The board meeting is going well. Then the newest board member — the one who reads everything — asks the question: “What’s our AI governance posture?”

The executive director smiles and slides a two-page document across the table. An AI policy. Downloaded as a template eight months ago, lightly edited, approved by unanimous consent. Everyone nods. Meeting adjourned.

Here’s the problem: that document answers none of the questions that actually matter. Who owns each AI tool in the organization? What data flows into them? How were they tested? Who’s monitoring them? What happens when one fails? A policy that can’t answer those five questions isn’t governance. It’s a permission slip you wrote to yourself.

I’ve spent my federal career — six agencies, CIO, CAIO, CTO, and Chief Digital Officer roles — watching organizations confuse having a document with having a discipline. AI has made that confusion dangerous.

The gap between adoption and governance has never been wider

The numbers tell the story plainly. Gartner research finds 68% of employees are using unauthorized AI tools at work — up from 41% in 2023. PagerDuty’s 2026 survey puts it at two-thirds of office professionals. Your people didn’t wait for your governance framework. They opened a browser tab.

The mission-driven sector is in the same boat, only smaller. The 2026 Nonprofit AI Adoption Report found that 92% of nonprofits now use AI in some capacity — but 47% have no AI policy at all, and only 7% report major strategic impact. Read those numbers together and the conclusion is unavoidable: the barrier isn’t access to AI. It’s the absence of a system around it.

Meanwhile, the regulatory clock is running. The EU AI Act’s high-risk obligations were set to bite on August 2, 2026 — conformity assessments, transparency duties, the works — with fines reaching 7% of global turnover. Brussels has been negotiating a Digital Omnibus that would push the high-risk deadline to late 2027, and U.S. companies have been watching that uncertainty closely. But if you’re treating a deadline extension as a reason to relax, you’ve misread the moment. The direction of travel is fixed. The only variable is how prepared you’ll be when enforcement arrives — from a regulator, a funder, an auditor, or your own board.

Governance is a decision architecture, not a committee

I’ve written before that real AI governance isn’t a working group that meets monthly to admire the problem. It’s a decision architecture: you inventory the use cases, assess the risks, assign the owners, train the people, monitor the outcomes. Then you iterate.

When an auditor — or a funder, or a journalist — comes calling, they don’t ask to see your policy. They ask you to prove five things:

1. Who owns each AI system. Not “the IT department.” A name.

2. What data it touches. Including the customer records your staff pasted into a free chatbot last Tuesday.

3. How it was tested. For accuracy, for bias, for the failure modes specific to your mission.

4. How it’s monitored. Post-deployment, continuously, with thresholds that trigger action.

5. What happens when it fails. An incident process that exists before the incident.

Most organizations can’t prove one of the five. The frameworks that structure this — NIST AI RMF, ISO/IEC 42001, the EU AI Act’s risk tiers — are not mysterious. They are, like FISMA and the NIST RMF before them, the architecture of responsible modernization. The problem has never been the frameworks. The problem is that translating them into working governance has required one of two things: a $200K enterprise platform built for a dedicated AI risk team, or a six-figure consulting engagement.

Subscribe now

If you’re a nonprofit director, an association executive, or the ops leader at a 200-person company who got handed AI governance on top of your actual job — the “accidental AI owner,” as I’ve come to think of this role — neither of those was built for you. You’ve been left with free templates at the bottom and enterprise platforms at the top, and nothing in the middle where you actually live.

That gap is why I built GOVERNBOX.ai — and it’s live today

After three decades of building governance inside federal agencies, I’ve put that experience into a product. GOVERNBOX.ai, from my firm Gradient Descent LLC, is self-service AI governance for the underserved middle: nonprofits, associations, public-sector organizations, and small and mid-sized businesses. It’s released, it’s ready, and you can use it right now.

