight, threshold management, confidence intervals, and root cause analysis, for instance. “Figuring out why an agent hallucinated or got stuck in an execution loop — whether due to poor input data or contradictory rules — and how to refine instructions, that’s the direction,” Le Clair says.

Who’s governing anyway?

AI governance is also complicated by the fact that AI projects exist both inside and outside the IT organization. That leaves governance work distributed across CIOs, data and analytics leads, AI leads, IT security, legal, and other players, with no consistent owner, says Kornutick. “It becomes a multi-role orchestration problem of how to govern this, who owns this, and who’s responsible for which component,” she says.

In response, some organizations have brought in a chief AI officer. Twenty-one percent of organizations now have already done so, says Le Clair, adding that roughly 24% of enterprises will move AI and automation governance outside the CIO’s office over the next year to deal with the risk of fragmentation.

Arora, who reports to CIO Kathy Kay, is the focal point at Principal. “My team establishes the standards, oversight, and governance process, but AI is too embedded in the business to be owned by a single function,” he adds. They collaborate with leaders from the business as well as the legal, compliance, risk, and technology organizations.

The challenge, therefore, lies in deciding who’s responsible for controls, model sprawl, and token economics. “We’re seeing a cooperative, co-model where IT focuses on the hard rails — cybersecurity, performance management, infrastructure reliability, and availability,” Le Clair says, while the CAIO focuses on soft rails, such as context engineering, the effects on employees as agents move to the center of the process and start taking over the middleware function humans used to perform, and connecting disparate systems and poorly designed interfaces.

At Eaton, governance is built on a three-legged stool between Schalmo’s organization, cybersecurity, and legal, while enterprise architecture weighs in on tech foundation decisions. The company also assigns ownership of an AI project only after a successful pilot, while IT performs a custodian or stewardship role. “Once that agent is live and operational, it shows up in an org chart, reporting to someone in the organization,” he says.

At Breakthru Beverage, Remoreras formed and leads an AI governance team that reports to the board and co-leads with the VP of data and AI a governance council that reviews and approves AI projects from SVP- and VP-level product owners. “I’m seen as the owner of our AI portfolio, but it’s co-leadership with my peers on the executive team,” he says.

Closing the tools gap

With regard to AI management platforms, says Le Clair, none of the platforms building AI agents have an adequate control plane today to give the visibility needed to move to truly agentic solutions. The most advanced planes are walled gardens. For example, Microsoft’s agent registry will show every agent built across its own platforms, says Le Clair, but not agents built on Salesforce or AWS.

“You’ve got maybe 50 vendors trying to be pure-play control-plane providers, plus the hyperscalers, portfolio companies, and startups building agentic frameworks,” he adds. “There’s no consensus yet on what’s even most important to control, and there’s confusion about requirements.”

Most AI governance tools available today are limited, Schalmo says. “We’ve looked at four or five different external vendors for AI governance and AI control-tower-type solutions, and a lot of them fall down on discovery of AI built by someone else’s solutions,” he says. “That’s a huge gap for me. Either I have to buy governance solutions from almost every piece of software we interact with, which gets really expensive, or I have major gaps in my portfolio I just don’t have visibility into.”

Currently, he’s looking at using a cyber vendor’s AI component for discoverability, going with at least one major firm that provides control-tower capability, and using AI to build another governance layer on top of that.

Organizations clearly need agent registries and agent lifecycle management but it’s less clear what they require beyond that. “How deep does explainability need to go when decisions are made at runtime that weren’t articulated at design time?” Le Clair asks. “There’s real vagueness in the requirements. Vendors have very well-tuned pitches that promise to do anything you want, but buyers often don’t know what they need in the first place, and there are real tool gaps. This is the major problem the industry is actively trying to solve. It’ll just take time.”

But those aren’t Arora’s biggest concerns. “Most organizations can acquire tools,” he says. “Far fewer have clear ownership, decision rights, and accountability embedded across the business.”

Speed versus governance

There’s a perception that governance slows down AI projects because it can’t keep up with the rapid pace of adoption and advancement. A 2026 GitLab AI accountability survey of developers and technology buyers found that 92% of organizations reported some form of governance challenge with respect to governing AI-generated code, and 34% of organizations that experienced an AI-related incident couldn’t determine after the fact whether AI-generated code was the cause.

Similarly, Faros AI’s telemetry analysis of 22,000 developers in its 2026 Engineering Report discovered that developers with high AI adoption rates completed 34% more tasks and 66% more epics, but the median pull-request review time rose by 441%, a nearly five-fold increase.

Is it the case that governance and speed are inherently at odds, and that human review simply can’t keep up? That’s a false choice, says Ammanath. Rather, it shows what happens when both aren’t designed together. “When done well, governance accelerates scaling by giving teams clear guardrails from the start,” she says. “What slows organizations down is retrofitting governance after broad deployment.”

Arora adds that controls don’t slow down innovation but protect the conditions that allow innovation to scale responsibly. “Our approach has always been to move with urgency, but not at the expense of trust,” he says.

How to proceed

For Principal, investing in workforce readiness was one of its biggest investments, helping employees understand both the opportunities and responsibilities that come with these tools, Arora says.

But organizations shouldn’t stop there. Redesigning workflows and decision-making structures is essential before scaling, says Ammanath. “Many organizations have policies and technology in place but lack clear decision rights or governance embedded into daily work,” she says.

Operating model changes take more time than training, and require executive sponsorship and cross-functional coordination. “Without workflow redesign, a workforce may understand AI but lack clarity on when to use it, how to govern it, and how daily responsibilities change,” she adds. “The organizations seeing the strongest results pair broad AI education with role-specific training, workflow redesign, and clear accountability for outcomes.”

Make sure you’ve thoroughly considered the organizational change management aspect of agentic AI projects, says Schalmo at Eaton. His team developed an automated workflow for processing complex bid requests to save the sales team time, but piloted it in a country with lower labor costs than the US. That challenged the economics of the project, and those individuals only dealt with higher-volume, lower-complexity cases.

The lesson: “Lead from a people-first standpoint, and understand the workflow and what’s impacted — whether it’s relieving drudgery and freeing someone for higher-order thinking or customer time, or impacting an actual support function’s role,” he says. “And make sure there’s a viable path to business value.”

An adaptive governance process is key to keeping up with the technology, Kornutick at Gartner adds. She recommends categorizing AI projects following a stoplight approach. Green light projects, such as for personal assistants, present acceptable risks. “We know there’s risk associated with it, but we’re willing to take it,” she says. Yellow-light projects need guardrails in place around such things as PII, or for those triggering a privacy-by-design process, or a security review of a new application. Red light projects need an architectural review before proceeding.

“Think about those use cases as business-transformation processes where you’re fully redesigning workflows, or considering replacing tasks individuals do and shifting them to supervising the AI doing those tasks instead,” she says.

