Executive briefing

AI adoption: position and next decisions

Where the organisation sits across four stages of adoption, and the three decisions that follow from that position.

Prepared for discussion with the chief executive 12 August 2026 approx 20 min

The question this turns on

Ask ten people what they used AI for last week. How many different answers, and how many were already known?

The distance between those two numbers is the subject of this discussion.

Where the organisation sits

Four stages of adoption

StageWhat it means in practiceThe test
1. AssistiveLicences issued. Staff draft with AI; people still perform the work.Can anyone state the hours released, and where they went?
2. EmbeddedAI completes a defined step inside a live process. People handle the exceptions.Has the throughput of a named process changed?
3. AgenticSystems take action across other systems within set limits.Does anything write to a system of record without a person approving it?
4. RedesignedThe process is rebuilt around the capability rather than the capability added to the existing process.Has any process been retired, rather than accelerated?

The common position

Most organisations are at stage one and describe themselves as being at stage three

Stage 1

Licences issued, staff drafting, people still performing the work.

Field observation across engagements. Not a measured study.

What stage one looks like from the inside

  • Licences bought and adoption unmeasured
  • Time savings described and never traced
  • No named process whose volume has changed

Stage one produces the impression of progress without the evidence of it. Reported time savings frequently convert into prompting and small decisions rather than removed work.

Part II

What the next stage is worth

Stage two in practice

Three candidates for a regulated financial institution

One

Periodic due diligence refresh

File assembly, adverse media screening and summarisation, with the analyst confirming the conclusion. The periodic review backlog is the largest single queue in most Malaysian banks.

Two

Alert triage in financial crime

First-level context gathering and a recommended disposition, confirmed by an analyst. The queue shortens while the decision stays where it is.

Three

Contact centre quality review

Full coverage in place of sampling, with complaint categorisation feeding regulatory reporting.

Each replaces analyst preparation time while the judgement stays with the analyst. Quantification requires the institution's own volumes (to confirm).

The pattern

Four causes account for most stalled programmes

01

The data is not ready

Unstructured, unclassified and inconsistent source material.

02

Permissions are unresolved

Retrieval inherits existing access. Over-shared locations become searchable.

03

No owner

It sits between technology and the business, and neither holds it.

04

No definition of success

Nothing was set that the pilot had to demonstrate before it began.

The one to test first

Retrieval tools inherit existing access rights

The mechanism

  • The tool indexes whatever the account can already open
  • Over-shared locations become searchable in plain language
  • Results reach people who should not hold the material

Why it lands here

  • The exposure pre-existed the tool. The tool made it discoverable.
  • Speed is the change. Manual search would not have found it.
  • Governance framing. Data use must be permissioned and transparent (Principle 4.2).

Verifiable in the institution's own environment within days, and the recommended starting diagnostic.

Next 90 days

Three decisions that sit with the chief executive

01

Name the owner and the budget line

A single accountable executive for adoption, reporting to a named forum, with a budget that is not split between technology and the business.

02

Concentrate on one process to stage two

In place of a portfolio of stage one pilots. Specify what the process must demonstrate, and by when, before work begins.

03

Set the rule on human involvement

Define which decisions must always involve a person. A risk appetite question rather than a technical one.

Each requires saying no to something, which is why none of them delegates.

Leave with this

Show me the inventory. Show me the measurement. Show me what it can do without a person.

Three questions for the management team. The answers locate the starting point.

Detail, and the questions in full

Governance framing draws on AI Governance Principles for Boards, KPMG International and INSEAD Corporate Governance Centre, publication 140336-G, April 2026. Illustrative working material. It does not constitute legal or regulatory advice.

→ / PageDown next · ← / PageUp back · F fullscreen · B blank · T identity · L layout