(This article originally appeared in CDO Magazine’s Trend Report, Generative + Agentic AI Moving From Experimentation to Enterprise Scale.)

In my experience leading enterprise data and analytics transformations across retail, telecommunications, financial services, and logistics, the shift from proof of concept to production consistently reveals the same thing: innovation is only the starting point. The real challenge lies in embedding these capabilities into the fabric of the organization in a way that delivers sustained, measurable value.

Chief Data Officers (CDOs) will recognize that a familiar pattern is emerging across organizations: promising pilots build enthusiasm, yet progress slows as teams move toward production. In practice, the constraint is rarely the model itself. More often, success depends on the interplay of integration complexity, trust frameworks, and organizational readiness. 

This article examines what is working in early deployments, what begins to fracture at scale, and how leaders can strengthen the foundations needed for the next phase of enterprise AI.

Why Most Pilots Never Reach Production

I have watched dozens of teams celebrate a successful pilot and then, six months later, struggle to explain why it never scaled. The pattern is consistent enough that I no longer think of it as bad luck. Instead, I see it as a structural gap between piloting and scaling.

McKinsey’s 2025 Global Survey on the State of AI supports what I have observed on the ground: 88 percent of organizations now report regular AI use in at least one business function, yet nearly two-thirds have not begun scaling AI across the enterprise. Usage is nearly universal. Value capture is not. And that gap is exactly where most of my conversations with fellow data leaders now center.

What strikes me most is that this is not a technology maturity problem. In many cases, a mid-size retailer today has access to the same AI models as the world’s largest banks. The differentiator I keep coming back to is workflow redesign. McKinsey’s findings back this up: high performers – the small group of organizations attributing meaningful EBIT impact to AI – are nearly three times more likely than their peers to have fundamentally redesigned individual workflows around AI rather than inserting a model into an unchanged process. The distinction between rebuild and bolt-on is the single clearest signal I use when a team asks me to evaluate whether their GenAI initiative is likely to scale.

Figure 1: AI use in at least one business function, 2017–2025, versus generative AI use, 2023–2025. Source: McKinsey: “The state of AI in 2025: Agents, innovation, and transformation”

What’s Working: Narrow Scope, Strong Foundations

The deployments I have seen produce durable value share two traits I look for early in any project review. 

Start With a Well-Defined Workflow

They target a specific, well-bounded workflow rather than attempting a department-wide transformation on day one. I have pushed back on more than one internal proposal that tried to reinvent an entire function at once instead of proving value on a narrow slice first. McKinsey’s research reinforces this approach, finding AI use concentrated in information capture and processing, marketing content support, and contact-center automation. These use cases all have clear inputs, clear outputs, and an existing baseline for measuring improvement. 

Build on Strong Data Foundations

The organizations I have seen gain real traction already had disciplined data and MLOps practices before generative AI ever arrived. This is the pattern I emphasize most with teams I advise. In my experience reviewing stalled deployments, the root cause traced back to a data quality or ownership gap that predated the AI initiative entirely. The model gets blamed. The data foundation is usually the real culprit. 

What’s Breaking: Governance Gaps Under Load

If there is one failure pattern I now flag immediately, it is teams scaling a GenAI pilot without a structured risk process behind it. I have seen well-built pilots move to production purely on enthusiasm, with no clear owner for what happens when the model produces an inaccurate or biased output at scale. 

NIST’s AI Risk Management Framework and its 2024 Generative AI Profile give this challenge a clear name and a practical structure that I use in governance reviews. The framework is built around four functions: Govern, Map, Measure, and Manage, with Govern serving as a cross-cutting function that informs the other three. 

I have seen this same pattern play out across automation projects: accelerating a process before its underlying rules and ownership are settled does not fix the process; it just breaks it faster and at a larger scale. The GenAI version of this mistake is procuring a model or platform before defining decision rights, escalation paths, and validation thresholds. McKinsey reached a similar conclusion, finding that high performers are more likely to have defined processes for determining when model outputs require human validation.