Schalmo’s team does risk tiering based on the EU AI Act’s four-tier risk framework to determine the appropriate level of governance scrutiny for each project. Low-risk requests are automatically provisioned after the requestor fills out a questionnaire, while high-risk cases get a full architectural review.

“Treat governance as the foundation for scaling, not a constraint on speed,” says Ammanath. “Before expanding agentic AI, organizations should define what decisions agents can make, where human oversight is required, who’s accountable, and how performance and risk will be monitored.”

The hardest part, says Arora, is helping an entire organization evolve at the pace of technology. “Successful AI adoption is ultimately a business transformation challenge,” he says. “It requires leadership alignment, clear accountability, workforce readiness, strong governance, and ongoing change management. Long-term trust will belong to organizations that can translate technology into sustainable business value.”

Most CIOs can easily describe their AI initiatives, but struggle to demonstrate and report on AI value and ROI. This is evidenced by Gartner’s AI ROI Vendor Sentiment survey, which found that 27% of respondents strongly agree that ROI from AI initiatives is difficult to quantify. In addition, only one in four had a clear process to evaluate success of AI initiatives.

In the digital transformation era, compute costs were relatively cheap, and the focus was less on FinOps and more on user experience, and the classic software attributes of availability, reliability, scalability, performance, and security.

AI-native and AI-enabled applications still bring these considerations, along with a host of new ones, such as accuracy, validity, explainability, safety, and all the other trust attributes like those in the NIST AI RMF. But as AI scales, it’s quicky becoming a FinOps exercise, too.

I’ve discussed techniques CIOs can apply to improve AI value and ROI such as architectural decisions related to controlling efficiency at the data layer, fine-tuning the application layer, and closing the gap between AI strategy and governance.

Here, we’ll look at three best practices for CIOs looking to formalize their process to evaluate the effectiveness of their AI initiatives through approaches, frameworks, and techniques that support measurement and ROI reporting across the entire AI portfolio.

1. Take a portfolio approach in line with AI ambition

The first step to AI value is to take a portfolio approach and look across your entire AI estate and how it supports your AI strategy and broader organizational strategy. This means thinking about your AI innovation ambition and how you’d like to move the needle year-over-year by adjusting your percentage of spend across quick wins versus must haves, internal (employee-facing) versus external (customer-facing) applications, near-term versus long-term initiatives, and cost savings and productivity versus revenue generation.

This AI innovation ambition approach is a best practice in innovation management as organizations work to gain quick wins early on to prove value, and then get more ambitious in subsequent years and allocate a larger percentage of their spend on more strategic, longer-term, and externally focused initiatives for revenue generation.

For example, an early maturity organization might focus 80% of its AI investment on internal-facing initiatives and 20% on external-facing ones in the first year. Then, it moves to a 70/30 split in year two, and so on. While many organizations may not track these spend allocations, it’s a valuable discipline and one which often differentiates AI leaders from the rest of the pack. In PwC’s 2026 AI Performance Study, the top 20% of companies capture 74% of all AI-driven economic value, delivering a 7.2 performance multiplier over peers.

Deploying focused pilots alongside quick wins is a great way to capture early insights into AI value and ROI before scaling applications. According to Joe Vaccaro, SVP and GM of Network Platform and Assurance at Cisco, networks have become distributed, continuously changing systems that produce far more signal than any human-led operating model was designed to interpret.

“Our survey of 1,000 IT and NetOps leaders found more than half believe a failure to automate will open critical security gaps and elevate enterprise risk,” he says. “For CIOs seeking to demonstrate ROI from AI investments, a credible path is to start with targeted, measurable, and reversible workflows. Focused pilots can validate outcomes and strengthen governance before broader deployment.”

At this level where organizations look at their holistic AI spend, it’s also important to have a well-crafted set of AI value metrics, which can be used to assess the current health and productivity of the portfolio. Borrowing from best practices in innovation management, AI value metrics, such as those that look at input and mix, health and efficiency, and outcomes, help to look across the entire innovation pipeline, from idea to value.

• AI innovation input and mix — What’s going into your pipeline in terms of the types of innovations in the queue.
• AI innovation health and efficiency — The flowrate through your pipeline and the amount of funding being applied.
• AI innovation outcomes — The measure of return on innovation in terms of commercialized innovations that have captured revenue or other objectives.

2. Develop an assessment framework focused on full cost benefit

While many organizations are laser-focused on the cost side of their AI initiatives, your assessment framework needs to incorporate a full cost benefit analysis. “While the current focus for many organizations is squarely on AI tokenomics, it’s important to look at both sides of the coin when it comes to AI value, and look at the business value that’s being delivered by each initiative to give a clear picture of actual return,” says David Evans, AI and growth strategist at thought leader networking platform Thinkers360. 

Ben Schein, VP of AI and analytics at AI infrastructure software company Progress Software, adds that CIOs should stop measuring AI activity and start measuring outcomes where possible. “Usage tells you the meter is spinning, not that value came out,” he says. “Instrument the cost side completely, since every AI action can carry its workload, model, and cost. Then pair costs with benefits where the work allows, so cost per workflow run against value per workflow run, never enterprise-wide spend against anecdotal wins.”

However, Dan Priest, PwC US CAIO, recommends getting back to basics, starting with the investment side but adding a few modern updates. “AI ROI has been illusive for many, in part because organizations are still learning how to achieve it, and because AI sometimes gets a pass on the typical disciplines required to measure it,” he says. “For major AI initiatives, starting with investment might include new infrastructure, labor for the build, models for the intelligence layer, and variable expenses like token costs. All of these should be contemplated in ROI calculation, some of which will require new tracking and controls.”

His benchmarking also points to a threshold effect: ROI stays insignificant until AI investment crosses roughly 1.6% of revenue, and above that line, EBITDA is up 9.5%, revenue is up 3.5%, and total shareholder return is up 20.2%.

3. Include benefits and measure what matters

Another best practice from innovation management is to look at both the quantitative and qualitative benefits of AI initiatives, not solely the direct financials.

“It sounds obvious, but CIOs should measure the business value created like productivity, growth, and other outcomes rather than activity completed, such as building an app, creating a dashboard, or collecting customer feedback,” says Priest. “We recommend looking across five dimensions of value: financial, operating, functional, trust, and workforce. That gives leaders a more consistent way to measure and compare value across an AI portfolio, even when individual investments are designed to produce different outcomes.”

Calculating projected as well as actual ROI can also give CIOs insight into how their AI portfolio is living up to expectations. This is where it’s important to factor in governance costs early in the lifecycle before initiatives get funded, particularly for high-risk applications where downstream governance requirements are high. 

“Ultimately, measure what matters, keep an eye on variable costs, and monitor actuals against expected costs and benefits,” adds Priest. “That gives CIOs the information they need to determine where investments are delivering, where changes are required, and where to lead, lag, or exit.”

