What has to change around AI before AI can genuinely scale?

Start With the Outcome the Operating Model Needs to Enable

Before designing structures, committees or roles, clarify what the organisation wants the model to achieve.

For example:

• Faster adoption of valuable AI opportunities

• Consistent governance

• Better reuse of technology and data

• Stronger risk management

• Clearer accountability

• Reduced duplication

• Better investment decisions

• Faster movement from pilot to production

• More reliable enterprise-scale operation

The operating model should support those outcomes.

It should not become an organisational design exercise detached from the reason AI matters.

Define Business Ownership

AI should not become something that technology teams do to the business.

Each meaningful AI use case needs clear business ownership.

That owner should understand:

• The problem being solved

• The expected outcome

• The affected process or capability

• The risks

• The required organisational change

• How value will be measured

Technology may enable the solution.

But accountability for the business outcome should remain with the business.

Without that ownership, AI can become a portfolio of interesting technical activity with weak connection to organisational value.

Decide What Should Be Centralised

One of the most important design choices is which AI capabilities should sit centrally.

Potential central capabilities may include:

• AI strategy

• Architecture standards

• Common platforms

• Model-provider standards

• Governance frameworks

• Risk controls

• Cybersecurity standards

• Shared tooling

• Reusable components

• Specialist expertise

• Supplier frameworks

• Enterprise monitoring

Centralisation can improve:

• Consistency

• Reuse

• Control

• Efficiency

• Enterprise learning

But too much centralisation can create bottlenecks.

The goal is not central control for its own sake.

It is to centralise where enterprise consistency creates value.

Most Organisations Will Need a Hybrid Model

For many enterprises, the practical answer will be a hybrid model.

For example:

Central capability

• Strategy

• Architecture

• Standards

• Common platforms

• Risk frameworks

• Security

• Reusable technology

• Specialist expertise

Federated capability

• Business ownership

• Opportunity identification

• Domain expertise

• Adoption

• Benefits realisation

• Selected delivery activity

This can create a balance between:

Control and speed

Consistency and flexibility

Enterprise reuse and local relevance

The exact balance should reflect the organisation's structure, maturity and risk profile.

1. Identify

The first question should be:

What problem are we trying to solve?

Opportunities may emerge from:

• Business teams

• Strategy

• Transformation

• Customer insight

• Operational teams

• Technology

• Data teams

• AI specialists

The operating model should make it easy for useful ideas to enter the process without creating an uncontrolled backlog of speculative use cases.

3. Prioritise

Not every valuable idea can be funded at once.

AI opportunities should be compared using factors such as:

• Strategic relevance

• Business value

• Feasibility

• Risk

• Data readiness

• Technical readiness

• Cost

• Dependency

• Reusability

• Time to value

The purpose is not simply to score use cases.

It is to understand which opportunities should move first and what foundational investment they depend on.

5. Govern

The organisation should determine the appropriate level of control.

Governance may consider:

• Data sensitivity

• Business consequence

• Model autonomy

• Customer impact

• Regulatory exposure

• Security

• Bias

• Explainability

• Human oversight

• Supplier risk

Not every use case should require the same level of governance.

A proportionate model is usually more practical.

7. Monitor

AI does not stop being a governance concern once it goes live.

Operational monitoring may need to consider:

• Performance

• Accuracy

• Model behaviour

• Security

• Data changes

• Usage

• Cost

• Business value

• User adoption

• Risk indicators

Monitoring responsibilities should therefore be designed into the operating model from the start.

Define AI Governance

A practical governance model should make clear:

• What requires approval

• Who approves it

• What evidence is required

• How risk is classified

• Which decisions can be delegated

• What needs escalation

• How exceptions are handled

• How deployed AI is reviewed

Governance should support responsible progress.

It should not exist simply to create more committees.

Define the Architecture Model

An AI Target Operating Model should connect directly to architecture.

Relevant decisions may include:

• Approved model providers

• Model hosting

• Cloud

• Data access

• APIs

• Integration

• Identity

• Access control

• Security

• Logging

• Monitoring

• Development environments

• Deployment environments

• Reusable AI services

Without architectural consistency, every use case can create a new technical pattern.

That increases:

• Complexity

• Cost

• Supplier dependence

• Security exposure

• Support overhead

The operating model should therefore clarify where teams have architectural freedom and where enterprise standards apply.

