What is an AI strategy?

    An AI strategy decides where AI will create value, where it will not be used, and how return and risk are measured. Components, build steps, framework anchors and regulatory context.

    An AI strategy is an organization's documented decision about where AI will create value, where it will not be used, what data, platforms and skills it needs to get there, and how return and risk will be measured and governed. It is a set of choices about problems, not a shopping list of tools.

    Why AI strategies fail: the evidence

    Most documents called an AI strategy are one of three things: a vision statement ("become an AI-first organization"), a technology roadmap (which platform, which model), or an inventory of pilots. None of them is a strategy, because none of them makes a choice that could turn out to be wrong.

    The evidence on outcomes is consistent. These are point-in-time surveys, and figures change with each edition. McKinsey's State of AI survey (November 2025) found that 88% of organizations use AI in at least one business function. Only about a third had begun to scale it across the enterprise, 39% attributed any EBIT impact to it, and roughly 6% (the "high performers") attributed 5% or more of EBIT to AI. MIT's NANDA initiative reported in 2025 that 95% of organizations it studied had seen no measurable return from generative AI pilots. That figure is widely quoted and rests on a small base (52 interviews, 153 survey responses and a review of 300+ public initiatives), so treat it as directional. The direction matches everything else: adoption is broad and value is narrow.

    On agents, Gartner predicted in June 2025 that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing cost, unclear value and inadequate risk controls. The pattern behind all three figures is the same: starting from the tool rather than from the business problem.

    AI strategy vs AI governance vs AI policy

    The three terms are often used interchangeably but refer to different things.

    AI strategy AI governance AI policy
    Question it answers What will we use AI for, and why? How are those uses controlled, owned and evidenced? What are the rules for people using AI?
    Owner Executive sponsor, approved by the board Accountable executive, with risk, legal, privacy and audit Policy owner, often CISO, CIO or legal
    Output Use-case portfolio, value thesis, red lines, roadmap, budget Inventory, roles, risk and impact assessments, controls, reporting Acceptable use policy, standards, procedures
    Fails when It rules nothing out It controls activity nobody chose It is the only artifact

    See what is AI governance? for the control side.

    What an AI strategy should contain

    • Business objectives. Two to five outcomes the organization needs, such as lower cost per claim, faster underwriting or fewer customer contacts, stated without mentioning AI. If an objective only makes sense with "AI" in it, it is a technology goal, not a business one.
    • A prioritized use-case portfolio. Candidate uses scored on value, feasibility (data, integration, skills) and risk, with a small number funded. The portfolio should include decisions not to pursue attractive uses, with the reason recorded.
    • A value thesis with measures. For each funded use, the baseline, the target metric and the date it will be measured. Productivity claims without a baseline cannot be verified.
    • Risk appetite and red lines. Which uses are prohibited outright (some already are under EU AI Act Article 5), which need board approval, and which uses about people (hiring, credit, pricing, access to services) need an impact assessment before anything is built. This is where strategy and accountability meet.
    • Data foundations. What data the priority uses need, whether it is fit for purpose, who owns it, and whether consent and privacy obligations allow the intended use. In practice, most AI programs depend more on data readiness than on model choice.
    • Build, buy or partner. Which capabilities to buy as SaaS features, which to build on foundation models through an API, and which to train or fine-tune. Each choice carries a different dependency: a model that cannot be inspected, a provider that can change or withdraw it, and contract terms that decide who carries the risk.
    • People and AI literacy. Who needs which skills, and how staff will be trained. As of October 2026, the EU AI Act's Article 4 literacy duty, softened by the 2026 Digital Omnibus to "take measures to support" literacy, still applies to providers and deployers.
    • Operating model. A central centre of excellence, a hub-and-spoke model, or federated teams with central standards. The choice matters less than making it explicitly.
    • Governance and accountability. Named owners per system, an inventory, stage gates, and the reporting the board will receive.
    • Funding and stage gates. Money released in stages (discovery, pilot, production, scale) against evidence, so stopping a use case is a normal outcome rather than a failure.

    How to build an AI strategy in eight steps

    1. Find out what already exists. Inventory the AI already in use, including AI features switched on in existing SaaS tools and unsanctioned use of public chatbots. Most organizations find more AI than they expected and less of it owned.
    2. Start from problems. Run sessions with business-line leaders on their costliest, slowest or most error-prone processes. Translate those into candidate uses only afterwards.
    3. Score and choose. Score candidates on value, feasibility and risk, and fund a small number. A small funded portfolio is easier to measure and govern than a large backlog of pilots.
    4. Set risk appetite and red lines. Get the board to approve what the organization will not do and what needs its approval. This step is frequently omitted.
    5. Decide the operating model and the sourcing approach. Decide who builds, who buys, who approves, and which third-party models the organization is willing to depend on.
    6. Define measures and stage gates. Take a baseline before each deployment and set the evidence required to move from pilot to production.
    7. Write a 12 to 18 month roadmap. Set direction for three years, but commit money and people over a shorter horizon. Model capability, pricing and regulation move faster than a five-year plan.
    8. Set the review cadence. Review the portfolio at least every six months and report to the board quarterly. Revision is how the strategy is tested against results.

    Where the frameworks put strategy

    None of the major frameworks uses the phrase "AI strategy", but each assumes one exists.