Here’s the premise. A non-technical leader should be able to sit down and, in under an hour, produce a defensible AI governance package — an AI use policy, an acceptable-use standard, a risk register, and a compliance crosswalk to NIST AI RMF, ISO/IEC 42001, and the EU AI Act. Not a template with your logo pasted on it. A package generated from a curated control library built on the controls auditors actually check — the ones most organizations miss — with every clause traceable back to its source control. No invented requirements. No jargon your board can’t read. And because the frameworks keep moving, your documents move with them.

It answers the five questions. Who owns it, what data it uses, how it was tested, how it’s monitored, what happens when it fails. On paper, with evidence, before anyone asks.

GOVERNBOX.ai is live, and I’m inviting all of you to use it. Start with the free AI Readiness Scorecard — ten minutes, no sales call, and you’ll know exactly where you stand against the five questions. If the results sting a little, generate your first governance package the same afternoon. Head to GOVERNBOX.ai to get started, or schedule some time with me if you’d rather talk it through first. And when you’ve run your organization through it, reply to this post and tell me what you found — reader feedback is shaping where the product goes next.

The bottom line

Your organization is already using AI. The only question is whether you’re governing it — or whether you’re carrying a two-page permission slip and hoping nobody asks the five questions.

It can be done. It doesn’t take a committee, a consultant, or a compliance team. It takes a decision — and now, a tool built for the people who have to make it.

Share

Jim Tunnessen is a veteran federal CIO/CAIO and Founder & Principal of Gradient Descent LLC. ExecutiveTech is a reader-supported publication — to receive new posts and support this work, consider becoming a free or paid subscriber.

Sources & further reading:

• Shadow AI Statistics: Key Data Points Every CISO Needs in 2026 (Airia, citing Gartner)

• PagerDuty: Two-Thirds of Office Professionals Have Used Unauthorized AI Tools at Work

• Nonprofit AI Adoption Hits 92% — But Only 7% See Major Impact (NonProfit PRO / Virtuous 2026 report)

• EU AI Act Deadlines 2026–2027: Compliance Calendar + Fines (Legiscope)

• EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines (Gibson Dunn)

• U.S. Companies Face EU AI Act’s Possible August 2026 Compliance Deadline (Holland & Knight)

The shiny new object is out of the box. The Agency Head is happy, there is a new tool to play with, and it is going to revolutionize the business. You can already feel the P&L statement shifting. Overhead costs are going to decline — especially the largest cost vector of all: labor. You receive the orders to stand up AI agents to do the jobs of human staff within the agency. And you can already see what’s coming — a governance nightmare. Autonomous agent upon autonomous agent running through the network, through the infrastructure, accessing areas without any control over who has access to what. People were easier. They were assigned access controls and you could physically see when they did something. What do you do about bots that live in your network?

Before organizations can innovate responsibly with AI, they must get the governance right. This is not a compliance checkbox. It is the structural foundation on which trustworthy AI is built.

Defining Identity Governance for a Modern AI Era

Traditionally, identity governance meant the policies, processes, and technologies that manage who has access to what, under what conditions, and with what authority. Now the definition must expand. We have AI agents, AI tools, and automated workflows that act with digital identities — accessing data, triggering decisions, and producing outputs alongside the human workforce. The four pillars of modern identity governance are:

1. Identity lifecycle management (from onboarding to offboarding)

2. Access entitlement management (role-based, least-privilege)

3. Access certification and periodic review

4. Audit trails and accountability reporting

The Identity Problem AI Introduces

AI tools aren’t just assisting users anymore. Now they act as users — accessing systems and data on behalf of people and organizations, running tasks, executing processes, completing transactions. They are performing the normal day-to-day operations that human staff handle. This expands the identity surface to include: human users, service accounts, AI agents, APIs, non-person entities (NPEs), and automated workflows. All of which require governance.

Governance for what? What could possibly happen? It’s an AI. I control it. It doesn’t have a mind of its own.

The risks of ungoverned AI identity:

• Data Exposure: AI tools accessing sensitive or restricted information they should not see

• Access Creep: AI inheriting excessive permissions over time

• Accountability Gaps: No clear audit trail for AI-assisted decisions

• Compliance Failures: Inability to demonstrate appropriate controls to regulators or auditors

Consider what happens when an AI tool operating in an HR or Finance context has no defined entitlement boundary. It can access compensation data, personnel records, or financial transactions well beyond the scope of its intended function — with no log of who authorized it, no record of what it touched, and no ability to reconstruct the decision trail when something goes wrong.

