Ninety days into leading an AI program, the technical aspects surfaced less challenge than the governance and human side. The models were the easy part. The hard part was people, data, timing, and the order you do things in. Here are ten things I learned, most of them by doing one or two in the wrong order first.
1. Do not overestimate AI use, or AI capability
Two illusions to drop early. The first is that your team is already using AI productively. They are using it, mostly on personal accounts you cannot see. An MIT study of enterprise AI in 2025 found that more than 90 percent of companies had employees using personal AI accounts for work, while only about 40 percent had bought official tools. That is shadow AI, not a program.
The second illusion is that the tools are more capable than they are. When Scale AI and the Center for AI Safety tested leading AI agents on real, paid freelance projects in late 2025 (the Remote Labor Index), the best agent finished about 2.5 percent of them end to end. The same MIT report found roughly 95 percent of enterprise AI pilots produced no measurable impact on profit. The capability is real and improving fast. It is also nowhere near set it and forget it. Plan for a tool that needs supervision, not a colleague who does not.
2. Be prepared for pushback, and treat it as information
The objections will be moral, ethical, and about privacy and data sharing, and most of them are reasonable. Where does our data go. Will this be used to train a model. Is it right to use this on a client’s work. If you treat those as obstacles to get past, you lose people. If you treat them as the requirements list for your governance, you get a better program, and the skeptics become your most careful users. The questions are not in your way. They are the work.
3. Plan for your highest-risk data, and for consent, before anyone gets a license
Do not hand an AI license to the people who handle your most sensitive data first just because they are the busiest. Privileged files, patient records, financials: those handlers come last, after you have done a risk assessment, written a data classification reference for what can go in which tool and what never can, and put guardrails in place. Most AI accidents are really data-handling accidents. Decide where the sensitive data is allowed to go before someone decides for you, at a deadline, with a paste. This is most of what the five governance documents exist to settle.
Consent is the other half of the same problem. People keep things in their work environment you do not know about: proprietary data, a side project, a client’s material under a separate agreement, personal notes. Before you point an AI tool at someone’s mailbox, drive, or workspace, give them a chance to separate what should not be in scope. Rolling out AI without that step feels efficient to you and reads as a violation to them. Plan the data, then get consent, then connect.
4. Prepare for the power users before they arrive
A few people will sprint. They will want agents, automations, and multi-step workflows in the first week, and if the environment is not configured for that, they will build it themselves in a corner you cannot see. Give them a properly configured, governed place to do the ambitious work: approved tools, sensible permissions, a human in the loop on anything consequential, and a record of what ran. Power users are either your best advertisement for the program or your first incident. The difference is whether you set the table before they sit down. If a standard automation already does the job, it is also fine to let it cook rather than rebuild it as an agent on day two.
5. Send your use cases to legal before rollout, not after
This is the one that cost me the most time. If you onboard the tools and then wait for legal to bless the use cases, you get the worst of both: licenses are paid for, users are logged in and eager, and nobody is allowed to actually do anything. Confusion, idle seats, and money on the table. Get a broad set of the concrete use cases in front of legal early, the specific tasks rather than “AI in general,” and run that approval in parallel with procurement so the green light lands when the access does.
6. Communicate early, and often
Announcing AI and then expecting adoption before you have done the training, the governance, and the communication is how you manufacture resistance. People fill an information vacuum with their worst fear, and the worst fear about AI is that it is being done to them. Tell people what is coming, why, what it will and will not change about their job, and when. Said another way: governance beats prohibition, and communication beats surprise. A rollout that feels rushed to your team gets treated like hype no matter how careful the plan behind it actually was.
7. Build baselines before AI shows up
If you think AI is coming, start measuring now: how a task is done today, and how long it takes. Once a tool is in the workflow, that baseline is the only honest way to show what changed. “It feels faster” does not survive a budget review. A sentence like “this task took the team six hours a week and now takes ninety minutes” does, and it ties the saving to a specific tool so you can prove the return rather than assert it. The baseline you did not capture is the ROI you cannot claim later.
8. Slow down
The last six months were a drumbeat of the next big thing: OpenClaw, Hermes, Copilot Scout, Fable 5, just to name a few. There will be another one next month, and the month after that. That pace is exactly the reason to slow down, not speed up. Plan before you purchase. Adopt responsibly. The models keep getting better while you take the time to do it right, which means patience costs you very little and saves you from rebuilding on a foundation that moved under you. In a field this loud, the discipline to wait is itself an advantage.
9. But do adopt
Slowing down is not the same as standing still, and this is the other half of the lesson. AI is consistently proving its worth, and it is touching nearly every industry. The leaders saying “adopt or get left behind” are not wrong, they are just easy to misread as “rush.” Do not rush. Do start. Begin planning, begin testing, begin building the governance that lets you move faster later with confidence. The goal is deliberate adoption, not no adoption and not reckless adoption.
10. Empower your people. Do not replace them, and do not bury them
Two of the biggest fears I heard were “AI will take my job” and “my boss will just expect me to do ten times the work.” Both are adoption killers, and you have to answer them out loud, early and often. The honest answer is that the point of AI here is to take the menial, repeatable, automatable work off people’s plates so they can spend their attention on the judgment and critical thinking that only a person can provide. Empowered by AI, not replaced by it and not weighed down by it. Say that on day one, then build a program that proves it.
That last one is really the whole job. AI governance is a job, not a project, and its real product is people who trust the tools enough to use them well. None of this is the hard part on a slide. It is the hard part in the room: the order you do things in, the conversations you have before the licenses, the measurement you set up before you need it. If you are standing up an AI program in a business where the work is sensitive and the trust is earned, that is exactly the work I would rather help you get right the first time. Book a free consultation.