Quantifying AI value and ROI doesn’t require a completely new methodology or new approach. It simply takes the same financial rigor applied to many other previous investments. The variable cost dynamics may be more complex, but these are solvable if you align with your AI innovation ambition, apply your assessment frameworks consistently, define your AI value metrics, and measure what matters.

AI’s ascent in business is rapidly impacting nearly every industry and job role. But, according to data from Indeed Hiring Lab, IT remains the epicenter of AI’s role revolution, with AI skills still proving to be most valuable to those working technology positions.

When it comes to AI’s impact, Indeed identifies software development, IT systems and support, data and analytics, marketing, and banking and finance as high-exposure occupations, whereas jobs in healthcare, food service, cleaning, and manufacturing are less directly impacted by the rapid ascent of AI.

Indeed’s report examined the correlation between AI exposure and advertised pay, evaluating salary data for high-exposure occupations most impacted by AI, and how it compared to low-exposure ones. The data revealed that the job roles most impacted by AI have experienced a steady rise in salary since 2022.

The post-ChatGPT pay premium

Salary data from the most-exposed roles revealed a pay premium for AI skills that’s been on a steady incline since ChatGPT’s release. For roles categorized as being the most-exposed, pay has grown 46% since 2021, compared to only 25% for the least-exposed roles. Companies are paying a premium for AI-related skills, especially as more organizations face a skills gap in the face of rapid AI adoption.

Since ChatGPT’s launch, roles in the more- and less-exposed occupations tracked similarly for salary growth until around 2024, when the split became more pronounced. This is around the same time the industry saw a bounce-back in hiring for roles in the more-exposed category, as employers began reorganizing work and competing for AI-adjacent skills, according to Indeed.

The data ultimately reveals a post-ChatGPT pay premium of 5.7%, says Jack Kennedy, economist at Indeed and author of the report. And that pay premium holds up under granular control. Even when a job title is compared against itself — such as data engineers against other data engineers, or truck drivers against truck drivers — the pay premium still stands around 4.7%.

Despite concerns that AI will hollow out knowledge work and drag down pay for the jobs that remain, Kennedy says the four years of data after the public release of ChatGPT reveals the posted wages for occupations most impacted by AI aren’t lagging. Instead, they’re outpacing their less-exposed counterparts.

AI pay premiums by seniority

When isolated by seniority level, pay premiums in high-exposure tech occupations start to diverge. The data reveals that at the senior level, pay in more-exposed roles grew 45% between 2021 and mid-2026, while at the midlevel, there’s a smaller gap of 12% growth. Entry level roles only saw 2% salary growth.

“The data points to hiring restructuring rather than direct substitution,” says Kennedy. He adds that it’s not a reflection of senior raises funded by junior cuts, but rather a sign that employers are shrinking the entry-level pipeline into AI-adjacent roles, while concentrating hiring and pay gains at the top.

A spectrum of skills

This data also supports the idea that AI is creating a push for soft skills in tech positions, while the industry has been traditionally focused on hard skills. But as AI learns and adopts hard tech skills, it’s becoming more valuable to have experienced, skilled tech workers who can oversee the AI outputs and ensure they’re correct.

“Employers appear willing to pay more for the ability to effectively oversee, integrate, and correct AI output,” says Kennedy. “The fact that pay premia scale with seniority suggests that experience and expert judgement are particularly salient qualities. At entry level, the smaller pay premium for AI exposure points to the complementary effect being thinner.”

AI is evolving to be a complement to skilled workers, rather than a replacement, and is changing market demand and average pay for traditional IT and tech skills, according to the report. It’ll be crucial in the next few years for tech employers to ensure their pay for high-exposure occupations continues to scale with other AI-adjacent industries to maintain competitive stature in recruiting and hiring.

Alternative clouds have emerged amid major cloud providers such as AWS, Google Cloud, and Microsoft Azure, and often specialize in niche areas like AI-native computing, and sovereign and edge deployments, while professing to provide cost reductions and best-of-breed performance.

“Many organizations are rebalancing away from all-in hyperscaler strategies to avoid lock-in and concentration risk,” says Kyle Campos, CTPO at CloudBolt, a cloud management platform. “At the same time, alternative clouds are often purpose-built for specific advantages.” To him, benefits include lower-cost object storage at scale, better edge performance for latency-sensitive apps, and faster access to dedicated GPUs for AI workloads. Data sovereignty is also pushing adoption of localized providers.

But as alternative clouds, also called neoclouds, make headlines and amass considerable funding rounds, their use in enterprise environments remains relatively nascent. While enterprise executives see the potential in using alternative clouds, especially for GPU workloads, many are skeptical, taking a balanced approach to assessing maturity, costs, and whether it’s worth sacrificing continuity with existing clouds.

Smartsheet CIO and CISO Ravi Soin is one of these executives taking a measured approach. “We’ll grow our use of alternative clouds, but within a clearly defined perimeter,” he says. “That discipline is what separates considered adoption from sprawl.” For Soin, many neoclouds still fail early in the evaluation process, especially for regulated workloads where a mature compliance posture is non-negotiable.

In order to fully evaluate alternative clouds, the platforms must be treated with the same vigilance as any other IT acquisition. “This remains consistent across any tech stack: fit, form, and function,” says Nigel Gibbons, director and senior advisor at the NCC Group, a cybersecurity consulting firm. “This means alignment of the cloud to workload performance, security, and sovereignty needs.”

Overall, CIOs aren’t rushing into alternative clouds. It’ll take a serious proof spanning regulatory impact, auditability, resilience, and total cost planning in order to convince large organizations to migrate away from well-established cloud infrastructure. More realistically, such clouds will be evaluated on a per-workload basis.

Compliance and transparency

When evaluating neoclouds, compliance is top of mind for enterprise executives. “Compliance posture such as SOC 2, ISO 27001, and sovereign-specific certifications like FedRAMP or IRAP is the first filter and, for most neoclouds, an early exit,” says Soin.

Smartsheet runs AI on enterprise customer data and therefore requires strict compliance and sovereignty frameworks. “That defines a hard boundary where regulated workloads stay with certified providers,” he adds. “Workload identity doesn’t federate natively across clouds, so every trust relationship must be hand-built and audited. For a platform where data sensitivity varies enormously, that governance gap isn’t theoretical.”

Gibbons adds that trust validation is becoming a pressing requirement from regulators and the overall market. “The uncomfortable truth is that most organizations have operated on deferred risk captured in registers, softened in board narratives, and tolerated due to limited visibility,” he says. The pattern of tumultuous changes in the AI market, he adds, is encouraging more of a resilience mindset among technical executives assessing new technologies.

Operational transparency is another pressing area to evaluate. For Soin, the infrastructure that supports AI workloads requires granular auditability. “Can the provider give you end-to-end observability across the inference layer: tamper-evident logs, model versioning, the ability to trace what happened to customer data from input to output?” he asks.