Why Identity Governance Unlocks — Rather Than Limits — AI Innovation

There is a common misconception that governance slows down innovation. That perception usually comes from governance frameworks that were built to gatekeep rather than enable — compliance checklists masquerading as strategy. The reality is that ungoverned AI creates risks that force organizations to either over-restrict their tools or expose themselves to significant liability. Both of those outcomes slow innovation.

When you put mature identity governance in place, organizations can:

• Confidently expand AI access to higher-value, higher-sensitivity use cases

• Grant AI agents elevated permissions with appropriate controls and monitoring

• Move faster through procurement and authorization processes (e.g., FedRAMP, ATO)

• Build stakeholder and leadership trust that accelerates enterprise-wide adoption

Proper identity governance is the permission structure for your agency’s AI ambition.

Subscribe now

Building Identity Governance for the AI Age: The Practical Steps

Step 1 — Inventory your identity surface. Include AI tools, APIs, and automated workflows alongside human accounts.

Step 2 — Apply least-privilege principles to AI agents. Define explicit entitlement boundaries, not open-ended access.

Step 3 — Integrate AI tools into your existing Identity Provider (IdP). Do not allow shadow identity systems to emerge.

Step 4 — Establish AI-specific access certification cycles. Review what AI tools can access on a regular, documented schedule.

Step 5 — Require audit-ready logging from AI vendors. Ensure logs are sufficient for incident response and compliance reporting. Monitor for privilege drift — AI agents accumulating permissions over time beyond their original scope.

Step 6 — Align identity governance to your AI risk tiers. The higher the risk, the stricter the identity controls. Not all AI use cases carry the same exposure.

What CIOs and Technology Leaders Should Ask Their AI Vendors

It is not uncommon to find that every vendor now has AI baked into their solution. AI-in-the-box! But how do they ensure their AI is governed and secure? Here are the questions to ask before you sign:

• Does your platform integrate with our enterprise IdP (e.g., Microsoft Entra ID, Okta)?

• How are AI agent identities defined, scoped, and audited within your system?

• What logging and audit trail capabilities are available, and do they meet federal/industry compliance standards?

• How do you enforce separation of duties when AI tools participate in multi-step workflows?

• What is your approach to privileged access management for AI-elevated operations?

Identity Governance as a Strategic Asset

The organizations that will lead in AI are not necessarily those with the most capable tools. They are those with the governance infrastructure to deploy those tools confidently, at scale, and with accountability. For government agencies and mission-driven organizations especially, the ability to demonstrate who accessed what, when, why, and with what result is not just a compliance requirement — it is a public trust obligation.

Share

The common narrative in boardrooms, at conferences, and in the trade press for as long as I have worked in this space is that government is slow. And I understand where it comes from — there is enough historical evidence to sustain it from other agencies. Not at the agencies I have been in.

One of the developers on our team at the National Endowment for the Arts dismantled that argument completely. And he did it in seven days with federal agency AI-assisted development tools.

What Happened

Andrii, a developer working with our team set out to redesign and rebuild a mission-critical, public-facing system from the ground up. This is not a back-office utility. It is the system that grant applicants across the country — artists, arts organizations, and cultural institutions — rely on to manage their submissions for federal arts funding. It is, by any definition, a high-stakes, high-visibility application.

He rebuilt it in a week.

Not a wireframe. Not a proof of concept. Not a minimum viable product destined for another six months of iteration. A production-ready, AI-embedded replacement, built using AI-assisted development tools and open-source technologies, that is ready to serve the public.

Why This Matters Beyond the NEA

If this had happened at a technology company or a well-funded startup, it might warrant a mention in a team Slack channel. One talented developer moving fast is expected in those environments.