Integrate Cybersecurity From the Beginning

Cybersecurity should not become a final approval step before deployment.

It should be part of the lifecycle.

Relevant considerations can include:

• Identity

• Access

• Sensitive information

• Data leakage

• Supplier security

• API security

• Model access

• Monitoring

• Logging

• Incident response

• Prompt handling

• External connectivity

Early involvement reduces the likelihood that a technically successful AI solution becomes impossible to deploy.

Consider Digital Sovereignty

AI architecture may create important strategic dependencies.

For example:

AI Service → Model Provider → Cloud Provider → Jurisdiction

or:

Business Capability → AI Platform → Proprietary API → Supplier Dependency

Those relationships may affect:

• Strategic control

• Resilience

• Data handling

• Portability

• Future choice

• Jurisdictional exposure

The operating model should define where sovereignty considerations need to enter AI decision-making.

Define the Role of Partners

External partners can accelerate AI adoption.

But the organisation should avoid becoming dependent on partners for knowledge it needs to operate AI sustainably.

The operating model should therefore clarify:

• What partners will provide

• What knowledge must remain internal

• How capability transfer will work

• Who retains accountability

• How supplier dependency will be managed

Partners should strengthen enterprise capability rather than substitute indefinitely for it.

Define How Value Will Be Measured

AI activity should be measured against the outcome it is intended to create.

Depending on the use case, measures could include:

• Revenue

• Cost reduction

• Productivity

• Cycle time

• Service quality

• Customer experience

• Risk reduction

• Decision speed

• Error reduction

• Employee experience

Technical measures also matter.

But a model performing well technically does not necessarily mean the organisation is creating value.

The operating model should clarify who owns benefits and how they will be measured.

Define Human Oversight

The operating model should clarify where human involvement is required.

That may include:

• Approval

• Review

• Escalation

• Exception handling

• Quality assurance

• High-consequence decisions

The level of human oversight should reflect the consequence of the AI use.

The objective is not to insert manual approval everywhere.

It is to ensure accountable judgement remains where it matters.

Connect the Operating Model to Technical Readiness

An organisation can design an excellent operating model that its existing technology environment cannot support.

For example:

A governance process may require strong data lineage.

But the organisation may not have it.

A deployment model may assume reusable APIs.

But integration capability may be weak.

A monitoring model may require enterprise observability.

But the required tooling may not exist.

The operating model should therefore be designed alongside an assessment of technical readiness.

Xirocco's AI Technical Readiness Score, or AiTRS, focuses on areas including:

• Data

• Cybersecurity

• Infrastructure

• IT capability

The purpose is to identify where the intended operating model depends on capabilities the organisation does not yet have.

Use Existing Governance Where It Works

Not every AI responsibility requires a new committee.

Existing mechanisms may already govern:

• Technology architecture

• Cybersecurity

• Data

• Investment

• Risk

• Procurement

• Change

The better question is:

Which existing governance mechanisms can absorb AI, and where are genuinely new capabilities required?

This can make the operating model simpler and more sustainable.

Design for Learning

AI capability will evolve quickly.

The operating model should therefore support learning across the enterprise.

That means preserving knowledge such as:

• Which use cases worked

• Which did not

• What data was required

• Which technical constraints appeared

• Which suppliers performed well

• Which governance decisions created friction

• Which architecture patterns should be reused

• What benefits were achieved

Without institutional learning, each new AI initiative begins too close to zero.

Keep the Operating Model Adaptable

AI will continue to change.

The operating model therefore should not be designed as a fixed structure that assumes today's:

• Technology

• Suppliers

• Models

• Regulations

• Skills

• Risks

will remain unchanged.

It should establish durable principles while allowing specific processes and controls to evolve.

Leadership should be able to revisit:

• Governance

• Architecture standards

• Supplier choices

• Skills

• Investment

• Roles

• Risk thresholds

as the environment changes.

The Key Test

A useful AI operating model should make it possible to answer:

If a business leader identifies a valuable AI opportunity tomorrow, what happens next?

Who assesses it?

Who owns it?

Who governs it?

Who designs it?

Who funds it?

Who builds it?

Who approves deployment?

Who operates it?

Who measures value?

Who remains accountable?

If the answers are unclear, the organisation does not yet have a complete operating model.