Smartsheet’s enterprise customers also ask how AI is applied to their data and what controls exist, and that answer has to be defensible. “A neocloud that can’t support it isn’t just an operations risk, it’s a risk to the customer trust our business is built on,” he says.

Per-workload evaluation

Although neoclouds are often framed as a replacement to hyperscalers, they’re more often complementary infrastructure, purpose-built for individual use cases. “A neocloud isn’t a type of cloud, but more a design principle,” says Gibbons. “We can think of it as infrastructure optimized for a specific workload, trust model or control requirement, rather than general-purpose scale.”

Their usage hinges on the project at hand, which typically involves AI/ML projects. “We work with a mix of alternative providers depending on workload fit,” says CloudBolt’s Campos. “We’ve used alternative cloud providers for VMware as part of a cloud migration strategy.” Their customers use alternative clouds for object storage, edge and low-latency needs, AI/ML GPU capacity, and legacy virtualization workloads that don’t map cleanly to hyperscaler-native services.

Executives must determine which environment makes sense for the workload at hand, and act accordingly. “CIOs should begin by clarifying the specific workload opportunity an alternative cloud is meant to accelerate, then evaluate providers against developer and operator experience inclusive of ability to scale with business need,” adds Campos. “From there, the priorities are whether the platform can be governed and operated alongside existing clouds, with strong visibility into usage and unit economics. Security, compliance posture, and credible SLAs for reliability and performance should be evaluated at the same bar as hyperscalers. The goal is to add flexibility without creating a new operational silo.”

Not all workloads are a fit for neoclouds or alternative providers, however. While these platforms benefit numerous workload-specific options, they’re not viewed as wholesale replacements for hyperscalers. For general-purpose enterprise functions, hyperscalers may still retain advantages around integrated services, discounts, operational maturity, and the availability of relevant job skills.

For this reason, many technology leaders are still in an exploratory phase. “Our infrastructure today runs on hyperscalers, and that’s been the right choice for where we’ve been,” says Smit Shanker, global CIO of Xebia, a global IT consulting and software engineering company. Still, he encourages CIOs to begin actively evaluating alternatives. “We’re now in that evaluation phase, looking at where specialized providers, sovereign options, or hybrid approaches make more sense for specific workloads.”

Shared responsibility model

CIOs require a high-degree of enterprise-grade trust that must be codified beyond empty promises and proven under real-world stress tests. As such, before diving headfirst into a newfangled cloud, Smartsheet’s Soin advocates verifying its shared responsibility model, which stipulates commitments the cloud provider has to uphold, and where responsibility lies with consumers.

For Soin, it’s especially critical to understand how a cloud provider acts when incidents occur. “Request post-incident reviews before signing anything, not templated RCAs but the real communication timeline,” he says. “Shared responsibility models are well-documented until they’re tested. Find out what happened the last time they were tested.”

Ultimately, alternative clouds need to meet the same enterprise maturity bar as established cloud providers. “Assurances must include auditability, compliance, resilience, transparent SLAs, interoperability, portability, and independently validated trust, not vendor assertions,” says NCC Group’s Gibbons.

Total cost analysis

Understanding the economic impact is necessary to determine whether an alternative cloud is worth it for the business. This is an area where alternative clouds shouldshine, with reports estimating savings of up to 70% compared with hyperscaler GPU instances. Traditional cloud computing pricing models are often opaque, and charges related to add-ons, upsells, and hidden fees around egress and ingress are notoriously known to surprise cloud computing consumers.

For certain workload categories, the economics can favor alternative clouds. “Traditional cloud providers often impose substantial data egress fees that inflate the total cost of ownership for data-heavy architectures,” says Dave McCarthy, VP of cloud and infrastructure services at global market intelligence and advisory firm IDC. “Alternative providers frequently minimize or eliminate these bandwidth penalties entirely, offering a more transparent cost structure,” he says.

Still, a full cost audit is necessary before going all-in on an alternative cloud. “What I’d recommend to anyone is do the full-cost model before you commit,” says Shanker. He suggests conducting a comprehensive analysis of cloud compute, inference, API volumes, and maintenance costs for things like infrastructure upgrades projected against the actual demand curve. When viewed together, he says, they create compounding costs that most C-suites haven’t modeled.

“Most enterprises are still modeling cloud economics on implementation costs alone, and that’s incomplete,” he adds. “The organizations getting AI right are the ones treating infrastructure economics as a first-class design decision, not a footnote.”

As cloud infrastructure choices can produce vendor lock-in, CIOs should use all the criteria at their disposal to plan and inform a neutral decision-making process. “Whatever path you choose — hyperscaler, alternative, sovereign, or some combination — the discipline that matters is vendor-agnostic, framework-led design,” adds Shanker. “Don’t let infrastructure choices constrain what’s possible.”

Where the market is heading

Neoclouds have made a mark for themselves by offering direct access to latest-generation hardware, which is important for AI-focused workloads requiring high performance. There’s also the argument that opting for alternative clouds aids a distributed multi-cloud strategy, which can benefit resilience and meet certain regional sovereign cloud mandates.

Nearly 90% of IT leaders say an organization should never commit to one cloud provider for their entire architecture, according to a HostingAdvice survey from last year. The same study found 73% of leaders use two or more alternative cloud providers, underscoring a clear interest in alternative clouds.

Still, while some industry reports are favorable, enterprise executives express more of a cautious reality of selective evaluation, not wholesale migration. For Soin, a top concern is the compliance posture and observability capabilities for alternative clouds, especially when hosting workloads that run AI inference. “The question isn’t just where inference happens but whether we can see what happened, explain it, and stand behind it,” he says. “That obligation shapes which providers are even in the conversation.”

While state-of-the-art cheap GPU compute is alluring, CIOs should keep an eye on the full governance picture when evaluating alternative clouds. “The neoclouds that earn more of our workload won’t just be the ones with the best GPUs,” says Soin. “They’ll be the ones that have seriously invested in model governance infrastructure and can demonstrate it. That’s a higher bar than most currently clear, but it’s where the market needs to go.”

A focus on inference

IDC forecasts that by next year, the computational demands of AI will force 80% of organizations to modernize legacy cloud environments by switching to platforms designed for AI workloads, with half of this being processed locally on endpoints or edge nodes by 2030.

“Enterprises are increasingly looking beyond major hyperscalers to avoid vendor lock-in and optimize specialized workloads,” says IDC’s McCarthy. “Rather than relying on a single, centralized infrastructure, organizations are adopting these alternatives into a broader portfolio.”

Much of this new computing paradigm will center on inference, or the post-training execution of AI models in production, using live customer or enterprise data. As inference moves into more business-critical workflows, decisions about where those workloads run, and what criteria guide those decisions, will have long-term implications.

Alt and neo clouds will likely have their place in inference, as well as in future sovereign and decentralized cloud models, and it’s not a decision CIOs should take lightly or without an informed evaluation framework. “Where workloads run becomes one of the most consequential decisions a leader makes,” says Shanker.

