Three moves to start closing the AI execution gap

Most organizations are already using AI. The question now is where the decision-making lies and on what terms.

These three moves set out practical work a leadership team can start to close the execution gap. They’re for organizations already using AI without governance that has kept pace: not those still deciding whether to start, or those that already have this discipline built.

Move one: Agree risk appetite at the level AI is used

The first move, and the one that makes the other two possible, is to agree risk appetite and tolerance for AI by division and by workflow, rather than once for the whole organisation. In essence, this is an organizational change exercise that requires a governance owner. It means identifying the use cases that matter and prioritizing them honestly against value, feasibility and the risk tolerance just agreed. That prioritized list can then help an organization move towards adopting AI safely and confidently, rather than simply deploying it.

Score live use cases, prioritizing the ones that keep people up at night. Do it in the same room as the people who will have to live with the answer. The guardrails that follow will be those that people can maintain, because they were built for a decision that was properly understood.

Few organizations have the internal bandwidth or the outside perspective to do this well on their own. That’s why it’s worth treating this as a discrete piece of work assigned to an owner, not a side project bolted onto someone's existing role.

Move two: Name an accountable owner before scaling

The second move is to name an accountable owner for that use case before scaling anything further. That owner is accountable for both the outcomes (adoption and the value delivered) and the risks, working within the agreed risk tolerance. They have the mandate to drive adoption, track outcomes and act when risks exceed that tolerance, not simply oversee deployment. It also means writing down specifically what happens to funding and escalation if that owner leaves.

This is arguably the highest-leverage move of the three because, in our delivery experience, it’s what most reliably drives return on investment. An unowned system carries more risk and stops improving, whereas human control can deliver team efficiencies, such as in our work with Bpifrance.

Move three: Map your regulatory timetable

The third move is to map your organization's regulatory timetable against the EU AI Act's revised deadlines, even if you sit outside direct EU scope, and to understand how the use of AI supports and continues your compliance with any other regulations. The sector regulators most organisations actually answer to are not waiting for Brussels, or for Westminster, to move first.

The discipline stays the same

None of these moves will look the same from one organization to the next.

A hospital trust, a mid-sized energy supplier and a regional bank are starting from different places, with their own risk appetites and existing governance. The right shape of the answer therefore must be built with the people who understand that context, not handed down from a generic template.

What stays constant is the discipline underneath it: agreeing who decides and on what terms, checking the data, and treating the regulatory timetable as a design input rather than a deadline to survive.