The uncomfortable numbers every CFO should know
In July 2025, MIT's NANDA initiative published a study that should give pause to every executive signing off on AI budgets. After examining three hundred public AI deployments and interviewing one hundred fifty executives, researchers found that of the $30–40 billion enterprises have invested in generative AI pilots, 95% delivered no measurable P&L impact.
McKinsey’s survey also provides a parallel picture. 88% of companies now use AI in at least one business function at least once a year, up from 78% a year ago. Adoption is clearly not the bottleneck. But when McKinsey asked how many businesses could point to real, enterprise-level impact on EBIT, only 39% said yes, and most reported improvements of less than 5% across the board. Just 6% of companies are what McKinsey calls "AI high performers.”
Simply put: nearly everyone is spending on AI, almost no one is making money from it, and that gap is not a technology issue. Today’s models are truly capable. The gap is a governance problem, or more precisely, the absence of one.
Why ungoverned AI adoption creates structural inefficiency
The failure pattern is strikingly consistent across industries and company sizes. Leadership buys a batch of licenses for a popular AI assistant. IT rolls them out. Employees get an email announcing the new tool and a vague expectation that “productivity will improve.” No one defines what “improve” means, no one measures a baseline, and six months later, finance is looking at a growing software line item with no corresponding line item on the revenue or cost-savings side.
This is not a hypothetical. Gartner has been tracking exactly this failure pattern. In July 2024, Gartner predicted that at least 30% of generative AI projects would be abandoned after proof-of-concept by the end of 2025, citing poor data quality, unclear business value, and escalating costs. By June 2025, the warning had sharpened for agentic AI specifically: Gartner projects that over 40% of agentic AI projects will be cancelled by the end of 2027, for the same underlying reasons. Looking further out, Gartner projects that through 2026, organisations will abandon 60% of AI projects not backed by properly governed, AI-ready data.
Notice what's common across every one of these numbers. It is never “the model wasn't smart enough.” It's always the same three words: strategy, governance, and data. In other words, it's not an AI problem. It's a management problem wearing an AI costume.
When AI is deployed without strategy, it doesn't just fail to add value; it actively drives structural inefficiency. You are paying for licenses that inflate your cost base. You are paying for the compute and API consumption behind those licenses. You are paying, often invisibly, for the security and compliance exposure created when employees start feeding sensitive data into tools nobody vetted. And you get none of the offsetting benefit, because nobody defined what benefit was supposed to look like in the first place.
The shadow AI problem
There's a second layer to this problem, and it's one boards and regulators are now taking very seriously: shadow AI. When companies fail to provide governed, sanctioned AI tools that actually meet employee needs, employees don't stop using AI; they simply route around IT.
Microsoft's Work Trend Index put AI usage among knowledge workers at around 75%, with the majority of those users bringing their own tools rather than sanctioned ones. IBM's report found that shadow-AI-linked incidents jumped from 20% to 43% of all AI-related breaches in a single year, at an average cost of over five million dollars per breach. That is the cost of ungoverned AI adoption made visible, and it is a cost that never shows up on the same spreadsheet as the license fees, which is exactly why it gets ignored until it's very expensive.
AI, deployed without strategy, does not create structural efficiency. It creates structural inefficiency: inflated cost, invisible risk, and no reliable path to value.
The fix: treat AI adoption like any other strategic investment
The good news is that this class of problem has already been solved: repeatedly, for every other transformative technology and major capital decision an enterprise makes. The discipline simply needs to be applied to AI rather than treating it as an exception.
That starts with a mindset shift: stop treating AI adoption as a procurement exercise and start treating it as a portfolio of initiatives, the same way you would manage a new product line, a market entry, or a digital transformation program.
Every serious AI initiative should be able to answer a short set of unglamorous questions before a single license is bought or model is built:
- What specific business problem are we solving, and for whom?
- What does success look like, in measurable terms: cost saved, cycle time reduced, revenue enabled, error rate lowered?
- What is the expected return on investment, and over what time horizon?
- What resources, data, and time will this actually require?
- Who owns the outcome, and who is accountable if it doesn't materialise?
McKinsey’s research on AI high performers found that the top differentiator wasn’t the model used or the budget spent, it was whether the organisation treated AI as a catalyst to redesign how work happens, with clear ownership and metrics, rather than layering a chatbot on top of an unchanged process. That discipline doesn’t happen by accident. It requires an organisational function responsible for enforcing it, systematically, every time, which brings us to governance.