Microsoft believes the era of enterprise agentic transformation is here, underscored by a slew of Microsoft Fabric announcements at the European Microsoft Fabric + SQL Community Conference in Barcelona today.

“We’re going to talk a lot about the notion of how you prepare your data estate to really provide the context for AI agents to help you transform the organization,” Amir Netz, CTO of Azure Data, told CIO.com last week.

At Microsoft Build 2026 in June, Microsoft unveiled Rayfin, a new open-source SDK and CLI that supports AI-assisted development. Now Microsoft has introduced Fabric Apps, which leverages Rayfin to bring applications development directly to governed data in Microsoft Fabric. The idea is to help organizations build and scale AI-powered applications with new capabilities for data connectivity, transactional workloads, backend logic, storage, and policy-controlled access.

“It’s not just the data itself,” Netz said. “You can build the entire app, including the web pages, the business processes, the functions, and you can build it end-to-end in Fabric. You don’t need to deploy containers. It’s fully hosted, fully managed, fully governed, only Fabric.”

Strength in numbers

Microsoft is also introducing new agentic data engineering features in Fabric that stem from its acquisition of Osmos in January. The AI-based data engineering firm’s tech uses agentic AI to turn raw data into analytics, and AI-ready assets in OneLake, the data lake at the core of Microsoft Fabric. With these new features, engineers can now define an outcome and set boundaries, and an agent can autonomously execute the work, validate the results, and refine the approach.

“They have this secret sauce of how to get really high accuracy from agents in very complex data engineering projects that you can’t just achieve by telling Claude to do it for you,” Netz said. “No matter how well your prompt is constructed, it’s not going to be good enough. The accuracy level we’re getting from this Osmos technology is significantly higher than any other commercially available agentic system from the best frontier labs.”

Meanwhile, Observability in Fabric is a new feature to support proactive operations rather than reactive troubleshooting. The Monitor Hub provides a unified view across jobs, capacities, workspaces, and workloads. Operations agents and Activator help teams investigate issues, identify root causes with AI, and automate responses.

“Observability is required for teams to both debug their projects and manage projects after they’re released in production,” Netz said. “It’s spanning both agents and code because you have agents that are going to call code, and you need to have the entire journey of the logic, and the execution from end-to-end.”

Shot in the arm for admin

For administrators, Database Hub in Fabric, now in public preview, provides a central control plane for managing SQL Server, Azure SQL, PostgreSQL, Cosmos DB, and SQL databases in Fabric. This helps administrators monitor and govern their entire database estate.

“Fabric is becoming the center point for everything data at Microsoft and everything that’s context based on data,” Netz said. “Fabric has always been about unifying all the data services, unifying all the data, and unifying users in one place. Now it unifies the entire inventory of databases, both in Azure and on-premises, in one place. You can find all your databases, monitor them, manage them, administrate them, and do it all with the help of an agent.”

To help companies share data with agents outside organizational boundaries, Microsoft has also introduced IQ Share in Microsoft Fabric, which allows organizations to securely share data and the business context around it while maintaining governance.

“The agents work on the same copy across the two organizations and the context comes with it so agents on both sides can really understand the meaning of the data,” Netz said.

From an enterprise perspective, AI sovereignty means complete control over the entire AI stack. For businesses with the human, technical, and monetary resources, this may be possible. For the vast majority, however, external help is required. The danger, as with any vendor relationship, is being locked in to a supplier or technology. With a mature technology that performs discrete tasks, that may not be a problem. But with an emerging and rapidly evolving one like AI and its ability to impact multiple processes across an enterprise, difficulties could arise. Gartner recently predicted that AI platform lock-in will increase from 5% now to 35% next year. So how do you avoid being in that high percentile?

1. Be clear of the trade-offs

As might be expected, there’s an inverse relationship between lock-in risks and operational overheads, including upfront costs, longer-term licensing fees, and internal talent requirements. Relying on open-source models, applications, and self-hosting is the lowest risk in terms of lock-in, but it requires a significant investment in AI engineering skills and infrastructure. In the middle, a multi-cloud or hybrid API approach provides high flexibility to swap underlying models, but relies on managing the abstraction layer. The fastest way to AI deployment is contracting a proprietary all-in-one platform requiring less operational overhead, but risks longer-term vendor dependency.

2. Break down the stack

A key priority to reduce AI lock-in is decoupling that application layer from the model layer. Deploying orchestration frameworks like LangChain or LiteLLM creates a controllable layer between the software applications an enterprise already uses, and the underlying AI models. The backend LLMs can then be swapped around as needed with minimal code rewrites. Model-agnostic architecture at this level ensures new models can be brought in as older ones become obsolete. The one certainty in AI at the moment is rapid change.

3. Keep an open mindset

Frontier models from OpenAI and Anthropic may still lead the pack in terms of performance, but open models (open weight and open source) aren’t far behind. The 2026 Stanford HAI Index shows the performance gap as 3.3%, making open models a serious option for many enterprise deployments. The overhead here is fine-tuning those models, which will usually require third-party help. Preventing this becoming a pathway to lock-in requires ensuring the weights, parameters, and training configurations remain exportable and your intellectual property.

4. Protect your crown jewels

With varying degrees of friction, all technology is replaceable but your data isn’t. Enforcing strict data portability and pipeline autonomy are the core foundations to building a sustainable AI strategy. “The only truly sovereign AI is the one that doesn’t present a new form of lock-in,” says Chris O’Brien, CTO of AI systems integrator, Advania UK. “The assets a CIO can’t substitute are their data and intelligence of how their business actually works. At that level, models are largely interchangeable unless you built your architecture around a single one.”

This requires keeping data preparation, vector databases such as Pinecone, Milvus, and Qdrant, as well as storage layers outside any single vendor’s proprietary AI cloud. Organizational knowledge stores, embeddings, and training data should be kept in open, standardized formats that can be easily re-indexed and, if necessary, migrated to a different platform.

5. Plan your exit

The market for AI products and solutions will look very different in a year’s time. Models are heading to commoditization as performance improvements shrink between generations, open-source alternatives improve, and competition among frontier model providers will likely see falling token costs. Avoiding long-term volume and/or spend commitments will help enterprises more safely navigate this rapidly evolving scene. Negotiating pay-as-you-go or short-term contracts can reduce risk as well as ensure contracts explicitly state your ownership of all prompts, inputs, outputs, and derived contextual metadata.

6. Build your internal skill base

Building core engineering expertise internally around core AI engineering standards such as Python, containerization, and API management will provide a solid foundation for future growth. Knowledge of vendor tools is important, but to build capability for an uncertain future requires foundational and adaptable skills.

