Artificial intelligence (AI) is rapidly reshaping how organizations operate, with new models appearing almost every day. But despite the constant buzz around AI and its impact, do businesses really know how to adopt AI responsibly?
As we move past the hype phase of AI and enter what Gartner calls the ‘Trough of Disillusionment’, organizations are becoming increasingly aware of both AI’s potential value and the challenges it poses.
At the same time, business leaders are facing rising pressures to adopt sooner rather than later, as boards demand generative AI strategies and customers expect AI-augmented services.
But responsible adoption is not just a technical exercise. Instead, it is a strategic capability that requires strong foundations in governance, data, security, and workforce readiness. Without groundwork, organizations risk letting fear drive decisions, rather than a strategic approach that ensures AI delivers sustainable value.
How AI goes beyond traditional software
One of the most misunderstood aspects of AI readiness is that AI doesn’t behave like traditional deterministic systems. In the channel world, deploying a Power Platform automation or a standard data integration is predictable: inputs are defined, steps are repeatable, and outcomes are consistent. Apply the same configuration twice, and the result is identical.
But generative AI is not deterministic. Chatbots, Copilots, and Agents can be asked the same question multiple times and produce a different answer every time. Traditional testing and deployment approaches for digital transformation rollouts simply don’t work.
You can’t treat AI like any other software project. So, what should you do instead?
When planning AI projects, implementing responsibility and security protocols takes up the majority of a project lead’s time, rather than adopting the AI tool itself. The 40-20-40 rule is a more realistic framework to ensure AI delivers value safely, reliably, and sustainably.
The first 40% – foundations, governance, and education
Some 40% of the time should be spent on establishing responsible data and security foundations. Before writing a single prompt, businesses need guardrails, identity management, compliance checks, secure data architecture, cleanliness, and governance.
Understanding where all data is stored and ensuring it is clean reduces the risk of AI hallucinations and improves the accuracy and reliability of outcomes. Without these measures, AI will be limited, ineffective, and potentially unsafe.
Cloud and data resilience also play a critical role. On-premises environments simply cannot deliver the scale, flexibility, or security required for modern AI systems. The cloud acts as an enabling layer for AI maturity, providing high-performance storage for large datasets and unlocking modern security and compliance capabilities. This is especially important when implementing generative AI, which interacts with sensitive data and therefore needs close governance.
A clear data strategy is equally important, as AI is only as good as the data by which it is underpinned. Structuring data appropriately, securing it correctly, and governing it responsibly will determine just how transformative AI can be. Starting with strong data and security disciplines from day one enables more powerful AI use cases, while also boosting reliability and unlocking safer automation.
AI readiness is not only a technical challenge but a cultural one. Many organisations fall into two risky extremes: employees resist AI due to fear or lack of education, or leaders adopt new tools without understanding governance, risk, or how to enable their workforce.
Neither approach delivers meaningful return on investment. To move from anxiety to empowerment, leaders must prioritize education through training, change management, and transparent communication, helping employees use AI responsibly, understand how it enhances their roles, and recognize the value it brings.
The 20% – implementation
Organizations often fixate on AI implementation. In reality, it’s the smallest slice of the effort. This phase is important, but it’s rarely where projects succeed or fail. As most businesses adopt pre-designed, embedded AI tools, such as Microsoft 365 Copilot, much of the technical heavy lifting has already been completed.
Treating implementation as the main event distracts from the deeper work required to ensure AI delivers value safely and consistently. When organisations spend too long here, it’s often a sign that earlier foundational work hasn’t been completed properly.
The final 40% – optimization, resilience, and trust
The remaining 40% of the time is where AI moves from a prototype into a trustworthy business capability. This phase should focus on refining prompts, improving evaluation methods, stress-testing behaviors, and ensuring responsible AI principles are in place.
According to our research, 37% of IT decision-makers believe that cybersecurity enhancements are a challenge when adopting AI. But strong cybersecurity testing, such as red teaming to simulate iterations on a system, is when AI transforms into a secure pillar for business success.
Red teaming simulates real-world attacks by deliberately prompting AI models and interrogating underlying data to expose vulnerabilities before they can be exploited. By involving people closest to the problem to review and critique model responses, organizations can identify weaknesses, including those revealed through malicious prompting, and strengthen both the AI system and its data.
Companies that skip this final 40% will face challenges on the road to AI adoption and are likely to struggle with accuracy, safety, and reliability.
Be ready to evolve
AI adoption isn’t a one-off project. It’s an ongoing capability that will develop over time.
Organizations that succeed with AI will be those willing to evolve continuously: refining models, updating prompts, adjusting guardrails, and aligning AI initiatives with business outcomes.
Hype cycles will come and go for all innovative technologies. But readiness – across cloud, data, security, and people – is what, ultimately, turns innovation into lasting success.