Three layers of AI governance blueprint
Layer one: an AI Council and alignment with ISO/IEC 42001
If AI initiatives need a business case, a budget process, and accountable ownership like any other strategic investment, then someone in the organisation needs to play the role that a PMO, an investment committee, or a change advisory board plays for other initiatives. That's what I'll call an AI Council — some organisations call it an AI governance board, an AI centre of excellence, or an AI steering committee. The name matters less than the mandate.
- A properly constituted AI Council should:
-
- Evaluate and prioritise proposed AI initiatives against strategic objectives and available resources;
- Approve or decline initiatives based on business case, risk profile, and expected ROI;
- Set and track KPIs for every approved initiative, not just at launch but throughout its life;
- Own resource and time planning across the AI portfolio, so initiatives aren't competing chaotically for the same data science or engineering capacity;
- Maintain oversight of AI-related risk, such as security, privacy, bias, and regulatory exposure, across the whole portfolio, not project by project in isolation.
Instead of building this function from scratch, organisations can anchor it to ISO/IEC 42001:2023, the world's first AI management system standard, published by ISO and the IEC in December 2023. ISO 42001 is exactly that kind of structured, auditable governance framework for AI that ISO 27001 is for information security: knowledge about the organisational context, leadership commitment and AI policy formulation, AI-specific risks and objectives, and continuous monitoring and improvement the familiar "plan, do, check, act" cycle for AI development, procurement, deployment, and retirement throughout the lifespan.
Aligning your AI Council's mandate with ISO 42001 gives you three concrete advantages.
- Credibility with regulators, with customers doing vendor due diligence, and with your own board. Several major cloud and AI providers already hold ISO 42001 certification, and it's rapidly becoming a baseline expectation in enterprise procurement, the way ISO 27001 became for security a decade ago.
- Completeness — the standard forces you to cover risk management, AI system impact assessment, lifecycle management, and third-party and supplier oversight, so you're not left with governance gaps you discover only after an incident.
- Regulatory alignment — a common language and structure that maps cleanly onto emerging regulation, including the EU AI Act's risk-based requirements around documentation, human oversight, and post-market monitoring. You are not building a bespoke governance framework that you'll have to defend from scratch to every auditor and every regulator, you're adopting one that is already internationally recognised.
As for the last point, the EU AI Act came into force in August 2024 and has since then been implemented in stages: prohibitions and AI-literacy obligations from February 2025, general-purpose AI model obligations from August 2025 and general enforcement powers from August 2026. In light of the 2026 Digital Omnibus, the European Commission has confirmed that the obligations for high-risk AI systems are now in place from December 2027 onwards, and there is a further extension to August 2028 for AI embedded in already regulated products such as medical devices and machinery. The direction of travel has not changed: documentation, human oversight, and post-market monitoring for consequential AI systems have only moved the compliance clock. That is why an internationally recognised governance standard is important, not less: it means an organisation does not have to change its course to meet every regulatory change.
Layer two: processes, policies, and procedures
An AI Council with a strategic mandate is necessary, but on its own it's not sufficient. Strategy has to be translated into something an employee, a project team, or a vendor can actually follow on a Tuesday afternoon. That's the second layer: processes, policies, and where needed, detailed procedures and guidelines.
This layer answers the “how” question for everything the Council decides “what” and “why” on. Concretely, this typically includes:
- AI usage policy — what tools are approved, what data classifications may or may not be used with which tools, and what's explicitly prohibited, for example, pasting client-confidential data into a public consumer AI tool;
- AI system risk-assessment and approval process — a standard intake so every new AI use case, whether purchased or internally built, goes through the same risk, data-privacy, and business-case screening before approval;
- Model and vendor due-diligence procedures — how you evaluate a third-party AI vendor's own security, data-handling, and governance posture before connecting their model to your systems and data;
- Data governance procedures specific to AI — because, as Gartner's research on AI-ready data makes clear, most AI failures trace back to ungoverned, low-quality, or inappropriately used data rather than model quality;
- Human oversight and escalation procedures — particularly important for any AI system making or influencing decisions that affect customers, employees, or regulatory obligations.
None of this is exotic. It's the same category of control most organisations already have for information security or data privacy. The difference is that AI moves faster, touches more of the organisation at once, and, this is the part that trips people up, often gets adopted bottom-up, by individual teams downloading a tool, before top-down governance even realises it's there. That's exactly why policy alone isn't enough.
Layer three: enforcement, monitoring, and the feedback loop
This is where governance stops being a document on a shared drive and starts being something the organisation actually lives by.
Enforcement has two dimensions, and you need both:
