Who Is Allowed to Stop a Pilot

The argument — why the stop authority matters more than the reporting line

Every large company rents the same models at the same collapsing prices. What separates working enterprise AI from theater is whether anyone in the building holds the paired authority to stop a use case and force a workflow to change. Where the AI capability sits on the org chart settles almost nothing.

In April 2026 the Office of Management and Budget published the consolidated inventory of what the United States federal government does with artificial intelligence: 3,611 individually reported use cases from 56 agency submissions, of which 445 are flagged high-impact¹. A use caseThe unit this whole subject is counted in: one named application of AI to one job — screening a claim, drafting a notice, ranking a maintenance queue. It is not a system, a product or a licence. One purchased tool can carry a dozen use cases, and one use case can span several tools. It matters because the use case is what gets proposed, funded, approved, monitored and — in principle — switched off. When the unit stops being enumerable, so does the governance built on it. is one named application of AI to one job, and high-impactThe federal inventory's risk flag. A use case is high-impact when its output is a principal basis for a decision that has a legal, material or otherwise significant effect on someone's rights or safety. The test is about what the output does, not about how advanced the technology is — and it applies whether or not a human reviews the decision. The flag is what triggers the testing, monitoring and review obligations, and the rule that a non-compliant system must be discontinued. is the flag for those whose output can decide something about a person's rights or safety. Every figure computed in this brief comes from the published 3,611-row file itself², not from the summary. The governing policy for those 445 is unambiguous. OMB Memorandum M-25-21, Section 4(a)(i)³, tells agencies that "if a particular high-impact use case is not compliant with the minimum practices then the agency must safely discontinue use of the AI functionality." That is a kill rule, written into policy, with a named officer attached to it.

The file records how much of that rule was carried out. Of the 445 high-impact cases, 127 carry any answer at all in the risk-management fields — testing, monitoring, independent review, appeal. Forty-five report completed pre-deployment testing. Forty report established monitoring. None report a completed independent review; thirty-one report "CAIO Review" — review by the agency's own Chief AI OfficerAbbreviated CAIO throughout. In the federal system, the single official each agency must designate to lead its AI work: to advise on the strategy, hold the use-case inventory, classify risk, certify that a high-impact system may go live, and decide any waiver from the required practices. Section 7 of this brief separates the title into the four quite different corporate jobs that share it. — and ninety report "in-progress." The largest single holder of high-impact cases, the Department of Veterans Affairs with 215, left every one of those fields empty.

This is the best-documented AI organization in the world. It has a mandated officer in every agency, a mandated governance board chaired by the Deputy Secretary, a published inventory, and a written rule that says stop. Three years in, the stopping is not visibly happening. The lesson has nothing to do with government being slow. A kill rule without an owner who is measured on using it is a sentence in a memo. The private sector has no memo, and it is running the same experiment with less disclosure.

Executive takeaways — seven claims, each with the number behind it

1. 1The org-chart argument is downstream of the kill decision. Federal agencies reported 3,611 AI use cases for 2025 and marked 314 retired — 8.7%. Pilot sprawlThe characteristic failure of this field. New pilots start, few reach production, almost none are formally ended — so the count of "AI initiatives" rises every quarter while the number of processes actually running differently stays flat. The tell is that the portfolio has no exit: a programme reporting sixty use cases and two terminations is sprawling, whatever its headline adoption number says. — a portfolio of experiments that only grows, because nothing in it is ever finished or formally ended — is not produced by the wrong reporting line; it is produced by nobody holding a stop authority they are measured on. Moderate confidence
2. 2The governance paperwork is thinner than the governance rhetoric. Only 45 of 445 federal high-impact use cases (10.1%) record completed pre-deployment testingTesting a system against the job it is actually going to do, in conditions resembling the real ones, before it is allowed to go live — as distinct from a vendor's benchmark scores or a demo. It is the first of the federal minimum practices and the one a promotion gate is built around, because it is the last moment at which stopping something is cheap. — checking the system against the job it will actually do, before it is allowed to go live — and 318 record nothing at all, against a policy that requires discontinuation of non-compliant high-impact AI. High confidence
3. 3"95% of pilots fail" misstates its own source's arithmetic. On the MIT NANDA funnelA stepwise count of how many organizations survive each stage of a process — here: looked at AI, ran a pilot, reached production. Its usefulness depends entirely on which number you divide by. Divide the survivors at the end by everyone who entered at the top and you get a headline failure rate; divide them by the ones who actually reached the previous step and you get a conversion rate. Those are different questions with the same arithmetic. — 20% of organizations piloted, 5% reached production, meaning the system runs inside the real business rather than as a trial — roughly a quarter of the organizations that actually ran a pilot cleared the bar. The 95% counts organizations without a production system, most of which never piloted. The study rests on 52 interviews and 153 survey responses and calls its own figures "directionally accurate." High confidence
4. 4The Chief AI Officer is common in surveys and rare in disclosure. Wharton's 2025 panel of ~800 US enterprise leaders puts CAIO roles at 60% of enterprises; a full-text search of every SEC filing between 1 January 2025 and 31 August 2026 returns 126 documents carrying the phrase, from 42 filers, of which only 25 are the 8-KThe form a US-listed company files to report a material event between its scheduled quarterly and annual reports. Item 5.02 of that form covers the arrival or departure of a named executive officer, so an 8-K is the closest thing to a public register of who actually holds a C-suite title. It carries legal liability, which is why this brief treats it as evidence and a press release as a claim. officer-change disclosures — the filing a listed company makes when a named executive actually arrives or leaves — that mark an actual appointment. High confidence
5. 5Where a CAIO exists at scale, it is usually an existing chief wearing a second hat. Of 17 federal CAIOs confirmed in August 2025, five were also the agency CIO, five sat in data leadership and three were the CTO. DHS's own compliance plan states plainly that the CIO is the CAIO. High confidence
6. 6Task-level gains are large and do not aggregate. +14% issues resolved per hour in customer support; 25.1% faster across 18 consulting tasks; 19% slower for experienced open-source developers in METR's 2025 trial. Census puts firm-level AI use at 19.8% as of 3 May 2026. High confidence
7. 7Buying beats building at the application layerThe top slice of the AI stack: the tool an employee actually uses — the support assistant, the contract reviewer, the claims triage screen. Beneath it sit the model layer (the rented intelligence) and the platform layer (access, evaluation, logging, security, cost metering). The distinction carries weight because the answers differ by layer: almost nobody builds their own model, most serious enterprises build their own platform, and the argument here is only about the application on top. — the tool an employee actually uses, as opposed to the model underneath it — and that is a verdict on org design. NANDA found purchased tools reached deployment roughly 67% of the time against roughly 33% for internal builds; the federal inventory shows 594 vendor-purchased against 581 in-house. Moderate confidence

1 · What is actually measured — adoption, and the three denominators that produce three different worlds

Ask how many American businesses use AI and you will get three defensible answers between 18% and 78%. All three are correct. They count different things, and almost every strategy argument in this field is really an argument about which denominator someone had in mind.

The Census Bureau runs the Business Trends and Outlook Survey, a biweekly panelA fixed group of respondents surveyed repeatedly over time, so that changes reflect the same units rather than a different sample each round. Panels are excellent for tracking movement and only as good as their recruitment for describing a population — which is the difference between the Census panel here, drawn to represent all US businesses, and the consultancy panels in Section 4, drawn from people who agreed to answer questions about AI. of roughly 1.2 million US firms. Its AI question is narrow and firm-level: did this business use AI in producing goods or services in the last two weeks? As of the 3 May 2026 reference date, 19.8% of businesses said yes⁴, with the rate hovering between 17% and 20% across the December 2025 to May 2026 collections. Size dominates: 37% of firms with at least 250 employees, 32% of firms with 100 to 249, and under 20% of firms with fewer than 20. Sector dominates too — Information at 39.7% and Finance and Insurance at 33.9%, against Retail Trade near 14%.

A Federal Reserve staff note published on 3 April 2026 laid the competing measures side by side. Jeffrey S. Allen's "Monitoring AI Adoption in the U.S. Economy"⁵ puts firm-level BTOS adoption at about 18% at year-end 2025, individual work-related generative AISystems that produce new text, code, images or audio in response to an instruction, rather than classifying or predicting from data. The distinction matters for reading every adoption number in this brief: a bank has been running predictive machine learning on credit files for decades, and that is "AI" in some surveys and not in others. Where a source says generative, it means the recent wave — the chat assistant, the drafting tool, the coding copilot. use at about 41%, and the employment-weighted figure — the share of the labor force employed at a firm that has adopted AI — at 78%. Fifty-four percent of the workforce is at a firm using large language modelsAbbreviated LLM. The class of system behind the current wave: trained on very large volumes of text to predict what comes next, and thereby able to draft, summarize, translate, answer and write code. Two properties drive the whole argument of this brief — every enterprise rents essentially the same ones from a handful of suppliers at falling prices, and none of them knows anything about a particular company's processes unless that company connects them to its own data. specifically. None of those numbers is wrong. A firm count treats a 5-person landscaping company and Walmart as one observation each; an employment weight does the opposite.

The most useful measure for an operating discussion is neither firms nor people. It is hours. Alexander Bick, Adam Blandin and David Deming's nationally representative surveys, published as NBER Working Paper 32966⁶, found that as of late 2024, 23% of employed respondents had used generative AI for work at least once in the previous week and 9% used it every working day. Then the sentence that should govern every business case written in 2026: "Between 1 and 5 percent of all work hours are currently assisted by generative AI, and respondents report time savings equivalent to 1.4 percent of total work hours." Adoption of the tool ran far ahead of penetration into the work.

The Census Bureau's own researchers went a level deeper. "The Microstructure of AI Diffusion"⁷ by Bonney, Breaux, Dinlersoz, Foster, Haltiwanger and Pande, published April 2026 from the 2026 BTOS AI supplement, measured AI use at three levels: the firm, the business function, and the worker task. Firm adoption was 18% for the November 2025–January 2026 reference period, 32% employment-weighted. Inside adopting firms, the leading functions were sales and marketing (52%), strategy and business development (45%) and IT (41%). And the finding that matters most for org design: 57% of users deploy AI in three or fewer business functions, and 65% limit worker use to three or fewer tasks. Sixty-six percent use AI purely to augment existing tasks. AI-related employment reductions appeared at 2% of firms.

That is a narrow base: a small number of functions, at a small number of firms, weighted heavily toward the largest employers. Adoption in the Census sense means someone in the building used a tool. It does not mean a process changed.

A vendor's own logs supply one more measurement, and it describes what enterprises build instead of what they say. Anthropic's Economic Index report of 15 September 2025⁸ compared consumer traffic on Claude.ai with enterprise traffic through the APIApplication programming interface — the channel through which one piece of software calls another, without a person typing in a box. Enterprise AI mostly runs this way: a system hands the model a task and takes back a result, inside an existing process. Usage patterns therefore look quite different from a consumer chat window, which is the point the passage is making.. On the API, 77% of usage showed automation patterns — the model is handed a whole task and returns a result — against roughly half on the consumer product. Computer and mathematical tasks made up 44% of API traffic. Anthropic is an interested party describing its own customers, and the sample is one vendor's logs over one week in August 2025. Taken for what it is, it says enterprises buy delegation, not collaboration, and they point it first at code.

2 · The failure numbers, read carefully — what "95% of pilots fail" is made of, and what survives the reading

In August 2025 a slide deck from MIT's NANDA initiative put a number into every boardroom in the country. "The GenAI Divide: State of AI in Business 2025"⁹ reported that despite "$30–40 billion in enterprise investment into GenAI," 95% of organizations were getting zero return. The figure travelled further and faster than any research finding in the field.

The method is stated on page one: a systematic review of 300 publicly disclosed AI initiatives, structured interviews with 52 organizations, and survey responses from 153 senior leaders. The pilot funnel that generates the 95% is drawn twice. For general-purpose chat tools, 80% of organizations investigated, 60% piloted, and 40% successfully implemented. For embedded or task-specific systems — the custom builds and vendor-sold enterprise tools — the exhibit on page six plots 50% investigated, 20% piloted, and 5% reaching production. The executive summary on page two says 60% rather than 50% for that first stage, which is a discrepancy inside the document itself; Figure 1b plots the exhibit and shows both. Beneath the exhibit the report prints its own warning: "These figures are directionally accurate based on individual interviews rather than official company reporting. Sample sizes vary by category, and success definitions may differ across organizations."

Two words carry that whole funnel, and no two studies define them the same way. A pilot is a bounded trial: a small group, a short window, a decision at the end about whether to go on. Production means the thing has become part of how the work runs — always on, depended upon by people who did not volunteer for it, and awkward to remove. What separates the two is rarely technical polish. It is integration with the systems around it, a security and privacy clearance, a support arrangement, somebody's name against the outcome, and a budget line that comes back every year.

The 95% is an interview-derived estimate of how rarely bespoke enterprise AI systems reach production with a P&L effect their own executives will name, drawn from 52 organizations, with the definition of success set by the respondent. It is not a measured failure rate across the enterprise population. The phenomenon is real. The precision is not.

The arithmetic is a sharper problem than the sampling. Ray Poynter worked the funnel back in a note published 31 May 2026¹⁰ and pointed out what the numbers actually say: if 20% of organizations reached pilot stage and 5% reached production, then "roughly one quarter of the organisations that actually ran a pilot cleared the bar." The 95% is the share of organizations that did not end up with a production system, most of which never piloted anything. The denominator is every organization surveyed, not the ones that ran a pilot. Poynter also notes that the success threshold was demanding (deployment beyond pilot, measurable KPIs, ROI assessed six months later, which may understate slower enterprise rollouts), that major outlets misreported the sample as "150 interviews and a survey of 350 employees," and that "if you go through the report looking for the evidential basis of the 95% figure, you struggle to find it. The number appears in essentially one sentence, with no underlying data presented."

NANDA is an initiative building agenticDescribing systems that act rather than answer: given a goal, they take a sequence of steps across real software — look something up, fill a form, send a message, retry — with no person approving each one. The difference from a chat assistant is not intelligence but consequence. An assistant that is wrong produces a bad draft somebody reads; an agent that is wrong produces an action somebody has to undo, which is why Section 14 argues that better systems tighten the governance problem rather than dissolving it. AI infrastructure, and the report's prescription — learning-capable, workflow-integrated agentic systems — is the category its authors work on. That does not make the finding wrong. It does mean the study is a Tier-3 sourceThis brief grades its evidence in three tiers, set out in full in the Evidence Register. Tier 1 is material somebody had to sign: company filings, regulator and statistical-agency publications, primary technical documents. Tier 2 is peer-reviewed research and reputable trade or wire reporting. Tier 3 is single-source, self-reported, sponsored or estimated material — used only where flagged, and never as the only support for a load-bearing claim. with an interest in its own conclusion, and it has been cited in board papers as though it were a census.

Two better-constructed numbers point the same direction. Gartner, in a press release dated 29 July 2024, predicted that at least 30% of generative AI projects would be abandoned after proof of conceptThe demonstration that a thing can be made to work at all — usually on sample data, for a friendly audience, outside the production systems. It answers a feasibility question and no other. Abandonment "after proof of concept" therefore describes the moment the harder questions arrive: whether the data is reachable, whether the controls will pass, whether anyone owns the process it would change. by the end of 2025, citing poor data quality, inadequate risk controls, escalating costs and unclear business value. That is a forecast, not a measurement, and it is a forecast from a firm that sells advisory services on the same problem. Deloitte's survey is larger and more recent: 3,235 business and IT leaders across 24 countries, fielded August–September 2025, published 21 January 2026, found that "only 25% of respondents have moved 40% or more of their AI pilots into production," and that "only 30% of organizations are redesigning key processes around AI." Thirty-seven percent said they use AI "at a surface level with little or no change to underlying business processes."

The federal inventory is the one dataset here that is neither a survey nor a forecast. Every CFO Act agencyThe twenty-four large federal departments and agencies named in the Chief Financial Officers Act — Defense, Treasury, Justice, Homeland Security, Veterans Affairs, NASA and the rest. Being on that list is what pulls an agency into most government-wide management requirements, this AI regime among them. It is the closest federal equivalent to "the Fortune 500 has to file." is required to file, the file is public, and it is coded at the level of the individual use case. Running the published 2025 file gives a funnel that nobody has to take on trust: of 3,611 reported use cases, 1,040 are coded Deployed, 440 Pilot, 1,479 Pre-deployment, 314 Retired and 338 uncoded. Deployment rates vary enormously by agency — Justice at 51.9%, DHS at 46.2%, Veterans Affairs at 37.6%, Energy at 35.0%, Treasury at 20.2%, NASA at 6.1% on 425 filed cases.

NASA, the agency with the highest use-case count in the inventory outside HHS, has deployed 26 of them and is sitting on 373 pre-deployment cases — a quarter of the entire federal backlog in one agency. Either NASA files more granularly than everyone else, or it has assembled the largest pre-production queue in government. The inventory does not say which. The coding is self-reported and the definitions are not audited. What the file does establish is that the pre-deployment stage is where the mass sits: 41% of everything the United States government says it is doing with AI has not been deployed.

Commerce is the sharper case, and it does not appear in any deployment-rate table because it cannot. The department filed 223 individually reported use cases and left the development-stage field blank on every one of them. That single agency accounts for 223 of the 338 uncoded rows in the whole file. A department can therefore satisfy a statutory inventory obligation, file more use cases than all but eight other agencies, and disclose nothing about whether any of them is running. The instrument records what it is given. Figure 2b sets the ten largest filers side by side.

Failure has an anatomy, and the anatomy is organizational. NANDA's own diagnosis, from the same interviews: "The core barrier to scaling is not infrastructure, regulation, or talent." Its four patterns were limited structural change (2 of 8 sectors), an enterprise paradox (large firms lead in pilot volume and lag in scale-up), an investment bias (sales and marketing captured roughly 70% of a hypothetical $100 AI budget allocation, despite back-office work yielding better returns), and an implementation advantage for external partnerships. The White House reached the same conclusion from the other direction. America's AI Action Plan, published July 2025, opens its adoption section with a sentence that could be the thesis of this primer: "the bottleneck to harnessing AI's full potential is not necessarily the availability of models, tools, or applications. Rather, it is the limited and slow adoption of AI, particularly within large, established organizations."

One NANDA finding cuts against the instinct of most large companies. In its interview sample, external partnerships reached deployment about 67% of the time against about 33% for internally built tools, and pilots built with a vendor were twice as likely to reach full deployment. The report flags the obvious confoundA third factor that moves both things you are comparing, so the apparent link between them may be an artifact of it. Here: firms that buy rather than build may already be better at procurement, clearer about what they want, and more disciplined about risk — in which case the buying is a symptom of competence rather than a cause of success. Naming a confound does not dispose of a finding; it sets the standard the finding has to clear. itself: firms that choose partners may simply differ in risk tolerance and procurement sophistication, and correlation is not causation. But the federal file, which does not depend on interviews, points the same way — 594 use cases coded vendor-purchased against 581 in-house and 429 mixed, in an institution with a large internal engineering base and every incentive to build.

Build-versus-buy at the application layer is usually argued as a technology question. It is a capacity question. An internal build consumes the scarcest thing the organization has: people who can ship and then maintain a production system against a model that will be replaced in nine months. A purchase consumes money, and money is the thing large enterprises have most of.

3 · What the experiments found — large effects, in narrow places, that refuse to add up

The randomized evidence on generative AI and work is unusually good for a technology this young. Five studies carry most of the weight, and read together they say something more specific than "AI makes people faster."

The biggest sample is in customer support. Erik Brynjolfsson, Danielle Li and Lindsey Raymond studied 5,179 customer support agents at a software firm as an AI conversational assistant was rolled out. Productivity, measured as issues resolved per hour, rose 14% on average. The average conceals the finding. Novice and low-skilled agents improved 34%; the most experienced agents improved barely at all. The authors' mechanism is the interesting part: the assistant was trained on the transcripts of the firm's best agents, so what it distributed was not intelligence but the tacit knowledgeWhat experienced people know how to do but cannot readily write down — the phrasing that defuses an angry customer, the exception that signals a bad claim. It is normally acquired by years of doing the job next to someone who already has it. A system trained on the record of expert work can hand a version of it to a novice on their first day, which is why the measured gains in these experiments concentrate so sharply among the inexperienced. of the top of the distribution. Customer sentiment improved and attrition fell.

Shakked Noy and Whitney Zhang ran a preregisteredThe researchers published what they intended to measure, and how, before collecting any data. It closes the escape hatch of running many analyses and reporting the flattering one. In a field this crowded with interested parties, whether a study was preregistered is one of the few cheap tests of whether its result was found or chosen. experiment with 444 college-educated professionals on incentivized, occupation-specific writing tasks. Time taken fell by 0.8 standard deviationsA way of stating an effect in units of how much the group already varied among itself, used when the raw units are not comparable across people or tasks. Roughly: a shift of 0.8 standard deviations moves a typical performer to about where the top fifth of the group used to sit. It is a large effect by the standards of this literature — and, being a relative measure, it says nothing about how much money the change is worth. and output quality rose by 0.4 standard deviations. Again the distribution compressed, because low-ability workers gained most. And again the mechanism is specific: the tool "mostly substitutes for worker effort rather than complementing worker skills," restructuring the task toward idea generation and editing and away from drafting.

Fabrizio Dell'Acqua and eight co-authors ran 758 Boston Consulting Group consultants through 18 realistic consulting tasks, published in Organization Science in March 2026. The jagged frontier is their name for the shape of what these systems can do, and it is the most useful idea in the whole literature. Capability does not run in a smooth line from easy work to hard work. It advances and retreats between tasks that look, to a person, about equally difficult. The boundary is jagged, and which side of it a given piece of work falls on cannot be read off any capability chart. It has to be found by trying, on that task, with those people. Inside the frontier, consultants with GPT-4 completed 12.2% more tasks, 25.1% faster, at materially higher graded quality. On one task deliberately placed outside it — a business case where the correct answer required reconciling data the model handled badly — consultants with AI were 19 percentage pointsThe plain arithmetic difference between two percentages, as against the proportional change between them. If a success rate falls by a fifth of itself, that is one number; the gap in percentage points between the two rates is another, and the two are routinely swapped in circulating AI statistics. This brief keeps them apart, and says which it means. less likely to get it right than consultants with none. The tool did not fail loudly. It produced a confident wrong answer, and the humans took it.

One of the five reversed the sign. METR randomized 246 real tasks across 16 experienced open-source developers working on repositories they had contributed to for an average of five years. Allowing AI tools increased completion time by 19%. Before starting, the developers forecast a 24% speed-up. After finishing, having actually been slowed down, they estimated they had been sped up 20%.

The people doing the work, measured against their own baseline, on their own code, were wrong about the direction of the effect by roughly forty percentage points. Any measurement regime that runs on self-reported time savings is measuring something, and it is not time.

METR's follow-up, published 24 February 2026, is a model of how to handle an inconvenient result. Repeating the design with late-2025 tools produced −18% for the original cohort and −4% for newly recruited developers — speed-ups, but with confidence intervalsThe range within which the true effect plausibly sits, given how much data the study had. The headline figure is the middle of that range, not a measurement. When an interval crosses zero — running from negative to positive — the data are consistent with the effect running in either direction, which is why a result reported that way cannot carry a decision however striking its midpoint looks. of −38% to +9% and −15% to +9% respectively. Both cross zero. More importantly, METR reported that the experiment had broken: "30% to 50% of developers told us that they were choosing not to submit some tasks because they did not want to do them without AI." Once the tool is load-bearing, you cannot randomize its absence without changing which tasks people bring you. METR's own conclusion is that developers are probably more sped up now than in early 2025, and that its new data provides "very weak evidence" for that.

The two software-development results are the sharpest thing in the entire evidence base. Sida Peng, Eirini Kalliamvakou, Peter Cihon and Mert Demirer ran a controlled experiment in which recruited developers built an HTTP server in JavaScript, and the group with GitHub Copilot finished 55.8% faster. METR ran experienced maintainers on real issues in repositories they had worked on for five years, and measured a 19% slowdown. Same technology, same profession, effect sizes seventy-five percentage points apart. The model was the same in both. The difference is the task: one was self-contained and carried no institutional context, and the other was almost entirely institutional context.

Two things follow for anyone designing an AI organization. First, the return on AI is set almost entirely by which workflow it is pointed at and who is doing that work — not by which model is procured. Support triage, first-draft writing, structured research, code review of unfamiliar systems: bounded, gradable, high-volume, staffed disproportionately by people who are not yet expert. Those are where the measured gains live. Selecting them is a judgement about the business, made by someone who knows the process. It cannot be made by a central lab reading a capability roadmap.

Second, the aggregate has not shown up and there is no mystery about why. Bick, Blandin and Deming measured 1% to 5% of total work hours assisted, with self-reported savings equal to 1.4% of hours. Even a 20% effect on 3% of hours is 0.6% of labour input. Stanford's 2026 AI Index collects the task-level results — 14–15% in customer support, 26% in software development, 50% in marketing output — alongside enterprise agent deployment that remains "in the single digits across nearly all business functions." Large effects on a small base produce a small number. That is arithmetic, not disappointment.

Daron Acemoglu did the arithmetic properly and got an answer that has been widely quoted and rarely read. Working from task-level cost savings and the share of tasks exposed, "The Simple Macroeconomics of AI" (May 2024) estimates macroeconomic effects that are "nontrivial but modest — no more than a 0.66% increase in total factor productivityThe share of economic output growth that is not explained by adding more workers or more capital — the residual that stands in for getting better at using what you have. It is the number a general-purpose technology is supposed to move, and the reason economists reach for it here: hiring more people or buying more machines is not what anyone is claiming AI does. over 10 years," and argues the true figure is likely under 0.53% because the early evidence comes from the simplest tasks. That estimate is contested and depends heavily on the exposure share assumed. It is nonetheless the only serious attempt to reconcile the task-level results with the aggregate, and it reaches the same place the hours data does: the effect is real, and it is small until far more of the work is touched.

The labour market has nonetheless started to move, and it moved exactly where the experiments said it would. Brynjolfsson, Bharat Chandar and Ruyu Chen's August 2026 update, built on ADP payroll records covering millions of US workers through June 2026, finds no economy-wide displacement, and employment of workers aged 22 to 25 in AI-exposed occupationsJobs whose everyday tasks these systems can already do a meaningful share of — customer support, junior software work, routine writing and analysis. Exposure is a statement about the tasks, not a prediction about the job, and it says nothing about whether the technology substitutes for the worker or assists them. That distinction is doing real work in the finding: the declines concentrate where it substitutes. now 19% below where it would have been had it tracked their less-exposed peers. Experienced workers show no comparable gap. Adjustment runs through reduced hiring rather than separations, and the declines concentrate in occupations where AI substitutes for the task rather than complements it. The authors are careful to call these "early, descriptive indicators — canaries in the coal mine — rather than causal estimates."

The tool works best for novices because it distributes what experts know. If it is then used to stop hiring novices, the organization has consumed its own supply of future experts to buy a one-time margin gain. That is a capital-allocation problem. It belongs to whoever signs off the headcount plan, and in most companies that is not the person running the AI programme.

4 · Survey narrative versus measurement — why 88% and 19.8% are both true, and what that costs the reader

Stanford's 2026 AI Index reports that 88% of surveyed organizations use AI in at least one business function, and 70% use generative AI. The Census Bureau, asking a probability sampleA sample drawn so that every unit in the target population has a known chance of being selected — which is what licenses generalizing from the sample back to the population. A panel of people who agreed to answer questions about AI has no such property, however large it is and however carefully it is run. This is the single most consequential methodological line in the brief: it is why an 88% and a 19.8% can both be honest. of US businesses the same calendar quarter, gets 19.8%. The gap is 68 percentage points and neither number is wrong.

The practitioner surveys draw from panels of people at large organizations who agree to answer questions about AI. Census surveys businesses, and most businesses in the United States are small. Add the size gradient — 37% at firms with 250-plus employees against under 20% at firms with fewer than 20 — and the two converge on the same underlying fact from opposite ends. What survives the reconciliation is that big firms have mostly touched the technology and small ones mostly have not. The impression the 88% creates, that the transformation has happened, does not survive it.

The same construction problem runs through every organizational statistic in this field. Wharton Human-AI Research and GBK Collective, in "Accountable Acceleration," published October 2025, report that "CAIO roles are now present in 60% of enterprises." The method is stated plainly in the deck: a 15-minute online tracking survey of roughly 800 US senior decision-makers at organizations with 1,000-plus employees and over $50 million in revenue, fielded 26 June to 11 July 2025, across HR, IT, Legal, Marketing, Operations, Product, Procurement, Finance and General Management. It is a competently run panel. It is also a survey in which a senior HR manager is asked whether her company has a Chief AI Officer, and her yes is recorded as organizational fact.

Set that against the record where the answer carries legal consequence. A full-text search of every filing on SEC EDGARThe Securities and Exchange Commission's public archive of every document US-listed companies are required to file, searchable by anyone, free. It is the closest thing that exists to a verifiable record of corporate fact, because the documents in it carry legal liability. This brief leans on it for one reason: a survey records what an executive says about their company, and EDGAR records what the company was willing to sign. between 1 January 2025 and 31 August 2026 returns 126 documents containing the exact phrase "Chief AI Officer," 30 for "Chief Artificial Intelligence Officer" and 15 for "Chief Data and AI Officer." De-duplicated by filer, those 126 documents come from 42 distinct central index keysThe permanent identifier EDGAR assigns to each filing entity. Counting by it collapses the many documents one company files into a single company — which is why 126 documents become 42 filers. It is an imperfect proxy for "companies", since a single business can hold several of these for subsidiaries, funds or duplicate registrations; the text says so and adjusts. — roughly 35 actual issuers once one company's duplicate registration, an individual insider filing and five insurance separate accounts filing under a single parent are collapsed. Only 25 of the 126 are 8-Ks, the form on which a company reports an officer change. Thirteen are proxy statementsThe annual document sent to shareholders ahead of a company's meeting, setting out who the directors are, what the executives are paid, and — increasingly — how the board oversees particular risks. It is where a company describes its governance in its own words under liability, which is why an AI council named by office in a proxy statement counts here as evidence and the same council named in a press release does not..

The filer list is more informative than the count. It is dominated by micro-capsThe smallest listed companies, worth a few hundred million dollars or less. They matter to the argument as a signal rather than as businesses: a title that appears mostly among very small issuers and rarely among very large ones is functioning as a positioning statement to investors, not as a description of how a big organization is run. and foreign private issuersNon-US companies listed on a US exchange. They file under a lighter disclosure regime — an annual 20-F instead of the quarterly US forms, and no obligation to report officer changes on an 8-K — so their appearance or absence in a US filing search says as much about the rulebook they sit under as about what they have done.: Nvni Group, Evaxion, Genius Group, Sparrow Vision, GATC Health, Xtend AI, NICE. The large-capitalization appearances are countable on two hands: S&P Global, FactSet, Analog Devices, Cognizant, Expedia, GE HealthCare, Raymond James, Unity, Xerox, WPP, Shinhan Financial, PJT Partners, United Therapeutics, Stagwell and Metropolitan Bank Holding.

The count over-states even that, and the error is the kind that survives peer review. A filing mentions "Chief AI Officer" whenever a director's biography describes a role that person holds somewhere else. Xerox's 2025 proxy contains the phrase because director John Roese is "Chief Technology Officer and Chief AI Officer at Dell Technologies." Expedia's 2026 proxy contains it because director Alexandr Wang has been "Chief AI Officer, Meta Platforms, Inc. (since June 2025)." United Therapeutics' proxy contains it because Ray Kurzweil is Chief AI Officer of Beyond Imagination. Three of the eleven large-capitalization documents opened for this brief are that kind of hit. The disclosure-side floor is lower than 126, not higher.

The disclosure test is not a perfect instrument either, and it under-counts in a specific way. A Chief AI Officer only appears in an SEC filing if the company treats the appointment as materialThe disclosure threshold: information a reasonable investor would consider important in deciding what to do with the stock. It is a judgement the company makes, and it is the hinge of this whole comparison — a company that does not regard its AI leadership as material to investors will not file anything about it, so silence in the record is ambiguous between "no such role" and "not worth telling you about." — an Item 5.02The numbered section of the 8-K form reserved for the departure or appointment of directors and principal officers. Because it is a defined item with its own trigger, counting Item 5.02 filings is the nearest thing to counting real executive appointments — and it is how this brief separates 25 genuine officer changes from 126 documents that merely contain a phrase. officer change, a proxy disclosure, an investor-day deck. A senior vice-president running AI for a Fortune 200 industrial will not show up. So the disclosure count is a floor and 60% is a ceiling, and the truth sits somewhere in between with a great deal of definitional mush in the middle. That mush is the point. When a survey says 60% of enterprises have a CAIO and the disclosure record says the title is rare among large public companies, what is actually being measured is that the phrase "we have someone in charge of AI" is true almost everywhere and means almost nothing.

A single consultancy survey percentage, repeated by fifty outlets, is one Tier-3 source. It is not fifty corroborations. The repetition is a function of the publisher's distribution budget, not of the finding's robustness. Two of the most-cited numbers in enterprise AI — the 95% pilot failure rate and the 30% abandonment forecast — originate in a 52-organization interview study and a conference prediction respectively. Both have been cited in board papers as though they were census data.

A second problem with the survey base is structural. Surveys of AI leaders about their AI programmes are self-assessments by the people accountable for those programmes. Wharton reports that 72% of leaders track structured business-linked ROI metrics and roughly three in four see positive returns — and, in the same instrument, that VP-and-above respondents are far more positive than mid-managers (81% versus 69% believing ROI is positive). The gradient runs the direction accountability predicts. Deloitte's 74% "meets or exceeds ROI expectations" has the same shape: an expectation is set by the person answering, then graded by the person answering.

BCG's AI Radar 2026, released 15 January 2026 from 2,360 executives across 16 markets including 640 chief executives, supplies the clearest illustration. It reports that "nearly three-quarters of chief executives (72%) say that they are now the main decision makers on AI" — double the prior year — and that half believe their jobs depend on getting AI right. A chief executive who is personally the main decision-maker on AI is describing an escalation, not an operating model; the decisions that actually determine outcomes are made weekly, at the use-case level, by people the CEO will never meet. What the number measures is attention, and attention has a well-known relationship with the second finding: half of the respondents believe their tenure depends on the answer. The question that would settle the matter — who signed the last promotion to production, and who signed the last termination — is not asked by any survey in this field.

None of this means the surveys are worthless. Used as what they are — a read on what senior people believe and intend, tracked consistently year over year — they are genuinely informative, and the Wharton series in particular is honest about its own construction. Used as evidence that something happened, they are not evidence at all.

5 · Five organizations, in their own words — what the filings say, as against what the coverage said

Case studies in this field are usually written by someone selling something. The discipline that fixes it is simple: prefer the document the organization had to sign. A 20-FThe audited annual report a non-US company listed in the United States files with the SEC — the foreign issuer's equivalent of the 10-K. Its contents are audited and its statements carry legal liability, so a claim that appears in one has survived a process a marketing claim has not. Where a 20-F and a press release describe the same events differently, this brief treats the gap between them as a finding rather than a nuisance. carries liability. A press release does not. Where the two disagree, the disagreement is the finding.

Klarna — the reversal that the filing does not describe

In February 2024 Klarna announced that its OpenAI-powered assistant had handled 2.3 million conversations in its first month, two-thirds of customer service chats, doing the work of 700 full-time agents, cutting resolution from 11 minutes to under two, reducing repeat inquiries 25%, and driving an estimated $40 million profit improvement for 2024. Through 2025 the business press reported a reversal: Klarna rehiring human agents after quality complaints, its chief executive conceding the company had cut too far.

Klarna's audited annual report on Form 20-F for the year ended 31 December 2025, filed 26 February 2026, describes no reversal. It states that the AI assistant "has handled 80% of customer service chats in the year ended December 31, 2025 ... with no drop in consumer satisfaction levels since its introduction," on 31 million conversations since launch, still doing "the equivalent work of over 700 full-time agents." Headcount over the same arc: 4,352 at end-2023, 3,422 at end-2024, 2,831 at end-2025, down 35% in two years. The filing attributes the fall to "our strategic decision to reduce our overall headcount and drive operational efficiency by leveraging AI." It adds that it expects the number "to continue to decrease in future periods." Average annual revenue per employee went from roughly $344,000 in 2022 to roughly $1,240,000 in 2025. Over 1,700 supplier contracts were reduced or cancelled following AI adoption and standardization. More than 1,500 positions — about 53% of the entire organization — are engineering and data science.

The reconciliation is not that the press was inventing things. Sebastian Siemiatkowski told Bloomberg in May 2025 that Klarna was recruiting customer service staff again after a hiring freeze, and put the reasoning plainly: "I just think it's so critical that you are clear to your customer that there will always be a human if you want," adding that "investing in the quality of human support is the way of the future for us." The roles being recruited were fully remote, aimed at students and rural populations. What the filing establishes is the shape of the change: the company rebuilt an escalation tierThe human layer a customer reaches when the automated one cannot or should not handle their case — the dispute, the hardship, the situation the system was never meant to judge. Designing it means deciding in advance what triggers a handover, who is waiting there, and how the customer gets told. A first tier deployed without one does not fail quietly; it fails on the cases that matter most, in public. under an assistant that still handles four chats in five. The automation stayed in place. The company found that the workflow needed a floor and built one. The lesson is in the filing, not the headline. Design the escalation path before you cut the humans; rebuilding it under public scrutiny costs more than keeping it would have.

One inconsistency shows the value of preferring the signed document. The February 2024 press release says the assistant resolves queries in under two minutes against 11 minutes for human agents. The 20-F, describing the same comparison as of September 2024, says two minutes against 12. Small, but the direction of drift in a promotional number is always the same direction.

JPMorgan Chase — a central platform with business-unit strategies on top

JPMorgan's 2025 Annual Report discloses a 2026 technology budget of approximately $19.8 billion and describes the firm as "as much a technology-driven company as we are a bank." The generative AI layer is one internal platform, LLM Suite, built in-house. In the Commercial & Investment Bank alone, "over 90% of our engineers now use AI code assistants, and more than 65,000 CIB colleagues actively use LLM Suite." The operational claim is specific rather than aspirational: "In transaction screening, AI has enabled us to review more than double the volume while halving the number of manual operator checks."

The organizational design shows through in one sentence buried in the CIB section: each business has "its own AI strategy aligned to the end-to-end client journey." One platform, one set of controls, one model-access layer — and separate strategies owned by the people who own the client relationships. That is hub-and-spokeOne central team owns what is identical everywhere — model access, evaluation, security review, cost metering, the standards — and teams inside each business own what differs everywhere, which is the work itself. Section 6 sets it against the two alternatives and shows where each breaks., described by a firm that never uses the phrase.

Jamie Dimon's letter is unusually restrained for a chief executive on this subject. "We do not yet know exactly how AI will unfold." "At this time, we cannot predict the ultimate winners and losers in AI-related industries." And on the organizational obligation: "AI will definitely eliminate some jobs, while it enhances others. Our firm will have definitive plans on how we can support and redeploy our affected workforce." The letter also names the risk that most programme documents omit: "there is a possibility that AI deployment will move faster than workforce adaptation to new job creation."

Walmart — consolidation as the strategy

Walmart's global chief technology officer Suresh Kumar published the company's operating decision himself, on 24 July 2025: four "super agents" — Sparky for customers, an associate agent for employees, Marty for suppliers and advertisers, and a developer agent — replacing a proliferating set of individual tools. His framing of the choice is the useful part: "a deliberate choice: to go beyond individual tools and build a unified, company-wide framework."

Consolidation is the least glamorous move in the field. Walmart's problem was not that it lacked AI. It had too much, in too many places, with no coherent surface. The remedy was a consolidation with four named owners and four named audiences. Trade reporting places Daniel Danker, hired from Instacart as executive vice president for AI acceleration, product and design, reporting to Kumar; Walmart's own post does not state the reporting line, so treat that detail as press-sourced rather than disclosed.

Moderna — the AI organization that has no AI executive

Moderna's executive committee, as published by the company, comprises nine people. There is no Chief AI Officer. There is no Chief Information Officer. There is no Chief Digital Officer. Digital technology sits inside the title "Chief People and Digital Technology Officer," held by Tracey Franklin, who was previously Chief Human Resources Officer.

The merger of the HR and IT functions under a single leader was reported through 2025 and is visible in the title itself. Whatever one thinks of the design, it encodes a thesis: the binding constraint on deploying AI in a 5,800-person company is the work — who does what, how roles are defined, how people are retrained — and not the technology. Putting digital technology under the person who owns job design is what that belief looks like on an org chart. Whether it produces better outcomes than a conventional CIO is not established by anything in the public record, and the widely circulated figures about thousands of internal GPTs come from interviews rather than filings.

Homeland Security — the design the private sector will not write down

No company has published anything as detailed as the federal one. The most complete public description of an enterprise AI operating model in existence is DHS's compliance plan for OMB M-25-21, published September 2025, and it exists because the government made publishing it mandatory. It states the reporting structure without euphemism: "The DHS CIO serves as the Chief AI Officer." "At DHS the Chief Data Officer reports to the DHS CIO." The AI Governance Board is chaired by the Deputy Secretary of Homeland Security with the CAIO as vice-chair, and its membership is listed by office — Chief of Staff, Under Secretary for Management, CFO, CIO, Chief Privacy Officer, Officer for Civil Rights and Civil Liberties, Principal Deputy General Counsel, and the deputies of CISA, CBP and FEMA.

The platform is central and named: DHSChat, an internal generative AI assistant available to all personnel, gated behind rules of behaviourA signed statement of what a user may and may not do with a particular system, and what happens if they do it anyway — the federal form of an acceptable-use policy, attached to the system rather than to the employee handbook. It is how an organization makes access broad and still bounded: everyone gets the tool, and everyone has agreed in writing to the limits before they touch it. and mandatory privacy and cybersecurity training. The policy prohibits using AI output "as the sole basis for taking a law enforcement action, civil action, or denial of government benefit." DHS filed 238 use cases in the 2025 inventory, 110 of them deployed — 46.2%, the second-highest conversion rate among the large filers.

A typical Fortune 500 annual report says almost none of this. Most public companies will tell you they are "embedding AI across the enterprise." A federal department will tell you which official chairs the board, who reports to whom, which uses are forbidden, and how many of its systems are live.

The difference is of degree, not of kind. One exception shows what corporate disclosure looks like when a company chooses to make it. GE HealthCare's 2025 proxy statement names the membership of its cross-functional AI council by office: the Chief Culture and Belonging Officer, the Chief Privacy and Data Trust Officer, the Chief Information Security Officer, the Chief Compliance Officer, the Chief Information Officer, the Chief Data Officer, the Chief Talent Officer, the Chief AI Officer, "and other representatives from each segment, region, and function," with the council reviewing and updating policy. That is a governance board described the way DHS describes one, in a proxy statement, by a company nobody compelled to describe it. It is also close to the only one. The general rule holds; the exception marks how easily any of the others could have written the same paragraph.

6 · The three archetypes — centralized, federated, hub-and-spoke, and the right that decides between them

Three shapes exist at scale, and every enterprise AI organization is a version of one of them. The useful question is which failure each one buys.

The centralized model puts platform, delivery and governance in one group that serves the whole enterprise. DHS is the cleanest disclosed example: one officer who is simultaneously CIO and CAIO, the Chief Data Officer reporting to him, one internal assistant available to all personnel, and one governance board. Walmart's four-agent consolidation is the same instinct applied to a product surface. The model optimizes for control, unit cost and consistency, and it is the correct answer when the regulatory cost of an inconsistency is high.

It fails as a queue. A central group has a fixed throughput, and every business unit's request enters the same line. The units that need the smallest changes wait behind the units that need the largest. Over eighteen months the predictable outcome is a shadow estate: people route around the centre, and the organization ends up federated anyway, without the governance that federation would have been designed with. MIT NANDA found precisely this pattern from the demand side — a "shadow AI economy" in which employees used personal accounts while their companies' formal initiatives stalled, with regular use reported at over 90% of surveyed companies against 40% that had bought an official subscription (Figure 7b).

The federated model puts AI capability inside each business unit, with the centre holding a nominal coordinating role. Moderna is the extreme version: no CAIO, no CIO, no CDO on the executive committee, digital technology held by the officer who owns job design. NANDA's interviews pointed the same direction — the successful buyers "sourced AI initiatives from frontline managers, not central labs," and the report's own organizational conclusion is that "companies succeed when they decentralize implementation authority but retain accountability."

It fails on duplication. Three units build three evaluation harnessesThe rig that scores a system before and after it goes live: a fixed set of test cases with known good answers, run automatically, so a change in model, prompt or data produces a number rather than an opinion. It is the least visible thing a platform team builds and the one that makes every other control possible — without it, "is this working?" has no answer but the enthusiasm of the people who built it, and no use case can be defensibly promoted or stopped., sign three vendor contracts, and discover three separate versions of the same data-access problem. The costs are real, but they arrive as a sum nobody computes, because no single unit sees the total. The governance failure is worse and quieter. The unit with a rigorous engineering culture holds its models to one standard and the unit without one holds its models to another, and the enterprise finds out which is which through an incident.

Hub-and-spoke splits the two. A hub owns the things that are the same everywhere — model access, evaluation, security review, cost metering, the standards — and spokes in the business own the things that are different everywhere, which is the work. JPMorgan describes it without naming it: one homegrown platform used by 65,000 people in a single division, with each business running "its own AI strategy aligned to the end-to-end client journey." The federal government is the same design at national scale, with OMB as the hub setting policy and agency CAIOs as spokes.

The most explicit written description of the design comes, again, from an agency that had to file one. The Treasury Department's compliance plan, prepared by Chief AI Officer Paras Malik, names three bodies and gives each a distinct job: an AI Governance Board of senior leaders providing "oversight and strategic direction"; an AI Transformation Office that "oversees overall governance and houses the enterprise-wide inventory, ensuring consistency"; and an AI Council of component-level AI and technical leads that "meets monthly to review use cases, exchange leading practices, and surface issues from bureaus." Identification of use cases and risk assessment "occur at the bureau and departmental office level." Treasury's own word for the arrangement is "federated," and the arrangement it describes is hub-and-spoke: a hub holding the inventory and the standard, spokes holding the work, and a board arbitrating.

Hub-and-spoke is currently the consensus recommendation, and the consensus should be treated with some suspicion, because the evidence behind it is thin. The widely repeated claims — that firms using it are several times more likely to scale, that hub-and-spoke CAIOs deliver measurably higher returns — trace to vendor and consultancy publications rather than to any measured comparison, and a search of the primary literature turns up no randomized or quasi-experimental study of AI operating-model structure at all. What can be said from evidence is narrower and still useful: the two largest disclosed AI operating models in the world, JPMorgan's and the federal government's, both converged on a central platform with distributed delivery, and both did so after starting somewhere else.

The three archetypes are usually argued as a question about where people sit. That is the least consequential thing about them. What differs materially is how many places hold the right to put something into production and take something out of it. Centralized holds it once. Federated holds it many times. Hub-and-spoke splits it into a proposal right and a certification right. And a design in which nobody holds the second half of it — the right to terminate — behaves identically in all three shapes: the portfolio grows, nothing converges, and the reporting line becomes an alibi.

7 · The Chief AI Officer, dissected — four jobs, one title, and the two that are worth the box

A board that decides to hire a Chief AI Officer has decided almost nothing. The title covers four different jobs with different reporting lines, different budgets and different conditions for success, and the most common failure in this field is a company hiring one variant to solve a problem that requires another.

The builder runs a platform organization. Engineers, model access, evaluation harnesses, security review, cost controls. The job is to make it cheap and safe for the rest of the company to ship. It needs a real budget, a real headcount and a reporting line into whoever owns engineering — CTO, CIO, or the chief executive if the company is technology-led. FactSet's appointment is the outward-facing version of this variant: on 2 March 2026 the company's Chief Technology Officer, Kate Stepp, became Chief AI Officer, reporting to the chief executive, with the remit to "lead FactSet's AI services for clients," while a new CTO took the internal platform. That pair of appointments separated AI-in-the-product from AI-in-the-company, and gave the product half to the person who had been running the platform.

The governor runs risk. Use-case classification, the pre-deployment gate, model risk managementA discipline banks were made to build after the financial crisis and are now applying to AI: every model in use is inventoried, its assumptions and limits are written down, it is validated by people independent of the team that built it, and it is re-examined on a schedule. Its transferable idea is the independence — the reviewer does not report to the builder — which is exactly the structure this brief argues the stop authority needs., incident response, regulatory interface. The job is to say no, and to be able to make it stick. It needs independence from delivery — which is why in regulated industries it usually sits near the general counsel, the chief risk officer or an existing model-risk function rather than inside technology. This is the variant the corpus's own governance work covers in depth; the operating question here is narrower: does the governor's no bind, and is the governor measured on anything other than the absence of incidents?

The evangelist runs change. Training, communications, community, use-case sourcing, executive education. It is the variant most companies actually hire, because it is the cheapest and the least threatening to existing chiefs. It can be genuinely valuable — Wharton's series consistently finds that skills and change management, not technical capacity, are the binding constraint, and reports that investment in training fell 8 percentage points year over year even as nearly half of organizations reported technical skill gaps. But an evangelist with no platform and no gate produces enthusiasm, and enthusiasm is what the pilot-failure literature is measuring.

The coordinator runs a committee. No budget, no engineers, no veto — a convening function that exists to make the org chart look complete. This is the variant that does active harm, because it creates a name that boards can point at while leaving every real decision where it was. Accountability for outcomes plus authority over nothing is a coordination tax, and it discredits the function for whoever holds it next.

The largest countable population of AI chiefs anywhere is the federal one, because OMB requires every agency to designate a Chief AI Officer and to notify OMB within 30 days when the designation changes. FedScoop confirmed 17 of roughly two dozen CAIO Council members in August 2025: five were also the agency CIO, five sat in data leadership roles, three were the CTO, and the rest held standalone or unique positions. Four agencies did not respond and two declined to name theirs.

The same pattern appears wherever an agency has written it down. The National Archives designates its Chief Information Officer as Chief AI Officer in its compliance plan of 18 September 2025, with the CAIO chairing the governance board. The EEOC gives the role to its Deputy CIO. Treasury is the exception among the plans sampled here, placing its CAIO as a Counselor to the Secretary rather than inside the technology function.

DHS did not respond to FedScoop. Its compliance plan says it outright: "The DHS CIO serves as the Chief AI Officer," and "at DHS the Chief Data Officer reports to the DHS CIO." That is a deliberate conclusion, not an avoided decision: a department with 238 filed use cases decided that AI is an information-technology capability, and that splitting authority over it from authority over infrastructure would create two chiefs and one bottleneck.

The Federal Reserve's plan records the opposite motion, and it is the more interesting one. The Board "appointed a CAIO to lead the program" in early 2024, and by late 2025 strategic oversight had transferred to the Office of the Chief Data Officer. A standalone AI chief was created, ran for about eighteen months, and was folded into the data function. Nothing in the document suggests failure. It reads like an institution deciding that the coordination problem it had created a role to solve had become a data-governance problem it already had a role for.

Which raises the question the title obscures: is the CAIO a permanent chief or a transitional one? The evidence points toward transitional in most organizations and permanent in a few, and the discriminator is the product. A company whose product contains AI — FactSet, Mastercard, a bank selling AI-mediated services — has a durable executive job that will not fold into IT, because it is a revenue role. Mastercard created a combined Chief AI and Data Officer position for Greg Ulrich in 2024. The company's own executive biography says he "leads Mastercard's approach for leveraging and integrating AI and data across the business, commercializing both internal and external applications and overseeing enterprise-wide governance of these functions," as a member of the Management Committee. Commercialization and governance in one role, at Management Committee level. Mastercard does not publish the reporting line; trade coverage of the April 2024 appointment puts it under Craig Vosburg, the Chief Services Officer, which would place the role on the revenue side rather than inside technology. Treat the scope as disclosed and the reporting line as reported. A company whose product does not contain AI has an internal capability-building job, and internal capability-building jobs end when the capability is built.

M-25-21 gets right the thing most boards get wrong about the role. The memo's list of CAIO duties says the CAIO must "provide guidance on AI investments to the agency head and agency CFO related to resourcing requirements" and "support agency efforts to track AI spending." Guidance. Support. The federal Chief AI Officer has no budget authority, by design, and OMB was explicit about it.

What the memo does give the role is two genuine decision rights, and both are about stopping rather than starting. A pilot exempt from the minimum risk practicesThe floor of obligations the federal memo attaches to any high-impact use: test it before deployment against its real intended use, assess its impact, monitor it once live, build a fail-safe, give affected people notice and a route to appeal, and have it reviewed independently. They are stated as a floor, not a ceiling — and the enforcement clause is what gives them teeth, since a high-impact system that cannot document them must be discontinued. may proceed only where "the agency CAIO has certified that the pilot may go forward, and that certification is tracked centrally." And a CAIO "may waive one or more of the requirements in this section for a specific covered AI application," on a written, system-specific risk determination, recertified annually, revocable at any time — with the memo adding that "the CAIO's responsibility under this paragraph shall not be delegated down to other officials."

That is a well-designed role. It has no money and two gates, both non-delegable, both audited. It is also, precisely, the design that most corporate CAIO appointments invert: money and headcount but no gate, or a gate with no obligation to record its exercise.

A fresh test of the consolidation reading arrived in March 2026, and it held. Kroger — a Fortune 50 retailer, not a company with any incentive to be conservative about AI — created its first Chief Data and AI Officer and gave it to Milen Mahadevan, who runs 84.51°, the company's retail analytics subsidiary. Reported on 6 March 2026, disclosed on the fourth-quarter earnings call, the role consolidates all of Kroger's data and AI teams under one leader who keeps running the analytics business and reports to Yael Cosset, the Chief Digital and Technology Officer, not to the chief executive. A new box, filled by the person who already owned the data, reporting into technology. That is the same motion as DHS and the Federal Reserve, arriving at a grocery chain. Kroger's own fourth-quarter release of 5 March 2026 does not mention the appointment, artificial intelligence or 84.51° anywhere in it, which is why this one is sourced to the trade press and flagged.

The wider disclosure record points the same way, and almost nobody reads it. S&P Global's investor-day release of 13 November 2025 lists its speakers by title, and one of them is "Chief AI Officer & Kensho Chief Executive Officer Bhavesh Dayalji" — the same construction as Kroger's, an AI chief who is simultaneously running the company's owned analytics business. Analog Devices' 2025 proxy records that "during 2024, we hired a new Chief AI Officer and appointed a Responsible AI Officer," and puts AI risk oversight with the Audit Committee — the builder and the governor split into two named roles at one company. Raymond James' fiscal 2025 fourth-quarter release announces "approximately $1 billion in technology including AI" in the same sentence as "creating the new positions of Chief AI Officer and Head of AI Strategy," which is the rare case of an issuer disclosing the money and the org change together. PJT Partners' proxy credits its President with having "recruited a Chief AI Officer," placing the hire under the chief operating officer.

One filing records the counter-motion, and it is the more instructive one. Unity's 2026 proxy lists Felix Thé as "Senior Vice President, Chief AI Officer and Product and Technology, Grow," and adds in a footnote that "due to organizational restructuring, Mr. Thé ceased to be an executive officer in March 2025, although he continues to be employed by the Company in his role." The title survived. The officer status did not. That is what the consolidation looks like when a public company has to write it down, and it is the only disclosed instance of it found in the 2025–26 filing record.

8 · The federal experiment — the only enterprise AI operating model whose homework is public

Somebody mandated a Chief AI Officer at every large organization in a 2-million-person enterprise, gave the role a written job description, required a governance board chaired one level below the chief executive, required a public inventory of every use case, set a rule that non-compliant high-risk systems must be switched off, and then published the results. Nobody else in the world has run this experiment. Almost nobody reads the output.

The memo specifies the mechanics down to the deadline. M-25-21 gives every agency head 60 days to designate a CAIO, permits designating an existing official "such as a Chief Information Officer, Chief Data Officer, Chief Technology Officer, or similar official ... provided that individual has significant expertise in AI," and requires the CAIO to be senior enough "to engage regularly with other agency leadership, to include the Deputy Secretary or equivalent." Within 90 days each CFO Act agency must stand up an AI Governance Board chaired at Deputy Secretary level with the CAIO as vice-chair, with mandated representation from IT, cybersecurity, data, budget, statistics, legal counsel, privacy, and civil rights and civil liberties.

The risk trigger is defined functionally, not by technology: AI is high-impact "when its output serves as a principal basis for decisions or actions that have a legal, material, binding, or significant effect on rights or safety," and "a high-impact determination is possible whether there is or is not human oversight for the decision or action." Certain categories are presumed high-impact, and an agency official who wants to rebut the presumption must file written documentation with the CAIO. Then the enforcement clause: "If a particular high-impact use case is not compliant with the minimum practices then the agency must safely discontinue use of the AI functionality."

Every element a corporate operating model is told it needs is here, written down, with dates.

Two agencies dominate the blank fields, and both are large. The Department of Veterans Affairs filed 215 high-impact use cases — 48% of the federal total — and left every risk-management field empty on all of them. Justice filed 114 and left 41 blank. Energy filed 29 and left 27 blank. DHS, by contrast, filed 55 high-impact cases and answered on 39 of them. The distribution suggests something more mundane than defiance: agencies that had already built an internal AI risk process had answers to give, and agencies that had not gave none. The reporting instrument found the gap it was designed to find.

In VA's case the explanation is on the record and predates the 2025 filing. GAO reported on 15 September 2025 that VA had gone from 40 AI use cases in 2023 to 229 in 2024, 27 of them generative, and that "VA's inventory of AI use cases did not include required data elements that OMB requested" — a recommendation still unimplemented at publication, alongside 26 outstanding IT management recommendations. The blanks in the 2025 file continue a documented inventory-completeness failure at the agency holding the largest high-impact AI portfolio in the federal government.

Two numbers carry the most weight for a corporate reader, because they measure the exercise of authority rather than its existence.

First, classification. The 2025 file records 110 use cases coded "Presumed High-Impact, but Not High-impact" — cases where an agency official filed the written rebuttal M-25-21 requires and the CAIO accepted it. DHS accounts for 49 of them, Justice 32, HHS 13. That is a decision right visibly in use, in the open, with the reasoning recorded. It is more transparency about AI risk classification than any listed company in the world provides.

Second, termination. The 2024 inventory is the last one filed under the predecessor memo, and the one with the richest free-text risk fields. Exactly one row in 2,133 records the phrase "Agency CAIO has waived this minimum practice and reported such waiver to OMB." One. It is the Department of Housing and Urban Development's "Translation of Digital Media" use case, and it carries the waiver language across seven separate minimum-practice fields — operational testing, independent evaluation, notice, disparity mitigation, affected-group consultation, appeal and opt-out. One use case, seven practices set aside, across the entire United States federal government.

Nor is it an accident of reporting. Agencies say in their own compliance plans that they do not expect to use it. The EEOC states it "currently has no intention of issuing any waivers." Treasury's plan defines a waiver process, assigns it to the AI Governance Board with legal and risk officials involved, and then says: "Treasury does not anticipate the need for such waivers. This framework is included to meet OMB's requirement and would only be applied in exceptional circumstances." Two of two agencies sampled built the stop mechanism to satisfy the memo and told the reader in advance they did not plan to pull it.

A waiver authority used once is not a governance failure in itself; agencies mostly did not reach the point of needing one. Set it beside the retirement rate — 314 of 3,611 use cases marked Retired in 2025, 8.7%, with VA at 72 and HHS at 49 — and the pattern is familiar to anyone who has sat in a corporate portfolio review. The machinery for stopping exists. It is documented, it is non-delegable, and it is almost never operated.

GAO has been measuring the same system from outside for three years, and the shape of what it finds has not changed. In December 2023 it found 20 of 23 agencies reporting roughly 1,200 current and planned AI use cases, with "five agencies providing comprehensive information for each of their reported use cases while the other 15 had instances of incomplete and inaccurate data," and twelve agencies fully implementing the AI requirements in federal law, policy and guidance. Its report of 29 July 2025 found generative AI use cases at 12 selected agencies rising roughly ninefold in a year — from 32 to 282 — while total AI use cases at 11 of them nearly doubled from 571 to 1,110. The obstacles agencies named were not model quality. Officials at 10 of 12 agencies said existing federal policy, data privacy policy among it, could obstruct adoption; eight named insufficient technical resources and budget; six named the difficulty of keeping use policies current against a technology that moves faster than the policy cycle.

Two design choices in the federal model are worth stealing outright. The first is the shared platform. Rather than let 24 agencies each negotiate model access, GSA built USAi — a "secure generative artificial intelligence evaluation suite" offered to agencies "at no cost to them," with dashboards and usage analytics so agencies can "track performance, measure maturity, and guide adoption strategies." Central procurement, central evaluation, distributed use. The platform is also acquiring the thing most corporate platforms lack, which is an independent evaluation standard: on 18 March 2026 the Center for AI Standards and Innovation signed a memorandum with GSA to build methods for assessing performance, security and functionality "in real-world workflows," together with pre-deployment assessment guidelines and post-deployment performance measurement. Evaluation as a procurement input, set by a body that is not the buyer or the seller.

The second design choice worth stealing is the mandate in America's AI Action Plan that agencies "ensure — to the maximum extent practicable — that all employees whose work could benefit from access to frontier language modelsThe most capable models available at a given moment, from the handful of labs operating at that level. "Frontier" is a moving description rather than a product category: this year's frontier is next year's commodity, which is the fact underneath the thesis. If every large organization can rent essentially the same best models, the model cannot be what separates them. have access to, and appropriate training for, such tools." Access is treated as infrastructure, not as a reward for winning an approval process.

None of which means the federal guidance is complete. GAO reported on 26 March 2026 that of ten relevant expert-identified privacy challenges in federal AI use, "OMB's AI, data, and privacy-related government-wide guidance fully addressed two and partially addressed eight." Partial is not nothing, and the residue is specific: how to evaluate models against sensitive data, how to separate data, what performance metrics to require, how to run a privacy impact assessment for AI. GAO's suggested remedy points straight at the operating model: use the Chief AI Officer Council as the forum. The structure exists; what it lacks is content.

The federal experiment says something quite specific. The structure works: a mandated officer, a board chaired one level below the top, a published inventory and a written termination rule survived a change of administration and produced the most detailed AI operating picture available anywhere. The enforcement does not: the practices that gate the highest-risk uses are documented as complete on roughly one in ten of them, and the one authority explicitly designed to stop things has been recorded as used once. A private company copying this design will inherit both halves, and will inherit the second half more easily than the first, because nobody outside will be reading its inventory.

9 · Decision rights and money — five rights, and the one that nobody wants

An operating model is a list of who can decide what without asking. Those permissions have a name in organizational design — decision rights — and the term is more exact than it sounds. A decision right is the ability to settle one specific question and have the organization treat it as settled, without another executive's consent. Influence and a seat at the table are something else. Writing them down one at a time is unglamorous work, and it is most of the difference between an org chart and an operating model. For enterprise AI there are five decisions that matter, and the difference between working companies and stalled ones is almost entirely in how cleanly the fifth is assigned.

Propose. Who may start a use case. In most large companies the answer is functionally "anyone with a budget code," which is the correct answer — the field evidence says the best-performing initiatives originate in the line. NANDA's buyers "sourced AI initiatives from frontline managers, not central labs." Restricting proposal rights is the one place where centralization is almost always wrong: it optimizes for the wrong scarcity, since ideas are abundant and the constraint is downstream.

Fund. Who pays, and out of whose line. Three patterns exist. A central innovation budget makes experiments cheap for the business and makes cancellation politically free, because no business unit loses anything when a centrally funded pilot dies. That is also its weakness: nothing centrally funded has an owner who cares. Business-unit funding produces the opposite: real ownership, real relevance, and a portfolio nobody can see. The hybrid that appears in disclosed designs funds the platform centrally and the use cases locally, and it is the arrangement that makes the unit economicsWhat one unit of the thing costs and what it earns — a resolved support ticket, a reviewed contract, a screened transaction — rather than what the programme costs in total. It is the only frame in which an AI use case can be compared with the alternative it replaced, and it is the number a termination decision has to rest on. A programme that can state its annual budget but not its cost per resolved ticket has no basis for stopping anything. legible, because the platform bill can be apportioned.

Promote. Who decides a pilot becomes a production system. This is the gate the demo-to-production literature is about, and it is the right most often left implicit. A gate, throughout this document, is a plain and rather boring object: a defined moment at which a use case may not move forward until stated conditions are documented and a named person signs. All of its power is in the timing. Before the gate, stopping something costs a conversation; after it, stopping something costs a running system, a signed supplier and somebody's standing. In the federal design it is explicit and split: a business official proposes, and where the use is high-impact the CAIO certifies. In corporate practice it usually collapses into whoever owns the infrastructure the thing has to run on. The decision then gets made on operational readiness rather than business value, by a person with no view of the business value.

Own the risk. Who is accountable when the output is wrong. The federal answer is unusually clean because the memo forced it: the use case has a named agency official, the classification as high-impact is recorded, and the CAIO can revisit any classification "at any time." The corporate answer is frequently that risk is owned by a committee, which is a way of saying it is owned by nobody.

Terminate. Who can switch it off. Nobody wants this right, and the reason is structural, not a matter of culture. The person best placed to judge whether a pilot is working is the person who proposed it, funded it, and staffed it. Asking that person to kill it is asking them to write down their own investment and their own judgement in the same meeting. Every organization that has ever run a project portfolio knows this, and every organization solves it the same way when it solves it at all: by separating the person who decides to continue from the person who proposed, and by making continuation the decision that requires justification rather than termination.

A sixth right hides inside the other five and is usually handled as paperwork: who owns the vendor relationship. Enterprise AI is bought more often than built, so the contract is where a great deal of the operating model actually lives, and the federal regime is the only place it has been specified in public. OMB M-25-22, issued the same day as the memo everyone reads, requires agencies to "convene a cross-functional team of relevant agency officials" for an AI acquisition, and names the equities: acquisition, IT, cybersecurity, privacy, confidentiality, civil rights, civil liberties, budgeting, data, legal and program evaluation. Not a procurement decision made by procurement.

The terms it requires are the ones an enterprise discovers it needed two years late. Agencies must scope licensing and intellectual-property rights "based on the intended use of AI, to avoid vendor lock-in," and include solicitation provisions on "knowledge transfer, clear data and model portability practices, clear licensing terms, and pricing transparency." They must disclose in the solicitation whether the intended use meets the high-impact threshold, so the vendor knows in advance what documentation it will owe. And contracts must give the agency "the ability to regularly monitor and evaluate ... performance, risks, and effectiveness of an AI system or service," on a stated cadence. The Chief AI Officer Council reviews agency IP processes to push toward common practice.

Then M-26-04, issued 11 December 2025, extended the same instrument to model behaviour. Every solicitation for a large language model must carry contractual requirements on the two principles the underlying executive order sets out, existing contracts should be modified before the next option is exercised, and agencies had until 11 March 2026 to update their procurement policies — including "processes for agency users of LLMs to report outputs that violate" those principles. The memo sunsets after two years unless renewed.

Whatever one makes of the substance, the mechanism is the transferable part, and it is one most companies have not built. A corporate AI programme that has thought hard about who approves a use case and not at all about what its model contract says on portability, monitoring rights and exit has assigned four decision rights and left the fifth with the vendor. The cost of that shows up later, as a switching costEverything you would have to pay to move to a different supplier that has nothing to do with the price of the new one: migrating the data, rebuilding the integrations, retraining the users, absorbing the outage. Where it is high enough, the choice stops being a choice — which is the sense in which a right you never negotiated has been transferred to the vendor., and by then it is not a decision.

Money makes the same point from a different angle. NANDA asked executives to allocate a hypothetical $100 across functions and found the allocation heavily skewed toward sales and marketing — the report's section takeaway says 50% and its body text says "approximately 70 percent," an internal inconsistency NANDA never reconciles. Either way the finding holds: budgets favour "visible, top-line functions over high-ROI back office," and the report is explicit that "this bias reflects easier metric attribution, not actual value."

It explains a great deal of otherwise inexplicable capital allocation. A marketing use case produces a number a marketer can put in a deck within a quarter. A procurement or claims-handling use case produces a saving that shows up as a slightly lower cost line eighteen months later, attributable to nothing in particular. The organization does not fund the higher return. It funds the more attributable one. Fixing that takes attribution built before the funding decision, not exhortation. The measurement regime has to precede the portfolio.

What working companies actually spend is mostly undisclosed, and the few figures that exist are stated at a level of aggregation that defeats analysis. JPMorgan discloses a 2026 technology budget of approximately $19.8 billion and does not break out AI within it. Wharton's panel reports that 88% of enterprises anticipate generative AI budget increases over the next twelve months and that about one-third of generative AI technology budgets go to building custom internal capability. Klarna is the rare case that quantifies the other side of the ledger: over 1,700 supplier contracts reduced or cancelled after AI adoption and standardization, $7 million taken out of external marketing suppliers in a single quarter with 37% of that reduction attributed to AI, and $39 million of assistant-related cost savings in 2024. Those are the numbers a CFO can audit, and they concern spend removed rather than value created.

The inference bill is the newest line item and the one most often misunderstood. Inference is what it costs to use a model rather than to build one: every request and every response is metered and billed by volume. Training is a capital event, and it happens at the supplier. Inference is an operating cost that lands on the buyer each time somebody actually uses the thing — which makes it, unusually among technology costs, traceable to one piece of work. The instinct imported from cloud cost management is to minimize it. Anthropic's usage data suggests that instinct is wrong at the enterprise level: in its September 2025 index, higher-cost tasks showed greater usage, not less, and the report's conclusion is that model capability and the value of automating the task matter far more than the per-token price. The elasticityHow much the quantity demanded of something moves when its price moves. Demand is elastic where a price cut brings a large increase in use, and inelastic where it barely registers. The finding being reported is the awkward one for cost-control instincts: enterprises used the expensive tasks more, not less, which suggests they are buying the value of the task being done rather than shopping on price. estimates in that analysis are explicitly preliminary and come from one vendor's logs. The caveat leaves the operating implication standing. The point of metering inference is attribution, not reduction: assign the cost to a use case, to a business unit, to a unit of output, so that somebody can compute a cost per resolved ticket, per reviewed contract, per screened transaction. An organization that cannot compute that number cannot make a kill decision on evidence, and will make it on politics.

One disclosure event shows how fast the outside world's ability to check any of this is disappearing. Accenture reported advanced AI new bookings of $2.2 billion in the first quarter of fiscal 2026, against $20.94 billion of total new bookingsThe value of contracts signed in a period, which is not the same as revenue recognized in it — the work is delivered, and the money earned, over the months or years that follow. Bookings are therefore a forward-looking signal of demand rather than a record of activity, and they are the closest public read available on what enterprises are committing to spend on AI advisory work.. Management then said it would stop reporting the metric discretely, on the reasoning that AI is now embedded in nearly everything the firm does. The reasoning is defensible and the consequence is not neutral. The single largest independent estimate of what enterprises are paying consultants to do AI work has just been withdrawn from the public record.

As AI stops being a separately reported category inside vendors, integrators and their clients, the only remaining public evidence about enterprise AI value becomes the survey base — which is produced by firms selling AI services, graded by the executives accountable for AI programmes, and repeated without its method note. The measurement problem this primer opened with does not resolve as the market matures. It gets worse, because the categories dissolve into the general ledger exactly as the questions get more consequential.

10 · Data, platform, people — what has to exist before an org chart means anything, and the order it appeared in

Data, a platform and people gate everything else.

The data estateEverything an organization holds about its business and its customers, wherever it happens to live — the warehouse, the ageing mainframe, the departmental spreadsheet, the vendor's system. Calling it an estate rather than a database is deliberate: the problem is rarely one system, it is the sprawl, the inconsistency between parts of it, and the fact that nobody owns the whole.

Every serious account of enterprise AI failure puts data first, and the failure is almost never about volume. It is about reachability and permission — whether the system that needs the record can get the record, and whether anyone can say yes to that without a six-month review. Gartner named poor data quality first among its causes of post-proof-of-concept abandonment. GAO found officials at 10 of 12 agencies citing data privacy policy as a potential barrier to generative AI adoption. JPMorgan states the requirement in one clause: "we connect models to well-governed data, with safeguards that protect clients, the firm and the financial system."

The federal inventory lets the point be counted rather than asserted. Of 3,611 reported use cases, 360 record that they process personally identifiable information, 1,151 record that they do not, and 2,100 leave the field blank. That distribution says more about data cataloguing than about privacy risk: for well over half the federal AI estate, nobody filled in whether the system touches personal data. An organization that cannot answer that question about its own systems has not yet reached the point where the org-chart debate is the binding constraint.

The platform layer

The platform is the answer to a question about arithmetic: how many times will this organization build model access, prompt logging, evaluation harnesses, red-teamingDeliberately attacking your own system to find out how it fails — feeding it the manipulative prompt, the poisoned document, the question it should refuse — before somebody outside does it for you. The name comes from military exercises where one team plays the adversary. It is the difference between knowing a system works when used as intended and knowing what it does when it is not., PII redaction, cost attributionAssigning each dollar of model usage to the use case, business unit and unit of output that caused it, rather than letting it land in one central technology line. Without it there is a total and no denominators, so nobody can say what a resolved ticket costs — and a portfolio review with no cost per unit has nothing to weigh a termination against. and a security review? Once, or once per business unit? Every disclosed working design answers once. JPMorgan built LLM Suite in-house as a single controlled environment giving access to models from multiple providers. DHS built DHSChat for all personnel, behind mandatory training and rules of behaviour. GSA built USAi so that agencies would not each build their own. Walmart consolidated a proliferating tool estate into four agents on one framework.

The security half of the platform is where the demo-to-production gap physically lives, and the federal data shows the seam. Of 1,040 deployed federal AI use cases, 534 report holding an authority to operate, 336 report not holding one, and 170 leave the field blank. A third of deployed systems in an environment with a mandatory, well-established authorization regime are running without the authorization that regime requires. Whatever the explanation — inapplicability, backlog, reporting error — the mechanism generalizes. Where the path to a production control is slow, systems reach production without it, and the control arrives retroactively, after an incident, instead of as a gate.

The people

Talent is where the honest answer is least comfortable, because the two things every company says about it are in tension. Companies say they will close the gap with training, and companies say the gap is in scarce, expensive, externally hired skills. Wharton's panel found both, and found the first losing: nearly half of organizations reported technical skill gaps, and in the same year investment in training fell 8 percentage points and confidence in training as the primary route to fluency fell 14. Recruiting advanced generative AI skills was named a top challenge by 49%. Lightcast, analysing over 1.3 billion job postings in a report released 23 July 2025, puts a 28% salary premium — "nearly $18,000 more per year" — on postings requiring AI skills, and finds that 51% of those postings sit outside IT and computer science occupations entirely.

The scarce person is the operations manager, the underwriter or the claims lead who understands a process well enough to redesign it and is fluent enough to know what the system can and cannot be trusted with. Machine-learning engineers are expensive, but a company can hire them. These people are already inside the company, doing the job, and the only way to get them is to train them — which is the budget line Wharton found falling.

Klarna shows what the endpoint of that logic looks like in a company that went all the way: more than 1,500 of 2,831 positions, about 53% of the entire organization, in engineering and data science. That ratio makes Klarna a payments company whose median employee is a builder.

The sequencing does not resolve one tension. The field experiments are unanimous that the largest gains accrue to novices — 34% for the least experienced support agents against near zero for the most experienced, with the writing and consulting studies showing the same compression. The labour data show hiring of 22-to-25-year-olds in AI-exposed occupations running 19% below the counterfactualWhat would have happened otherwise — here, the hiring path this group would have followed had it kept tracking the comparison group. It is a constructed estimate, not an observation, which is why the authors of that work call their findings descriptive rather than causal. It is also the only honest way to state an effect: a number that fell means nothing until you say what it would have done instead., through reduced hiring rather than separations. A company that uses the technology to stop hiring juniors captures a margin gain now by consuming the pipeline that produces the seniors who will supervise the systems later. Nobody in the org chart owns that trade, because it sits between the AI programme, the workforce plan and the capital allocation process — and it is exactly the kind of decision that falls between three chiefs and gets made by default.

11 · Redesign, and how it is measured — the difference between changing a process and putting a chatbot next to it

Buying a licence for every employee is a procurement decision. It is frequently described as an AI strategy, and the reason the description survives is that the two produce identical-looking dashboards for about a year.

The clearest disclosed redesign in the record is Klarna's, and the process is the part that matters. Before: a customer contacts support, waits in a queue, reaches a human, and the human resolves the issue in about twelve minutes on average. After: the system is the first tier and handles 80% of chats; the human tier still exists but is now an escalation path for disputes, complex refunds and hardship cases; resolution for the automated tier is about two minutes; repeat inquiries fell 25%. Steps were removed. Roles were redefined. The company reports the throughput number and the quality control in the same sentence — 80% of chats "with no drop in consumer satisfaction levels since its introduction."

JPMorgan's transaction-screening example has the same shape in one line: "AI has enabled us to review more than double the volume while halving the number of manual operator checks." Volume up, human checks down, both quantified. That is a redesigned control process, not a screening tool with a copilot bolted on.

Each is one workflow, taken deep. Klarna did not deploy generative AI evenly across a payments company; it rebuilt customer service and then let the rest follow. JPMorgan names transaction screening specifically, inside a firm running a $19.8 billion technology budget. The instinct that produces the Value Gap is the opposite: buy the licences for everyone, run enablement sessions, and wait for value to emerge from the aggregate. It does not emerge, because nobody in that model is accountable for changing a process.

The Census microdata is consistent with depth being the norm among adopters even where success is not measured: 57% of AI-using firms deploy it in three or fewer business functions and 65% limit worker use to three or fewer tasks, with 66% using it purely to augment existing tasks. Most firms are narrow. The difference between the narrow firms that get something and the narrow firms that do not is whether the narrowness was chosen and redesigned around, or simply the extent of the rollout so far.

What to measure, and what not to

A measurement regime is a kill mechanism in disguise. Whatever it counts becomes the thing the portfolio optimizes for, and if what it counts always goes up, nothing will ever be stopped.

Two cautions on the measurement side, both of which cut against comfortable practice. The first is the METR result, which is really about the reliability of asking people how much faster they got. Participants who had been measurably slowed by 19% estimated afterwards that they had been sped up by 20%. Any regime that runs on satisfaction surveys, self-reported hours saved, or "employees report AI saves them X hours a week" is collecting a number that has been shown to get the sign wrong.

The second is subtler and concerns what happens when the vendor supplies the telemetryData a system emits about its own use — who opened it, how often, for how long, with what result — collected automatically rather than by asking anyone. It observes instead of surveying, which makes it far more reliable about usage than a questionnaire. It also sees only its own product and nothing about whether the work on the other side got better, which makes it no evidence at all about value.. Microsoft's 2026 Work Trend Index reports that a privacy-preserving analysis of more than 100,000 Microsoft 365 Copilot chats found 49% of conversations supporting cognitive work, and that 67% of leaders are familiar with agents against 40% of employees. Vendor telemetry is genuinely more reliable than self-report — it observes rather than asks. It is also produced by the party selling the licences, describes only its own product's usage, and cannot see the business outcome on the other side of the interaction. It is a good input to a usage question and no input at all to a value question.

Pick a small number of workflows. Instrument the baseline before you deploy anything, because after deployment there is no baseline and every number becomes an argument. Report a throughput or cost figure and a quality control together. Then set, in advance, the level at which the use case gets stopped — and give that decision to someone who did not propose it.

12 · The reference design — who owns the platform, who ships, and who can say stop

Every box in the chart below is copied from somewhere. Each element exists because a named organization runs it that way, a measured outcome supports it, or a documented failure mode is prevented by it. Where the evidence does not settle a choice, the text says so and gives a decision rule instead.

Read the chart as an answer to five questions rather than as a hierarchy.

Where does the platform sit? Under the CIO or CTO, funded centrally, serving everyone. It owns model access, the evaluation harness, logging, security review, PII handling and the cost meter. It does not own use cases. The moment it owns use cases it becomes the queue described in Section 6, and the business routes around it.

Where does delivery sit? In the business, under leads who report to business-unit presidents and are measured on the unit's own numbers. They propose, prioritize and ship. Their dotted line to the hub is real — it covers standards, evaluation and model access — but their solid line runs to the person whose P&L moves.

Where does the stop authority sit? Outside delivery, in AI risk and assurance, reporting to the chief risk officer or the general counsel. It classifies use cases, certifies promotions, monitors deployed systems and can terminate. It is the smallest box on the chart and the one that decides whether the rest of it works.

Who arbitrates? A council chaired one level below the chief executive, with the platform lead as vice-chair and mandated membership from finance, people, security and legal. This is lifted directly from M-25-21 and DHS's implementation of it, and the two structural details matter more than the existence of the body: the chair is a line executive, not the AI lead, and the AI lead's vice-chair position gives standing without giving control.

Who owns the data? Named product owners by domain, accountable for whether a given dataset is reachable and permissioned — not a central data organization that owns everything and therefore is asked for everything.

The smaller design

Below roughly 5,000 employees, or in a business with one dominant process rather than several genuinely different ones, most of the chart above is overhead. The evidence supports a much smaller structure: a platform team of a handful of people reporting to the CTO; the stop authority held by an existing risk or audit function rather than a new one; no council, replaced by a standing item on the existing operating review; no Chief AI Officer at all. Moderna's disclosed executive committee — nine members, no CAIO, no CIO, no CDO, digital technology inside the people function — is a live example of a mid-cap running without any of the specialized boxes. NANDA's finding that mid-market firms reported roughly 90 days from pilot to full implementation against nine months or longer for enterprises is consistent with the smaller structure being faster, though that comparison rests on the same 52 interviews as the rest of the study and should be held loosely.

The decision rule for whether to add the boxes: add the platform team when the second business unit starts building the same capability; add the separate stop authority when the first use case reaches a decision that affects a customer's money, safety or legal rights; add a council when two chiefs have escalated a conflict over the same use case twice; add a Chief AI Officer only when the product itself contains AI and the role therefore has revenue attached to it.

13 · Cadence and sequence — the four loops, and what to build first

An org chart says who holds what. It says nothing about how often anything happens. Four loops run at different speeds, and each exists to make one specific failure mode expensive.

The sequencing question — what to build first — has an answer in the disclosed record, and it is not the answer most programmes follow.

First, visibility and reachability. An enumerated list of every AI use case in the organization, and a named owner for every dataset those use cases need. Neither is glamorous and both are cheap. DHS has published an inventory annually since 2022 and is, not coincidentally, one of the few large agencies that could answer the risk-management questions when asked. The federal counter-example is on the record too: 2,100 of 3,611 use cases with the personal-data field left blank.

Second, the platform. Model access, evaluation, logging, security review and the cost meter, built once. The test for whether it is done is not whether it exists but whether a business unit can get a use case from idea to a tested prototype without negotiating a contract or a security exception. Every disclosed working design built this before it built an AI leadership structure — JPMorgan on "more than 10 years" of machine learning and data foundations, GSA standing up USAi before most agencies had scaled anything.

Third, the gate and the stop authority. Before the portfolio gets large enough that stopping things becomes politically expensive. This is the step that is almost always deferred, on the reasonable-sounding argument that governance should not slow down early experimentation. The argument is correct about the gate's severity and wrong about its timing: a gate installed at twenty use cases costs nothing, and a gate installed at two hundred is a reorganization.

Fourth, the workflows. Two or three, chosen for the properties the field experiments identified — bounded, high-volume, gradable output, staffed disproportionately by people who are not yet expert. Instrument the baseline first. Design the escalation path before removing the humans, which is the lesson Klarna paid for in public.

Fifth, and only fifth, the leadership structure. By this point the organization knows which variant of the role it needs, because it has watched where the work actually got stuck. A company that names a Chief AI Officer before it has a platform has asked someone to lead an organization that does not exist yet.

The sequence most companies actually run is close to the reverse: announce the ambition, name a leader, buy licences at scale, run a hackathon, accumulate pilots, and discover the data problem in month nine. Each step is individually defensible and the order is what fails. Licences at scale generate the seat metric described in Section 11, which cannot fall, which means the programme's headline number improves while its portfolio converges on nothing. The leader appointed at step two spends the first year building the platform they were assumed to already have, and is then measured against expectations set when the announcement was made.

One caveat applies to the whole blueprint. Every organization in the evidence base is a survivor. JPMorgan, Klarna, Walmart, DHS and Moderna publish because they are still here and, in four of the five cases, because a regulator requires it. The companies that sequenced differently and failed did not write it up. The sequence above is therefore a description of what worked in the cases visible, not a demonstration that alternative sequences fail — and the difference matters more than the confident tone of most best-practice writing admits.

14 · The live arguments — five questions the evidence does not settle, argued on their merits

Five disputes in this field are genuinely open. Each is usually presented as settled by whoever is presenting it, and in each case the honest position is a decision rule rather than an answer.

Centralize or federate — and does the answer change as models improve?

The case for centralizing is that the expensive parts are identical everywhere. Evaluation harnesses, security review, model contracts, PII handling and cost attribution do not vary by business unit, and building them three times is a straightforward waste that also produces three different standards. The case for federating is that the valuable part is not identical anywhere. The field evidence says returns come from redesigning specific workflows, and the knowledge of which workflow is worth redesigning is held by people who cannot be centralized without being removed from the process they understand. NANDA found the successful buyers sourcing initiatives from frontline managers rather than central labs, and found large firms leading in pilot volume while lagging in conversion — the signature of a centre that can start things and cannot finish them.

Does capability change the answer? There is an argument that it does. As models get better at using tools, retaining context and operating across systems, the integration cost that justifies a central platform falls, and the balance should tilt toward the line. There is a stronger argument that it does not, and it runs the other way: as systems act more autonomously, the cost of an unmonitored failure rises, and the case for a common evaluation and control layer strengthens rather than weakens. What would settle it is a comparison nobody has run — outcomes for matched firms under different structures, with a common definition of success. In its absence, treat every confident claim about the superiority of one structure, including the currently fashionable hub-and-spoke, as a hypothesis with a vendor attached.

Is the Chief AI Officer a transitional role?

The case for permanence is that AI is now a durable capability requiring a durable owner, in the same way that information security acquired a permanent chief once it stopped being an IT subspecialty. The case for transience is stronger and has better evidence behind it. The role's core job in a non-technology company is to build a capability the company does not have; once built, the capability belongs to whoever runs technology and whoever runs the business. The Federal Reserve appointed a CAIO in early 2024 and moved strategic oversight to the Office of the Chief Data Officer by late 2025. Of the federal CAIOs whose designations are public, most are an existing chief wearing a second hat, which is what a transitional role looks like when an organization is forced to name one.

The product decides it. FactSet's Chief AI Officer leads "AI services for clients" and reports to the chief executive; that role has revenue attached and will not fold into IT. Mastercard's combined Chief AI and Data Officer sits inside the services side of the business rather than inside technology. Where the product contains AI, the job is permanent because it is a revenue job. Where it does not, the job is a construction project with a leadership title.

Build or buy at the application layer?

The consensus that has hardened over the past two years is buy, and the evidence is real but softer than it looks. NANDA's interview sample put external partnerships at roughly 67% deployment success against roughly 33% for internal builds, and the report flags its own confound: firms choosing partners may differ systematically in procurement sophistication and risk tolerance. The federal file is more neutral evidence — 594 vendor-purchased against 581 in-house and 429 mixed, in an institution with deep internal engineering.

The case for building is narrower than its advocates claim and better than its critics allow. It rests on two conditions, and where both hold it is decisive: the workflow is one the company competes on, and the data it needs cannot leave. JPMorgan built LLM Suite in-house rather than buying an enterprise assistant, and the reason is visible in the same annual report — a firm whose regulatory position depends on where its data sits and who can see it. Klarna's disclosure of over 1,700 supplier contracts cancelled after AI adoption and standardization is the same logic taken further: consolidation onto one owned platform, with the savings coming from the suppliers no longer needed.

The thin-wrapperA dismissive term for an application that is little more than a user interface and a prompt sitting on top of somebody else's model — the implication being that it adds nothing the model does not already do, and that the model provider could absorb it tomorrow. The interesting cases are the ones where the label is wrong: where the wrapper's value is the company's own data, permissions and process, none of which the model provider has. question — whether it is ever worth building internally what a vendor sells — has a clean answer that has nothing to do with the technology. Build the wrapper when the thing you are wrapping is your own data and your own process, and the wrapper's value is the fit rather than the model. Buy when you are wrapping a general capability, because the vendor will out-iterate you and the model underneath will change three times before your internal version reaches maturity.

Can workflow redesign be led from the centre?

Almost certainly not, and the field experiments explain why. The returns depend on properties of the specific task — how bounded it is, how gradable the output is, how experienced the person doing it is — and those properties are invisible from a central function. The jagged-frontier result is the sharpest version: within one consulting workflow, on tasks of apparently similar difficulty, AI raised performance on eighteen and cut correctness by 19 percentage points on one. Nobody at a central lab can tell in advance which task is which. Only the person who does the work can, and even they cannot always.

What the centre can do is make redesign cheap and make its results legible: instrument the baseline, supply the evaluation harness, meter the cost, and hold the standard. That is a service, not a leadership function, and describing it accurately is most of the argument against calling the platform team a centre of excellenceThe standard corporate name for a central team gathering scarce expertise and disseminating best practice. The objection here is not to the team but to the framing: "excellence" implies the centre knows which work is worth changing, when the field evidence says that knowledge sits with the people doing the work. A service that instruments and standardizes is valuable. A centre that also chooses the processes becomes the queue described in Section 6..

Are the pilot-failure numbers a J-curve artifact?

This is the most substantive challenge to the whole failure literature, and it deserves the strongest form. General-purpose technologiesThe handful of inventions broad enough to reshape how nearly every industry works — the steam engine, electrification, the computer. They share an awkward signature: the measured payoff is held to arrive long after the invention, because the value is said to come not from the machine itself but from rebuilding the work around it. That claim is the whole basis of the J-curve argument being made here, and it is why the argument is about timing rather than about whether the technology works. produce a productivity J-curve: measured output falls or flatlines during the years when firms are building the intangible complements — process changes, retraining, reorganized workflows — because that investment is expensed rather than capitalizedAccounting decides where a cost lands. A capitalized cost — a building, a machine — goes onto the balance sheet as an asset and is written down over its useful life. An expensed cost hits this year's profit in full. Retraining, process redesign and reorganized workflows are expensed, so the spending that actually creates the value shows up as a cost today and as nothing at all in the asset column — which is exactly how a real investment can look like a failed one in the accounts.. Under that reading, a 95% pilot failure rate is what the bottom of the J looks like from inside, and the pilots that "failed" were the complementary investment.

The evidence genuinely cuts both ways. METR's own February 2026 follow-up is the strongest exhibit for the J-curve side: a design that measured a 19% slowdown in early 2025 measured directional speed-ups a year later, and METR reported that its randomization had been undermined because developers would not surrender the tool. That is what capability improvement looks like arriving inside a measurement. Against it, first, Acemoglu's arithmetic: even granting the task-level effect sizes, the share of tasks exposed is small enough that the ten-year total factor productivity gain lands under 0.7%, and possibly under 0.53%. A J-curve implies a subsequent upswing large enough to justify the trough; that estimate says the upswing is modest unless the exposed share rises a great deal. Second, and more directly: the failure literature's diagnoses are not about capability. Gartner names data quality and unclear business value. GAO's agencies name compliance with existing policy and insufficient budget. NANDA names workflow integration and organizational learning. The federal inventory shows a third of deployed systems without an authorization and 71% of high-impact cases without a recorded risk status. None of those get solved by a better model.

Both are true, and they operate on different quantities. Capability improvement is raising the ceiling on what a well-run organization can extract. Organizational design determines how much of that ceiling any particular company reaches. A rising ceiling widens the gap between the organizations that can convert and the ones that cannot, which is the opposite of the comforting reading that time will fix this.

The strongest case against this primer's thesis

Everything in this document is an artifact of a transitional moment. The reason enterprises need platform teams, evaluation harnesses, promotion gates and decision-rights tables is that today's systems are brittle at the seams: they do not retain context, do not integrate with existing software, and cannot be trusted to act. Every one of those is a capability deficit, and every one is closing. Enterprise API traffic is already automation-dominant — 77% in Anthropic's September 2025 index, and roughly three-quarters in its January 2026 report, against 45% on the consumer product. As systems become able to operate software, hold institutional context and act reliably, the integration work that currently requires an organizational apparatus becomes a purchase. The companies building elaborate AI operating models today are building scaffolding for a building that will be delivered pre-assembled, and the ones that stayed lean and waited will have spent less to arrive in the same place. The federal government's own strategy document says the bottleneck is adoption, not technology — which is precisely what you would expect a bottleneck to look like just before it clears.

One inconvenient detail sits inside that argument's own best evidence. Anthropic's January 2026 index reports that the share of consumer conversations in its "directive" mode — hand over the task, accept the output — peaked at 39% in August 2025 and then fell seven percentage points to 32% by November 2025, from a base of 27% in January 2025. Delegation rose and then partly reversed while capability continued to improve. Whatever is governing how much people hand over, it is not tracking capability in a straight line.

That argument is serious and it is partly right. It is wrong on the part that matters, for a reason visible in its own evidence. The bottleneck it predicts clearing is the integration bottleneck. The bottleneck this primer identifies is permission and accountability, and improved capability makes it tighter rather than looser. A system that cannot act needs an approval to be built. A system that can act needs an approval to be trusted — with a named owner, a monitored failure mode, an escalation path and someone who can switch it off. That is a heavier governance requirement, not a lighter one. The federal inventory shows the constraint precisely: 336 of 1,040 deployed use cases running without the authorization the regime requires, on today's technology, which does very little autonomously. The same organization with agents that act would not have a smaller problem. It would have the same problem with consequences attached.

15 · What we do not know — the limits of the evidence, and what would make this blueprint obsolete

The evidence base for everything above is about three years old. That needs saying out loud in a field whose literature is written in the present tense.

There is no causal evidence on operating-model structure at all. Not one randomized or quasi-experimentalA study that gets close to the strength of a randomized trial without being able to assign anyone at random — by exploiting a policy change, a staggered rollout, or some other accident that split otherwise-similar units into treated and untreated groups. It is the standard evidence a question like this one could realistically produce. That not even this exists is the point being made. study compares centralized, federated and hub-and-spoke AI organizations on a common outcome. Everything in Part II, including this primer's own reference design, is inference from disclosed structures at organizations that are still standing. The productivity literature is genuinely good — randomized, preregistered, published — and it studies individual tasks, not organizations. The organizational literature is interviews and surveys. That asymmetry is the single largest gap in the field, and it will not close soon, because no company will randomize its own org chart.

Every case is a survivor. JPMorgan, Klarna, Walmart, Moderna and DHS appear here because they publish. Four of the five publish because a regulator requires it. The organizations that made different choices and failed produce no annual report about their AI operating model, and their absence from the evidence base is correlated with exactly the variable being studied.

The definitions are unstable across every source. "Adoption" means used-in-two-weeks at Census, used-in-a-function in the practitioner panels, and used-by-an-employee in the household surveys. "Pilot" and "production" are respondent-defined in every study that measures conversion, which is why the pilot-failure rate ranges from 5% to 75% depending on who is counting. Even the federal inventory changed its stage taxonomy between 2024 and 2025 — from "Operation and Maintenance" to "Deployed" — which is why this primer does not compute a year-over-year conversion trend from it. The numbers in this document are as comparable as their sources allow, and no more.

Three specific claims here rest on partial evidence and should be treated accordingly. The federal high-impact compliance figures are a snapshot taken at the December 2025 submission deadline, roughly three months before the April 2026 compliance date, so they describe status ahead of the deadline rather than failure after it. The CAIO reporting-line distribution rests on 17 confirmed designations out of roughly two dozen, reported in August 2025, and individual designations change. And the SEC full-text search is a floor in two separate directions: it counts documents rather than companies, and a share of those documents mention a director's Chief AI Officer role at some other company rather than the filer's own. Both were corrected for in Section 4 by de-duplicating to 42 filers and by reading the large-capitalization filings individually, but the residual share of third-party mentions across all 126 documents was estimated from an eleven-document sample rather than classified in full. The count supports a floor. It does not support a population estimate.

One regulatory forcing function just moved, and it is now law rather than a proposal. A great deal of European AI governance work was funded against an August 2026 deadline for high-risk systemThe EU AI Act's own risk tier, and not the same thing as the US federal inventory's "high-impact" — two regimes, near-identical words, different tests and different obligations. The European version is defined largely by listed use categories and by systems acting as safety components in regulated products, and it carries duties on documentation, data governance, human oversight and post-market monitoring. A company operating in both jurisdictions has to classify twice. obligations under the EU AI Act. The Commission proposed deferral in the Digital Omnibus on 19 November 2025; co-legislators agreed the text on 7 May 2026, as the European Parliament's legislative record tracks; and on 27 July 2026 the Commission announced that the AI Omnibus had entered into force, published at OJ L_202601744, with the high-risk dates now applicable law: 2 December 2027 for stand-alone systems and 2 August 2028 for systems embedded in regulated products. Organizations that built their AI governance because a date was coming have had roughly sixteen months handed back. The programmes that survive that reprieve are the ones that were built for a reason other than the date.

One European obligation did not move, and it is the one nobody funded a programme around. Article 4 of the AI Act has applied since 2 February 2025 and binds every provider and deployer, with no transition period: providers and deployers "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in." The Commission treats it as a standing duty rather than a project, and publishes its own literacy materials against it. Set that beside Wharton's finding that training investment fell 8 percentage points in the year, and a company operating in Europe is currently reducing spending on the one AI obligation it already has.

What would make the blueprint obsolete. Two developments, either of which would require rewriting Part III rather than amending it.

The first is a shift in where the integration work happens. The design in Figure 15 exists because model access, evaluation, monitoring and cost attribution are currently things an enterprise assembles. If they arrive as a purchased, audited layer — the way identity management or endpoint security did — the platform team shrinks to a vendor-management function and the hub stops being an organization. Watch for evaluation and monitoring becoming a compliance-grade product category with third-party attestation, because that is what the equivalent shift looked like in security.

The second is a change in what a use case is. Everything here assumes discrete use cases that can be enumerated, classified, gated, monitored and terminated — the unit of analysis the federal inventory is built on. If the technology becomes ambient inside every application, the enumeration breaks, and with it the entire governance apparatus that depends on being able to list what you have. There are early signs of that already in the federal file, where 56 agency submissions include consolidated commercial off-the-shelf inventories rather than individual use cases, because listing every AI feature in every purchased product is not tractable. When the list stops being possible, the gate stops being possible, and the whole model in this document needs replacing with something that governs behaviour rather than systems.

The disclosure is far better wherever somebody was compelled to disclose. A federal department will tell you which official chairs its AI board, which uses are forbidden, how many of its systems are live and which of them lack an authorization to operate. Most public companies with ten times the resources will tell you they are embedding AI across the enterprise. The exceptions prove it is a choice and not a constraint — GE HealthCare's proxy names its AI council by office, Analog Devices' names the committee that oversees AI risk, Unity's records an AI chief losing executive-officer status in a restructuring. Any of the others could write the same paragraph. The best available account of how to organize enterprise AI comes from the sector nobody holds up as a model of operational excellence, for the simple reason that it is the only one that had to write it down.

The organizations that publish their AI operating model publish it because a regulator made them. Everyone else is describing weather.

AIR Research

Tier 1 — Government, regulator and statistical primary sources

Tier 1 — Issuer filings and company primary disclosure

Tier 1–2 — Peer-reviewed and working-paper research

Tier 2–3 — Survey base, vendor reports and trade reporting (interested parties, flagged in text)

• McKinsey's State of AI survey. The mandate named it as part of the survey base. mckinsey.com refused every retrieval attempt — two timeouts via fetch, a connection failure via direct request, and a third attempt with a browser user agent that terminated at the network layer without returning a status code. Figures widely attributed to it (88% adoption, 6% high performers, 39% enterprise-level EBIT impact, 21% having redesigned any workflow, 28% CEO governance ownership) are therefore not cited here. Where an 88% adoption figure appears in this brief it is taken from Stanford's 2026 AI Index, which was opened directly.
• The CDT one-year retrospective on M-25-21 implementation. cdt.org returned HTTP 403 to both the fetch tool and a direct request with a browser user agent. Its findings on agency compliance-plan completeness are not used. The federal compliance picture in this brief rests instead on agency compliance plans read directly and on the published inventory.
• Mastercard's reporting line. The page at mastercard.com returns HTTP 403, but the company's newsroom host serves the same executive biography and was opened; it is now cited for the role's title, scope and Management Committee standing. It does not state whom the role reports to. That detail remains trade-sourced and is flagged where it appears.
• Claims that a stated share of Fortune 500 companies now have a Chief AI Officer, and that a stated share of those report to the CEO. Several figures circulate (26%, 40%, 76%). None traces to a retrievable primary; the sources found were content-marketing pages, one of which also misstates the current EU AI Act timeline. No such figure appears in this brief. The disclosure-side count in Figure 5 is offered as a floor, not as a population estimate.
• Reported CAIO appointments at Cigna, Target, UnitedHealth, American Express and Lowe's. Encountered in aggregator content without primary corroboration; not verified and not used. Kroger's appointment, which appeared in the same material, was checked and is used with its trade source named.
• Claimed return-on-investment advantages for hub-and-spoke operating models (for example, "36% higher ROI than decentralized structures") and claims that firms using hub-and-spoke are several times more likely to scale AI. These trace to vendor and consultancy marketing pages. No underlying study was retrievable. Section 6 states the absence of causal evidence rather than repeating these figures.
• Walmart's internal reporting line for AI leadership — that Daniel Danker reports to Suresh Kumar — appears in trade reporting and not in Walmart's own post; it is described in the text as press-sourced.
• The widely repeated figure that ~200,000 or ~230,000 JPMorgan employees use LLM Suite. The 2025 Annual Report discloses 65,000+ active users in the Commercial & Investment Bank and does not state a firmwide figure in the sections read. Only the disclosed figure is used.
• Moderna's internal AI usage figures — commonly cited as roughly 3,000 internal GPTs and over 80% employee adoption of an internal assistant — come from interviews and secondary coverage rather than company filings, and are not used as evidence here.
• OpenAI's "State of Enterprise AI" report. The mandate named vendor enterprise-deployment reports as a source category. openai.com returned HTTP 403 to retrieval. Figures attributed to it in secondary coverage — enterprise users saving 40–60 minutes a day, frontier employees sending 6× more messages than median users, 57% of firms deploying agents for multi-stage workflows — are not cited here. The vendor perspective in this brief is carried by Anthropic's two Economic Index reports and Microsoft's Work Trend Index, both of which were opened directly.
• BCG's AI Radar 2026 fieldwork period. The PDF at web-assets.bcg.com could not be parsed. Sample size and composition come from BCG's own press release; the fieldwork dates are not disclosed in it, and this brief therefore states the publication date rather than a fieldwork window.
• The 2026 federal inventory submission deadline. The 2025 cycle's deadline is now sourced directly: OMB's Guidance on 2025 Agency Artificial Intelligence Reporting sets 22 December 2025. Figure 20 infers the 2026 date from that prior cycle. OMB's guidance for the 2026 cycle was not retrieved and the date is not confirmed.
• The count of AI use cases "in production" in GAO's December 2023 review. A figure of roughly 200 circulates and was carried in an earlier draft of this brief. It appears in a chart image rather than in the report's text, and could not be reproduced from the document. It has been removed; the surrounding argument now rests on GAO's own verbatim findings about inventory completeness and requirement implementation.
• The share of EDGAR "Chief AI Officer" hits that are third-party director-biography mentions. Established from eleven large-capitalization documents opened individually, three of which were that kind of hit. All 126 documents in the window were enumerated and de-duplicated by filer, but not individually classified. The claim carried in the text is directional — that the disclosure count over-states issuer self-disclosure — and not a rate.