Every business is unique

Eventually, AI technologies and platforms will mature into a more stable environment for businesses. Deployment decisions made now need to build in sufficient flexibility to adapt to this uncertain future. For most enterprises, SMBs in particular, there’s a massive imbalance in knowledge, resources, and skills compared to AI vendors and consultants at the leading edge of this transformation. Protecting your unique data assets and knowledge of your workflows, and the sector you operate in to build a replaceable AI layer on top of that, is the way to a more sovereign future.

For many years, Musinsa, South Korea’s premier online fashion platform and marketplace for Korean designer brands, streetwear, and beauty products, has described itself as a company dedicated to AI. They bring in AI-native talent and give employees room to experiment, yet meticulously manage token usage and work performance.

And instead of handing over AI completed by engineers to the field, they have the field restructure their own work using AI. So if external solutions are deemed lacking, they analyze the cause and create their own solutions.

Gil Gi-yong, the company’s director of core AI and CX engineering, began actively utilizing AI shortly after joining Musinsa last year when he saw AI evangelists, from the CTO to new employees, directly create results. He says that Musinsa changes faster than organizations he’s experienced before, so he’s diligent about anything new that comes along to augment its developing internal AI platform.

Director of operations Kim Dae-ho is on the same page, too. Kim, who joined in September 2022, currently leads the operations strategy team that’s responsible for planning and executing tasks to improve customer and partner experiences, and improve operational efficiency across Musinsa’s commerce ecosystem. Recently, most of his work has been closely related to AI, so he’s collaborating with the development team to lead AX projects.

Musinsa is investing so much in AI is because trends change rapidly and fashion consumers can be impulsive. So platforms have to be fast, anticipatory, and intuitive to meet demand. In addition, they should support areas such as sales management for partners, and AI is the means to meet these needs and boost business competitiveness. That’s how Musinsa has started solving unique fashion industry problems.

A prime example is how outfit photos are shot. To showcase products in the past, models were hired, they dress themselves, and it’s all shot in a studio. Now, AI is used as a coordinator to generate images and the goal, according to Gil, is to elevate visual AI tech to a top standard by H1 2027.

Plus, AI is used in the product registration process of partner companies, so when a product is registered, AI automatically infers categories, colors, materials, and more. In the past, these tasks were manually entered. Holistic AI has also been integrated into customer service centers. The AI chat agent operated by 29CM, a South Korean fashion and lifestyle platform operated by Musinsa, currently handles about 25% of all customer inquiries.

From business operations to ROI

Companies typically approach AX in two ways. One is for the engineering team to get the requirements of the field, develop the system, and then say try it, and pass it on. If it’s hard to solve internally, the other way is to leave it to an external vendor. But Gil sees that AX often fails in these two approaches.

“The reason is that engineers do AX, but they don’t fully understand the processes of the field,” he says. “That’s why we focus on creating an environment where field experts can directly improve the actual work processes.”

In fact, Musinsa’s AX-related ideas are directly proposed by each business team. For example, the planning and engineering departments review how to improve on repetitive tasks with LLMs by setting quantitative goals such as reducing tasks from 270 man hours per week to three.

The core of the approach Musinsa choses is next. Engineers don’t write scripts for them. Instead, the core AI team suggests guides until target figures are achieved through repeated testing. Gil says this process ultimately helps the business operator measure how to write prompts and what improvements they use to improve them.

This approach has also changed the process by which AI spreads. Instead of copying systems created by developers, colleagues directly use AI to improve actual work. As small success stories accumulate and are shared, overall AI utilization capabilities also increase.

Gil adds that this approach must align with the direction of leadership. Simply sending tasks down by saying try using AI and costs will be covered isn’t enough to drive adoption. At Musinsa, many leaders, including the C-suite, first experiment with AI and freely share results. This culture encourages voluntary experimentation and accelerates the spread of AI. 29CM’s AI chat agent was reputedly developed using this method.

In fact, this tech was developed in collaboration with outsourced companies, and produced a certain level of output, but the strategy was revised to in-house development. Those results were actually better, according to Gil, and they succeeded in launching quickly while reducing costs to about a third of the outsourcing method. The development period was also about a quarter of similar projects at other companies.

However, this speed isn’t simply due to AI. ROI verification is thorough and Musinsa first fixes timelines and budgets, then prioritizes requirements to implement within that framework.

Even before starting, cost issues are carefully considered. For example, they calculate a five-year TCO and first check when investment costs can be recovered as savings. When using external services, they don’t sign long-term contracts based on simple discount benefits. Kim says that starting a project based solely on rough cost estimates may result in significant investment but doesn’t achieve the expected efficiency.

For AI chat agents, they quantified the estimates generated by the technical team, and simulated how much customer satisfaction would change and inquiry rates decrease. Investment costs were also calculated by year and month.

After implementation, monthly tracking is conducted to see how costs differ from expectations, how the AI processes inquiries, and how close performance is to the original target. If differences from expectations occur, improvements are made, including which variables to add, if the scope of inquiries handled by AI should expand, and if agent workflows should change.

Generous support, but objective evaluation

For this approach to continue, a supportive organizational culture is necessary. First, Musinsa provides a substantial amount of tokens so its members can fully utilize AI. But token usage is actively managed, so each leader regularly checks it using separate monitoring tools. If too many are used for tasks that could be handled with fewer, it’s looked into. Conversely, tasks that could be completed much faster with AI are still subject to inspection even if they’re handled using traditional methods.

Kim says that ultimately, what matters isn’t whether AI was used, but what results were achieved and how many resources were invested in the process. If AI can improve the quality of deliverables and reduce time in the work, it should be actively utilized. But the costs invested and the results achieved should be considered together.

Naturally there are times when using AI when multiple rounds of testing are gone through before desired results are reached. This means more tokens and time are required, and costs increase. But Musinsa focuses more on what trial and error was experienced, what was learned in the process, and what can be done differently next time. Failure is also seen as data that increases the chances of success next time.

AI leader standards for talent

What kind of talent do AI-led companies need? Not so much proficiency in AI itself but the ability to properly define problems. Kim defines planning as a journey of problem-solving, meaning a series of processes to identify them, develop solutions, and execute. It’s become even more important for humans to define what to ask of AI. If the problem definition is ambiguous, no matter how plausible the AI is, it’s difficult to apply it to actual work.

Of course, acquiring these skills isn’t easy. Kim says that training to constantly ask why is helpful. He doesn’t just accept initial causes as they are, but searches until a real solution emerges.

“At first, it’s confusing,” he says, “But through intense discussions and debates, capabilities develop. If the opponent isn’t a human but an LLM, you can repeat the same process much faster.”

Gil’s standards to evaluate development talent are similar. He believes people who can think differently from traditional methods are now needed, and relying solely on experience and technical expertise is no longer a sufficient nor competitive advantage.

In fact, this is reflected in Musinsa’s AI native developer recruitment. The focus isn’t on simple algorithm proficiency, but on how well the applicant defines real-world problems, grasps the essence of the problem, and uses certain indicators to determine whether to solve the problem, even when freely using AI.

