AIArtificial intelligence

Behind on artificial intelligence: what management decides in the first quarter

An organisation that is behind on artificial intelligence does not catch up by buying licences. It catches up through a few leadership decisions, taken in order over ninety days. Here is what they are, who takes them and what gets written down.

Strategic editorial team 8 October 2026 8 min read

Cover: “Behind on AI: the decisions of the first quarter”, Artificial intelligence

A larger organisation that is behind on artificial intelligence does not catch up by buying licences for everyone, nor by waiting for the perfect project. It catches up if management takes, in the right order, the few decisions that nobody else can take on its behalf: who leads the work and with what mandate, what is already in use without rules, which use cases to test, with which data and suppliers, and with which criteria for judging them. In ninety days these decisions fit into a handful of documents and lead to a reasoned choice to extend, correct or stop. Handled this way, the delay even turns into an advantage, because you start from more mature tools and from the mistakes others have already made.

Is being behind really a problem?

According to Istat, Italy’s national statistics institute, 53.1% of Italian companies with at least 250 employees used at least one artificial intelligence technology in 2025, compared with 32.5% the year before and 15.7% of companies with 10 to 249 employees. Among the companies that had considered AI without adopting it, the obstacles cited most often were a lack of skills (58.6%), regulatory uncertainty (47.3%) and the poor availability or quality of data (45.2%). None of these obstacles is overcome by buying a tool. They are all management issues.

Often, though, the real delay lies elsewhere. Artificial intelligence is already inside the company. It is just that nobody decided to bring it in. In Microsoft’s 2024 Work Trend Index, a survey of 31,000 people in 31 countries, 75% of knowledge workers said they used generative AI at work, and 78% of those users relied on their own tools rather than tools provided by the company. In the same survey, 60% of leaders worried that the top of their own organisation lacked a plan and a vision.

The risk is not arriving late. It is arriving late without having decided anything, while company documents and data pass through personal accounts, outside any contract or control.

Why does the first move belong to management and not to IT?

Because the decisive choices are not technical. Which data may leave the company is a matter for legal counsel and the data protection officer. How people’s work changes is a matter for HR and, where they exist, the trade union representatives. In Italy, Law 132/2025, the national law on artificial intelligence in force since 10 October 2025, requires employers to inform workers about the use of AI in the cases set out in Legislative Decree 152/1997, which governs the information employers must give their staff. Budget, priorities between functions and acceptable risks are for the leadership. IT governs the tools, not these choices. The supplier, for its part, has an interest in the answer, as explained in the piece on who sells artificial intelligence and who advises on it.

The AI Risk Management Framework of NIST, the US standards body, puts risk governance at the centre, as a cross-cutting function that steers mapping, measurement and management. In practice you need three things, written on a single page:

An owner on the management committee, for example the general manager or the finance and administration director, with the time to devote to it.
A small working group made up of IT and security, legal and data protection, HR, and one or two heads of function.
A mandate that sets the objective for the quarter, a spending cap and the date of the final decision.

Month one: who leads, and what is already there?

The first month is about seeing the real situation before imagining the future one. The review covers three fronts:

Tools that people already use, including through personal accounts, gathered with a short anonymous questionnaire that is not looking for culprits.
AI features already switched on in the software the company has bought, from the CRM to the office suite, often arriving with an update and never assessed.
The contracts and data involved, meaning what current contracts say about the use of data, and which information has already passed through these tools.

Alongside the review come interim rules. They set out which company tools can be used straight away, for which activities and with which data excluded. Banning everything looks prudent, but it pushes use onto personal accounts, where the company sees nothing. At the end of the month, management approves the map of uses and the interim rules.

Month two: which use cases to test, and with which data?

The second month turns the proposals from the various functions into a portfolio of two or three trials, and no more. For a larger organisation, these criteria matter most:

An owner: the head of function who proposes the use case is accountable for it and signs its brief.
Clear permissions: the sources already have an owner and access rules that the assistant can inherit, as explained for AI assistants connected to company systems.
Room for human oversight: a person sees the result before it has any effect.
No decisions about people: systems used to select or assess staff are high-risk under the EU AI Act, and they are not the place to learn.