But this happened inside a federal agency — with all of the compliance requirements, security controls, and operational constraints that entails. And that changes the significance of the story entirely.

What Andrii demonstrated is not just personal capability, though that is real and worth celebrating. What he demonstrated is that the environment we have been building at the NEA — one that equips people with AI-assisted development tools, embraces open-source technologies, and creates the cultural permission to move — can produce outcomes that rival any private sector team.

This is the lesson I want every CIO, CAIO, and technology leader in the public sector to take from this story: speed is not a sector characteristic. It is an environmental one.

Subscribe now

We Under-Equipped Our People

For years, the conventional wisdom held that government technology moved slowly because of bureaucracy, risk aversion, and talent gaps. And while those factors are real, they are not the root cause. The root cause is that we systematically under-equipped our people.

We gave developers legacy toolchains and told them to modernize. We asked for innovation while maintaining procurement processes that could not keep pace with technology cycles. We expected agility from teams that had never been given agile training let alone agile tools.

AI-assisted development changes this equation fundamentally. When a skilled developer has access to AI-powered coding tools, the gap between what one person can accomplish and what a large team could previously deliver collapses dramatically. Andrii did not beat the clock through heroic effort alone. In the Marine Corps we called it being force-multiplied. Andrii was force-multiplied.

This is the conversation the public sector needs to be having right now. Not just “how do we adopt AI responsibly” — though that governance work is essential — but “how do we use AI to unleash the talent we already have?”

What Leaders Need to Do

For technology leaders in government and the public sector, I would offer three takeaways from what we experienced at the NEA.

First, equip before you mandate. The instinct in many agencies is to govern AI adoption before enabling it — to write the policy before buying the tool. Governance matters enormously, and I have spent significant time building our AI governance framework at the NEA. But governance without enablement produces compliance theater, not results. Give your developers the tools, then govern their use rigorously.

Second, create cultural permission to move. Andrii moved fast not just because he had the tools, but because he had the trust. There was no committee approval required to start. No six-week requirements gathering process. He was trusted with a problem, equipped to solve it, and empowered to deliver. That cultural condition is as important as any technology investment.

Third, celebrate the evidence when it appears. One of the most powerful things a technology leader can do is name and amplify examples of what is possible within their organization. Not because it makes for good content — though it does — but because it reshapes what people believe is achievable. Every developer at the NEA who hears Andrii’s story recalibrates their own sense of what they can accomplish.

The Argument Is Settled

I am not suggesting that every government modernization challenge can be solved in a week by one developer. Complex legacy systems, enterprise integration requirements, and mission-critical data environments demand careful, sustained effort. I am not trading one oversimplification for another.

What I am saying is this: the blanket assumption that the government cannot compete with the private sector on technology speed and innovation is wrong. It was always more of a self-fulfilling prophecy than an immutable truth — and AI is making it easier than ever to prove that.

Andrii proved it. And at the National Endowment for the Arts, we are enhancing our environment, upskilling our people, trusting in the plan, and just getting started.

Share

I’ve been sitting on this one for a while. Not because I wasn’t sure about the argument — I’ve been sure about this argument for twenty years. But because saying it plainly, in public, feels like a risk. That’s exactly why I’m saying it. If you’ve worked in federal technology and you recognize what I’m describing, share it. If you disagree, I want to hear that too. Either way — let’s stop pretending the problem is the procurement rules.

For thirty years, we’ve accepted a comfortable lie in federal IT: that legacy systems, compliance frameworks, and procurement rules make real modernization impossible. That AI governance is too complex to act on. That change takes a decade, requires a task force, needs more study.

It doesn’t.

I’ve run technology at six federal agencies — across defense, immigration, public health, international broadcasting, and the arts. Every time I walked into a new organization, I found the same thing: the tools existed, the legal authorities existed, the talented people existed. What was missing wasn’t resources or runway. What was missing was a leader willing to make a decision and stand behind it.