Integration: Building on a Governed Platform, Not Around One

One point that has consistently come up in architecture reviews over the years is this: a GenAI system is only as good as the enterprise data it can securely reach, and that access has to be governed from the start, not retrofitted after a pilot proves out. 

NIST’s framework treats third-party and supply-chain risk as a Govern-level category for good reason: most enterprise GenAI deployments depend on external foundation models, APIs, and training data that organizations do not fully control. In practice, that means treating data lineage, access control, and model provenance as core platform capabilities before the first production use case goes live, rather than treating them as a cleanup exercise once a proof of concept has already generated momentum. 

The teams I have seen avoid costly rework are the ones that treated integration and governance as a single design decision rather than sequential phases. Once stakeholders begin relying on a customer-facing model, retrofitting security and lineage controls becomes harder and riskier than building those controls into the platform from day one.

Trust and Governance: A Certifiable, Auditable Structure

Where NIST’s framework gives organizations a risk management process, ISO/IEC 42001 provides something equally important: a certifiable management system that organizations can be formally audited against. Published as the world’s first AI management system standard, ISO/IEC 42001 organizes AI governance around a Plan-Do-Check-Act cycle. It covers AI policy, risk criteria, control implementation, performance monitoring, and continual improvement.

This pairing matters to me because trust, in my experience, is never just a marketing claim. Trust has to be a documented, auditable structure that customers, regulators, and internal risk committees can evaluate against a known standard, rather than taking a data team’s word for it. Enterprises often discover this gap the hard way: a large customer’s procurement team asks for evidence of AI governance controls, and the honest answer is a set of Slack threads rather than a documented, auditable management system.

Organizational Readiness: The Non-Technical Bottleneck

None of the infrastructure or governance work I have described matters if the organization is not ready to operate it. This is the piece I spend the most time on with executive teams. McKinsey’s survey found that high performers are nearly three times more likely than their peers to report strong senior leadership ownership of AI initiatives and are also more likely to actively role-model AI use. In nearly every organization I have worked with, employees need to see leadership actually using the tools, not just approving the budget for them, before they trust the outputs enough to change how they work. 

NIST’s framework builds the human dimension directly into its structure, and I think that is underappreciated. The Manage function calls for organizations to define appeal and override mechanisms, not just technical monitoring. The people closest to the output are often the first and best to signal that something has gone wrong. In practice, I have seen teams treat organizational readiness as a training slide rather than an operational requirement. The result is often shadow AI usage that no governance framework can actually see or control, however well-designed it is on paper. 

Where This Goes Next: Scaling GenAI with AI Agents

The next phase of this work is agentic AI. A recent Economist Impact report found that 99 percent of respondents expect generative AI adoption across internal and external use cases by 2027. That same report is candid that many of those organizations will struggle to scale their projects beyond the pilot stage. That statistic tracks closely with what I described above about the adoption-versus-scaling gap, and it tells me the next bottleneck will look very familiar. 

A model without access to governed, context-aware enterprise data, and without a structured evaluation loop, will produce results that are inaccurate or irrelevant often enough to erode trust before it ever reaches meaningful scale. As organizations move toward AI agents, these same requirements become even more important. Agents need appropriate context, governed access to enterprise tools and data, and continuous evaluation as their responsibilities expand.  

What I find most important as organizations move toward agentic AI is that the governance principles described throughout this article become part of how these systems operate rather than an afterthought. That means supporting continuous evaluation against task-specific metrics, enforcing access through existing data and catalog permissions, and capturing human feedback in a way that feeds back into the system instead of disappearing into review threads. That is not a new governance philosophy bolted onto agents; it is the same Govern, Map, Measure, and Manage discipline described earlier, applied to systems that now act rather than just respond.

The organizations that succeed in this next wave will be the ones that build governance and data readiness into their agentic AI initiatives from the start rather than retrofitting them later. The lessons from this generation of GenAI deployments are the foundation on which agentic AI will either succeed or repeat the same mistakes at a faster clock speed.