The principles of leadership aren’t much different. Kim defines his style as autonomy-based leadership, while Gil prefers to clarify responsibilities and authority. The common goal, however, is to have an organization that doesn’t rely on any single individual.

In terms of next steps in AI transformation. Gil believes that competitiveness depends on who’ll first leverage new technologies, and how quickly that experience will transform into organizational capabilities. But AI led by tech organizations has its limits. Models that worked in commerce don’t work offline as is, and a single model can’t transplant across all areas of the company. So each organization must handle AI based on its own domain of expertise.

This is where Musinsa is headed. It’s not a company that relies on a few AI experts, but a place where anyone can wield AI in their work. “I want to establish a company where every employee solves their own problems with AI, and accumulates that experience as an organizational asset to show we use it well,” says Gil.

Data is the fuel for AI since generative, agentic, and ML systems are only as effective as the information they consume. Across all stages of the data lifecycle, including creation, storage, usage, archival, and destruction, CIOs and their business peers must consider how information feeds AI services.

Almost two-thirds of organizations are unsure whether they have the right data management practices for AI, says Gartner. The tech analyst predicts organizations will abandon 60% of AI projects by the end of the year due to a lack of data readiness. In such circumstances, a potential competitive advantage quickly becomes an innovation cul-de-sac.

CIOs who want to exploit AI will need a way to improve data management across the lifecycle, and it’s here where AI itself can play a crucial role. Gartner recommends organizations build on their existing practices by iteratively adding AI-specific services that extend and improve data management techniques.

Stephen Wood, COO at Rathbones Asset Management recognizes this opportunity, and he and his firm’s staff are eager to avoid lifting and shifting information from one place to another in its data management efforts. AI could help.

“Our people want to run models to look at the data, whether that’s the shape, structure, value, or whatever it happens to be,” he says. “If that task becomes something AI can do, I’m not sure yet. But given its power, it seems obvious you’ll be able to manage elements of the data lifecycle.”

Digital leaders suggest AI can improve information management processes, but there are limitations. First, they must recognize that emerging technology needs high-quality data, and then they need to identify key challenges, particularly around governance and trust. Then they must carefully explore where AI can play a key role.

Establishing data quality

For some digital leaders, a clear direction for data lifecycle management is already part of the operating process, including using AI.

Alwin Bakkenes, head of software engineering at Volvo Cars, says his company’s driver assistance systems (ADAS) rely on high-quality information. With a strong heritage in vehicle safety, Volvo has collected millions of data points since 2020, all with customer consent, to improve its collision-avoidance systems.

“In our ADAS stack, data curation is one of the most important elements,” he says. “There’s a lot of data coming in from a large fleet, and we curate it and figure out what information we need to make model training more efficient.”

Bakkenes gives the example of collecting data from vehicles to help understand traffic hotspots, such as large Parisian roundabouts. His team sends triggers to sensors to collect more data, which is then used to train AI models and test whether they behave as expected.

“It’s quite an open loop but that’s our data management strategy,” he says. “And this insight must be maintained and curated over time. Crucially, more data isn’t always the best data. Instead, data quality matters, and we’ve had good data for a long time.”

This strategic approach to information collection chimes with Ankur Anand, group CIO at recruiter Harvey Nash. He says successful data lifecycle management in the age of AI involves four underlying processes. “First, the data has to be findable, which means AI can locate the relevant information without relying on a professional’s knowledge,” he says.

Second, data must be understandable. He gives the example of multinational companies using different definitions across the business. “If there’s no common language or consistent terms, the context will vary, the AI will interpret the data differently, and that can have a big impact on the decision-making processes,” he says.

The third core element is data must be trustworthy. “The cleanup stage is very important,” Anand says. “The data must be permissioned appropriately so you don’t have an issue with people seeing information they shouldn’t be seeing. Confidentiality is crucial, because if the trust is broken, people won’t use AI.”

Finally, data must be usable at speed, which relies on the three previous processes. “It shouldn’t take people long to get a proper summarization, comparison, or reasoning from AI.”

Recognizing the potential, with limitations

Once data quality is established, digital leaders can start to consider how emerging technology can be inserted into stages of the data lifecycle.

Take Emmanuel Frenehard, chief digital officer at biopharmaceutical giant Sanofi. “I think AI can help surface gaps in data,” he says, referring to emerging technology, such as Snowflake’s agents, to scan information and identify areas where decision makers lack detailed insights.

Frenehard adds that AI can also help correct data. Most of his firm’s clinical trial data involves some element of human correction, and emerging technology can spot anomalies. “That’s very useful,” he says. “We use AI as a data governance methodology for clinical trials, where we review everything that comes in and self-heal the data.”

However, while these capabilities exist, Frenehard says there are limits. In a heavily governed industry like biopharmaceuticals, a probabilistic AI model that uses statistics to predict likelihoods and manage uncertainty can be helpful, but it can also create risks. His firm isn’t prepared to use AI to manage data without human input.

“The potential is there, but the trust would have to be there, too,” he says. “I always have concerns with probabilistic models. Probabilities are never 100%. There may be areas of business where it’s okay not to be 100% certain, yet there are also areas where it’s not, such as patient data and treatment recommendations.”

That sentiment resonates with Bernhard Seiser, VP of digital, data, and IT at AOP Health, who says his firm isn’t using AI to manage the full data lifecycle. He says discussions about data often cover similar concerns in big, heavily governed sectors, especially when considering whether AI is ready for information management.

“In our industry, 99% certainly doesn’t help me in a data space that needs to be 100% accurate,” he says. “But of course there are areas where you can leverage AI. For example, if you bring in new data sources, having somebody from the business available to describe each field is tough. For that task, gen AI tools can do a fantastic job.”

Seiser says his organization will continue to explore emerging technologies, but temper expectations. More AI might mean a degree of uncertainty that’s unpalatable, and right now, pioneering developments that could push AI-enabled data lifecycle management to new heights seem a long way off.

“For the more sophisticated stuff, like creating data products, writing queries, and so on, you always need to live with the fact that it’s not 100% certain,” he says. “I’ve spoken with technology experts, and people are unsure the technology will be ready for managing the full data lifecycle in five or even 10 years.”

Exploring solid use cases

While digital leaders aren’t eager to automate the data lifecycle in its entirety, pioneers recognize AI brings new efficiencies to specific stages of the process.

Michael Cole, chief technology officer at the DP World Tour, has spent the past two years working with key partners, such as HCLTech and AWS, to digitize his organization’s historical archive of over 50 years of data, covering 20,000 tapes, 27,000 hours, and 1.2 petabytes of content. This process has helped highlight the value of AI-enabled data management.

“That’s only the start of the journey,” he says, referring to the transformation. “We’re about to announce a new platform for media asset management, which means we’ll not only have all archived content in a digital format, but it’ll be easily accessible for internal resources, media, broadcasters, partners, and ultimately fans as well.”