At USDA, we had food safety inspectors training on VHS tapes. We fixed it — not with a multi-year program of record, but with a decision. At DHS, I built the first federal hackathon and stood up a DevOps organization inside an agency that had declared DevOps impossible. At Voice of America, we built AI-powered transcription, a streaming platform, and 20 mobile apps inside a bureaucracy most people had written off. Not because the rules changed. Because we decided to lead instead of waiting for permission.

Subscribe now

Here’s what I’ve learned: the policy is rarely the problem. Policies can be changed — you are the policymaker. Procurement rules can be navigated — people do it every day. Compliance frameworks like FISMA and the NIST RMF are not obstacles to modernization; they are the architecture of responsible modernization, if you actually understand them. The problem is that too many federal technology leaders have learned to use compliance as a shield.

“We can’t do that — it’s too risky.” “We need more authority.” “We’ll revisit that next fiscal year.”

These are not prudent statements. They are abdications.

AI has made this worse. Every agency now has an AI policy, an AI council, an AI working group. Most of them are elaborate exercises in delay dressed up as governance. Real AI governance isn’t a committee — it’s a decision architecture. You define the use cases, assess the risks, acquire the tools, train the people, measure the outcomes. Then you iterate. That’s it. The agencies actually doing this aren’t the ones with the biggest budgets or the cleanest systems. They’re the ones with leaders who decided that responsible action beats indefinite analysis.

The transformation of government technology is not a technical problem. It never was. It is a leadership problem. And leadership problems have a solution: leaders who are willing to be wrong, willing to be accountable, and unwilling to let bureaucratic inertia become a permanent excuse.

It can be done. It has been done. The only question is whether you’re willing to do it.

Share

I. The Pivot from “Chat” to “Do”

I have a confession: I am a conference survivor.

I’ve lived through the great Cloud migration, the Agile awakening, and the DevOps world tours. For fifteen years, I’ve had the privilege of standing on stages discussing these “new” frontiers. And while there were moments where it felt like the record was skipping, where we were debating the same points for the third decade in a row, I look back with an incredible amount of gratitude. Those cycles weren’t just noise; they were the hard, necessary work of leveling up the federal government’s digital backbone. We had to learn how to move fast (Agile) and where to live (Cloud) before we could ever hope to do what comes next.

And what comes next is finally here.

Now, we have a “new” old topic: AI. It’s easy to joke that every product now has an “AI inside” sticker (I’m still waiting for an AI-enabled office chair), but the truth is, this isn’t a flash in the pan. We’ve been in the trenches with this since at least 2017. For the last few years, we’ve been captivated by GenAI. I’m actually on three panels this week alone and I couldn’t be more energized. We are finally moving past the theory and into the “how.”

Over the past few years, federal agencies have enjoyed the “Summer of LLM Pilots.” It was a season of exploration: try two different LLMs, see what sticks, and find a use case. We successfully proved that AI can summarize a memo and draft a decent email (which, let’s be honest, has saved us all from a lot of Friday afternoon writer’s block).

But the honeymoon phase is winding down. We are moving from a world where AI simply talks to us, to a world where AI works for us. We haven’t yet fully prepared our data to let an agent autonomously execute a procurement action or adjudicate a benefit. Moving to Agentic AI, systems that actually execute tasks rather than just talking about them, isn’t a “model” problem; it’s a metadata and mandate problem.

If your data isn’t machine-actionable, your agents are just high-priced chatbots. Welcome to 2026: The Year of the Agent. This isn’t just another pilot season; it’s the season of implementation. And I, for one, am glad I’ve got the mileage from the last 15 years to help navigate it.

II. Redefining “Data Readiness” for the Agentic Era

In the pilot phase, “clean” data was the gold standard. For agents, we require Contextual Readiness. When I was releasing the first chatbot solution for my agency, I had the cyber team use their tools to “lock down” the environment—restricting files, folders, and drives to prevent data leakage between offices. It was a success; nothing spilled.

But then we hit the “Dark Data” PDF Trap. The chatbot wasn’t leaking information, but it was pulling “ghosts” from the past-decades of conflicting policy hidden in unstructured formats. When you haven’t properly labeled, archived, or contextualized your data, your agent can’t distinguish between a 1994 memo and a 2024 regulation. This creates reasoning conflicts that paralyze an agent.