In the same month the technical scope is agreed with IT, covering the environment, access, logs and where the data is processed. Suppliers are chosen using the clauses of the contract with an AI vendor. And the rules for judging the trials are set, with the task given to whoever measures the results rather than to whoever proposed them.

Month three: how do you test, and how do you decide?

The trial involves a small group, one site or one office, working with real data and limited permissions. Participants receive training tied to their role: what the tool can do, where it gets things wrong, what must never be entered into it and whom to report a problem to. The EU AI Act also requires organisations that use these systems to look after their staff’s skills (Article 4, as amended in 2026).

On day ninety, the board or the management committee receives a single page. It sets out what was tested, the figures collected, the problems that emerged, the proposed decision for each use case and the plan for the following six months, including the skills to build in-house. If the quarter starts in the autumn, this page arrives in time for the following year’s budget.

Month	Decisions	Who decides	Document left behind
One	Owner, group and mandate, plus interim rules	Chief executive or general manager	Mandate, map of uses, interim rules
Two	Use cases to test, data, suppliers, evaluation criteria	Management committee, on a proposal from the group	Use case briefs, technical scope, measurement protocol
Three	Outcome of the trials and six-month plan	Board or management committee	One-page report, six-month plan

Which mistakes waste the quarter?

Mistake	What happens	How to avoid it
Licences for everyone before the use cases	Use stays individual, processes do not change and the fee remains	Licences only for those taking part in the trials
Delegating everything to IT or the supplier	Decisions on data and people are taken by inertia	A mandate from the top, and a group that includes legal and HR
Banning every tool	Use moves to personal accounts, out of control	Interim rules and authorised company tools
Showcase project	You choose what makes headlines, not what is needed	Use cases proposed and signed off by a head of function
Trial with no end date	The experiment never turns into a decision	A date and thresholds written down in month two
Measuring at the end	The figures are read in the project’s favour	Measurement protocol approved before the trial

A typical scenario. Take a group with four operating companies, whose board asks where it stands on artificial intelligence. The review finds three assistants used through personal accounts across sales and marketing, an AI feature that has been switched on in the CRM for months and no contract that mentions any of it. The general manager gives the mandate to the finance and administration director, working with IT, legal and HR. In month two, two trials are chosen. One covers looking up quality procedures at one plant. The other covers first drafts of responses to tender specifications for the bids office. On day ninety the board receives a single page. The first trial is extended to a second plant. The second is corrected, because its sources were disorganised.

In brief

The delay is made up through leadership decisions taken in order, not by buying licences.
Month one takes stock of existing uses and sets interim rules, without blanket bans.
Month two chooses two or three trials, each with an owner, clear permissions and written evaluation criteria.
Month three tests on a limited scope and brings the leadership a decision for each use case.
Data, people and suppliers remain management decisions, even when the technical work belongs to IT.

Frequently asked questions

Are ninety days enough for a large organisation?

They are enough to decide, not to transform. The quarter produces a mandate, rules, measured trials and a reasoned plan. Extending to other sites and functions takes longer, and it follows the results.

Do you need to appoint a head of artificial intelligence?

You need a person with a clear mandate and the time to exercise it. It can be an executive who is already in place. What counts is the mandate and access to the leadership, not the title.

What if the data is not in order?

That is the most common situation. You choose trials whose sources are already well kept, and you put the clean-up of the others into the plan, with owners and update cycles, as described in the guide on how to prepare documents for an AI assistant.

Is it worth waiting for the EU rules to settle?

The timetable is now fixed. Regulation (EU) 2026/1744 moved the obligations for the high-risk systems listed in Annex III of the AI Act to 2 December 2027, while the transparency obligations of Article 50 apply from 2 August 2026. Waiting does not stop the use already under way. It only leaves it without rules.

Supporting management in these decisions, from the mandate to the report for the board, is the work of our artificial intelligence for organisations practice. The first conversation carries no commitment. Where needed, an assessment leaves the company with a technical document and a summary for management. For those taking part in the trials, there is training by function and role.

Sources

Consulted on 16 September 2026.

Find out moreArtificial intelligence for businessesArtificial intelligence built into the systems your company already uses. We choose the right processes, connect the data, and settle security and rules first.