Cole says this work illustrates the organization’s focus on digitizing information and making it available to younger fans who want to consume sports content in myriad ways. As this process gathers pace, emerging technology will play an important role in data management.

“We already use AI to automate the clipping of player shots, and we’ll continue to use AI for metadata tagging because that process is critical to creating an efficient way to source content and data,” he says. “Everything must be tagged accurately to enable that efficiency. We think gen AI and agentic technology will evolve to boost the efficiency of not only producing content but making it accessible to our fans.”

Freshworks CIO Ashwin Ballal is another digital leader who says AI can help manage stages of the lifecycle, such as the manually intensive data-cleansing process. An AI agent should be able to speed up that laborious process exponentially.

However, Ballal also suggests the key point isn’t whether AI can do data management work quickly, but whether tools work effectively to improve data integrity and quality. The good news is model training can help boost effectiveness. Now his firm is looking to insert agentic AI into the data management lifecycle.

“We’re just beginning that process,” he says. “We have a Databricks platform and have built LLMs and agents on top of the data. So if you’re a salesperson, you’ve got a sales agent, a marketing agent, and a product agent. This technology taps into the power of the data.”

In the wake of rapid AI adoption, organizations are now facing a broadening skills gap as the technology has been integrated faster than employees can develop new skills. The CompTIA Workforce and Learning Trends 2026 study found that, overall, companies cite some of the biggest challenges of AI adoption as insufficient skills using AI (24%), insufficient core domain skills (24%), and insufficient integration skills (21%).

Skills gaps remain one of the biggest issues for business transformation, with 63% of employers citing it as a major barrier, according to the 2025 Future of Jobs Survey from the World Economic Forum. In response, 85% of employers said they plan to upskill their workforce, 70% said they plan to hire new staff, and 50% said they plan to transition staff from declining to growing roles.

Establishing a strategy for training and upskilling can help companies develop quality skills-based training programs that help remedy skills gaps. However, organizations will also need to be mindful of providing employees with a career roadmap that includes on-the-job training, and thoughtfully considers the impacts of AI on their overall career growth.

Organizational factors driving training needs

While AI will impact most job roles, some are driving the demand for AI training more than others. Roles in cybersecurity (38%), operations (38%), data management (38%), tech support (37%), IT Infrastructure (37%), customer support (34%), software development (31%), and project management (26%) were the top ranked roles pushing training needs. These tech roles were followed closely behind by non-tech ones in sales (25%), marketing (25%), finance (23%), and legal (13%), according to data from CompTIA.

Training priorities also vary by company size. SMEs are prioritizing AI training first, followed by AI security and then AI support. At large companies, that shifts to a focus on AI security first, then AI training followed by AI management. And at very large organizations, the priorities begin with AI security, followed by AI integration, and then AI training.

Cybersecurity needs have also paced alongside AI demands, as AI implementation has accelerated both the capabilities of security operations and the scale of threat vectors, according to CompTIA. Skills in cybersecurity as well as overall cybersecurity awareness in the organization will become increasingly important as businesses navigate AI adoption.

Based off data from the WEF, skills in highest demand include analytical thinking (68%); resilience, flexibility, and agility (67%); leadership and social influence (61%); creative thinking (57%); and motivation and self-awareness (52%).

These skills reflect the shift to AI implementation, increasing the demand for soft skills over hard skills. Organizations need professionals who can oversee AI outputs and think logistically and analytically about whether AI outputs are correct or at their full potential. These skills will also need to be considered in training programs; L&D will need to expand beyond hard-skills training to include modules on soft skills and other AI-related skills.

Challenging outdated perceptions of training

In 48% of cases, training is one of the biggest areas where businesses say they plan on investing, as companies shift their focus to integration within the tech stack and workflow. Training has shifted from focusing on foundational concepts to exploring deeper needs around AI fluency, as well as other emerging disciplines, according to CompTIA.

As a result, 57% of respondents said their company is investing in a new training program across all skill types, while 50% said they’re launching entirely new training programs focused specifically on AI skills. Additionally, 48% plan to update existing training programs with new AI modules, while only 11% said they’re not taking any related action at this time.

Organizations need to lead the charge on skills development for AI, the survey also found, in that only 43% of respondents felt their workforce is enthusiastic about AI adoption, citing low confidence of building skills (39%), and an unclear starting point for skills (35%) as two driving factors.

One hurdle many businesses face surrounds the perceptions of on-the-job training, which might require a shift in company culture. A report from TalentLMS on Learning and Development in 2025 found that almost half of employees and HR managers agree that, at their companies, time spent training is viewed as time away from real work. This presents learning as an interruption rather than an advantage.

But the survey also found that 64% of companies plan to upskill and reskill existing employees, so it’s important for organizations to evaluate internal attitudes toward training, especially considering that 86% of employees said they do, in fact, learn new skills hands-on through on-the-job training. For many employees, integrating training into their daily workflow can also help improve outcomes and make it more likely that employees will embrace upskilling programs.

Full commitment to the cause

Companies need to develop a realistic picture of how employees view training opportunities available in the organization. The survey from TalentLMS found that 83% of HR managers say they believe their company actively supports employees in learning how to use AI, but only 64% of employees said the same. Implementing effective training programs for AI will require strong communication and collaboration between HR, IT executives, and L&D teams to ensure employee training needs are being met.

AI adoption has taken hold at a rapid pace, and training programs need to reflect that in tandem. For many employees, they report feeling behind on AI skills, unsure of where to start and how to gain the necessary skills for the future of their job roles. Establishing a strong AI strategy that considers training can help organizations make the most of their AI investments, and ensure skills gaps are met as the technology evolves.

A practical, commercial quantum computer is over a decade away, executives at Japanese IT services company NEC are reported as saying.

That’s why, according to Japanese news publication The Mainichi, company has pulled the plug on its plans to develop a quantum computer — although it will still continue research into quantum technology.

NEC sources told The Mainichi that it would take at least a decade to build a quantum computing that could be put to practical use, and it would be difficult to monetize the technology.

This is quite a turnaround for NEC which three years ago was talking about its advances in quantum and its plans to accelerate investment in the technology.  The company is certainly bucking the trend as quantum computing is seen as being very much at the cutting edge of research. Pioneers in the field were awarded the Nobel Prize in Physics last year, while companies such as Nvidia and IBM are keen to boost their quantum credentials.

Despite its early successes in the quantum field, The Mainichi reports that NEC is lagging its Japanese competitors such as Fujitsu and Hitachi when it comes to the latest advances.

There is also the level of investment required. According to The Mainichi, Japan is set to commit just 10 trillion yen ($65.3 billion) to quantum computing by 2040, far lower than the sums invested by the US and China.

We’re talking about a long game. Quantum technology has been talked about for some time, but we’re still a long way from seeing the technology in the mainstream. NEC may not be the only company to decide the cost of investment is not worth it.