    • ISO/IEC 42001. Clause 5.2 requires top management to establish an AI policy appropriate to the organization's purpose. Clause 6.2 requires AI objectives, with plans for who will achieve them, by when and how results are evaluated. An auditor certifying against ISO/IEC 42001 will ask to see both, which makes them the formal home of strategy decisions.
    • NIST AI RMF. The Map function asks organizations to document their mission and goals for AI (MAP 1.3) and the business value or context of each use (MAP 1.4) before measuring risk. Without those, the NIST AI RMF has nothing to weigh risk against.
    • US federal government. OMB Memorandum M-25-21 (April 2025) required CFO Act agencies to publish an AI strategy within 180 days, appoint a chief AI officer and set up an AI governance board. Its structure, with strategy, accountable officer and governance body side by side, can serve as a template for private-sector organizations.
    • Financial services in Canada. OSFI's Guideline E-23, effective 1 May 2027, expects an enterprise-wide, risk-based model risk framework that explicitly covers AI and machine learning models, including third-party ones. For federally regulated institutions, the AI strategy has to fit inside it. See AI risk in financial services.

    Regulatory context (status as of October 2026)

    Regulatory positions changed materially in 2025 and 2026. A strategy approved before then is likely to need review on regulation alone.

    • European Union. The Digital Omnibus on AI, Regulation (EU) 2026/1744 (in force 27 July 2026), moved Annex III high-risk obligations to 2 December 2027 and Annex I product-embedded systems to 2 August 2028. Prohibitions, general-purpose AI rules and Article 50 transparency duties already apply. Use cases touching hiring, credit, education or essential services in the EU should carry their compliance cost in the business case before the 2027 deadline.
    • Canada. AI for All, the national AI strategy launched on 4 June 2026, is built on trust, opportunity and sovereignty. It aims to raise business AI adoption from just over 12% to 60% by 2034, and promises privacy, online safety and AI transparency measures plus content watermarking. As of October 2026, two related bills tabled in June 2026 are not yet law: Bill C-36, the Protecting Privacy and Consumer Data Act, which would replace PIPEDA after a long transition, and Bill C-34, the Safe Social Media Act, which includes duties for AI chatbots. A Canadian strategy should plan for both without assuming their final shape.
    • United States. Federal policy favours adoption (America's AI Action Plan, July 2025) and is pushing back on state laws (Executive Order 14365, December 2025, with a DOJ AI Litigation Task Force formalized on 9 January 2026). State law still binds. In Colorado, enforcement of the 2024 AI Act was barred by a federal court order in xAI v. Weiser (27 April 2026) before the state replaced it with a narrower automated decision-making law, SB 26-189, which applies from 1 January 2027. As of October 2026, California's frontier-model law (SB 53) and AI Transparency Act are in force.

    For strategy purposes, the relevance of regulation is cost: it determines which uses are cheap and which are expensive, so it belongs in the scoring in step 3.

    Common mistakes

    • Tool-first strategy. Buying an enterprise licence and calling it a strategy. A licence is a cost line.
    • No red lines. An organization that has recorded no refusals has not made a strategic decision yet.
    • Pilot purgatory. Funding pilots without the evidence that would move them to production, or a defined process for stopping them.
    • Ignoring dependency. Building core processes on a third-party model with no exit plan, no contractual notice of model changes and no testing when the provider updates it.
    • Strategy and governance written by different teams that do not coordinate. The result is a portfolio governance cannot see and controls the business routes around.
    • No baseline. Without a measurement taken before deployment, productivity claims cannot be verified.

    For the control side of the same decisions, see what is AI governance? and AI accountability. For what the board should see, see AI oversight at board level. For the first policy most organizations need, see the AI acceptable use policy. The AI governance scorecard gives a quick baseline before a strategy is drafted.

    Sources and references

    Frequently asked questions

    What is an AI strategy?

    An AI strategy is an organization's documented decision about where AI will create value, where it will not be used, what data, platforms and skills it needs, and how return and risk will be measured and governed. It is a set of choices about problems, not a list of tools.

    What should an AI strategy include?

    At minimum: the business objectives AI serves, a prioritized portfolio of use cases, a value thesis with measures, a risk appetite and explicit red lines, data and platform decisions including build, buy or partner, skills and AI literacy, an operating model, governance and accountability, funding tied to stage gates, and a review cadence.

    What is the difference between an AI strategy and AI governance?

    The strategy decides what the organization will do with AI and why. Governance decides how those decisions are controlled, who is accountable, and how compliance and risk are evidenced. A strategy without governance scales risk. Governance without a strategy controls activity nobody chose.

    Who should own the AI strategy?

    A single accountable executive, often a chief AI officer, chief data officer or the COO, with the board approving it and the risk appetite. Ownership split across IT, data science and the business lines usually produces a list of pilots rather than a strategy.

    How long should an AI strategy cover?

    Set direction and red lines for three years, but commit funding and use cases on a 12 to 18 month roadmap reviewed at least every six months. Model capability, pricing and regulation all move faster than a traditional five-year plan.

    Do small businesses need an AI strategy?

    Yes, but a short one. A two-page document naming the two or three problems AI should solve, the tools approved, what data may never go into them, and who decides exceptions covers most of the risk and most of the value for a small organization.

    How do you measure the success of an AI strategy?

    Against the business outcomes each use case was approved for, such as cycle time, cost per case, error rate or revenue, measured against a baseline taken before deployment. Add a small set of risk measures: inventory coverage, assessment coverage, incidents and the share of use cases stopped at a stage gate.

    Share on LinkedIn