This is the reality check for every CIO, CAIO, and CDO: You cannot scale what you cannot map. If an agent doesn’t know the “intent” or the “freshness” of a data point, it cannot be trusted to take an action.

III. Architecture: The False Choice Between Centralized and Federated

We are often told we have to choose: Centralization (which creates massive bureaucratic bottlenecks) or pure Federation (which creates “data wild-westers” and security nightmares).

You don’t have to choose. My recommendation is “Federated Data, Centralized Governance.” This is where the Data Mesh approach comes in. In a Data Mesh, we stop trying to shove everything into one giant “data lake” that inevitably becomes a “data swamp.” Instead, we treat data as a product. The domain experts, the people in HR, Finance, or Program Offices, remain the owners of their data. They know it best.

Governance, however, becomes the Centralized Control Plane. We centralize identity, policy-as-code, and security guardrails. We don’t move the data to the AI; we move the AI’s “view” to the data using the Model Context Protocol (MCP) and virtualization. This allows agents to query live, authoritative data at the source without creating redundant (and risky) copies.

Subscribe now

IV. The Trust Stack: Lineage, Provenance, and Accountability

In government, an agent’s recommendation isn’t just an output; it’s a potential legal liability. If an agent takes an action, we must be able to audit it with the same rigor we use for human federal employees.

I call this the Traceability Trio:

1. Provenance: Where did the data start? Is this a certified, authoritative record or a draft from a SharePoint folder?

2. Lineage: How did the agent transform or interpret that data? What steps were taken between the query and the conclusion?

3. Immutable Audit: We need a non-erasable “black box” for agentic decision-making.

The governance mantra for the next decade is simple: “If it isn’t logged, it didn’t happen. If it isn’t traceable, it isn’t trustable.”

V. Collaboration: Solving the “Semantic Dissonance”

The biggest hurdle to cross-agency AI isn’t the tech; it’s Semantic Dissonance. This is the multi-domain challenge: Why cross-agency AI fails when Agency A’s definition of a “target” is a person, but Agency B’s definition is a geographic location. If two agents from different domains try to collaborate without a shared understanding, the results are catastrophic.

The fix isn’t sharing every database, it’s building shared ontologies. Agencies don’t need to share everything; they just need to agree on what the “things” are called and how they relate to one another. We need to build a common language for agents to speak before we ask them to work together.

VI. Conclusion: Measuring What Matters (Beyond ROI)

Metrics matter. They are the only way we decide what is worthy of our limited budget.

When I first started measuring ROI for our “chatbot army,” I focused on time and efficiency—how many minutes were saved per task. It was helpful, and the significant time savings increased adoption. But as we move to agents, we need to shift our gaze.

We need to move from “Cost Savings” to Mission Velocity and Intervention Rates.

• Mission Velocity: How much faster are we delivering services to the citizen?

• Intervention Rate: How often does a human have to step in and correct the agent?

As the intervention rate drops, your scale increases. Agentic AI is the most significant shift in federal IT since the cloud. It requires us to stop being “data librarians” and start being architects of autonomy.

Share

A few months ago, a fictional federal agency, let’s call it the Department of Public Assistance (DPA), rolled out an AI system designed to streamline eligibility determinations for a national benefits program.

The system promised efficiency, accuracy, and millions in taxpayer savings. Within weeks, thousands of applications were processed that would’ve taken human analysts months.

And then the complaints started rolling in.

Applicants who’d been denied benefits wanted to know why. Freedom of Information Act (FOIA) requests poured in demanding to see the criteria, the data, and the logic behind those denials. But when the agency turned to its shiny new AI model for answers, it had none.

The only explanation DPA could offer was: “The model determined the applicant did not meet eligibility thresholds.”

That’s when the lawsuits began.

The Black Box Problem

This hypothetical story isn’t far-fetched. Agencies across government are under enormous pressure to modernize, automate, and innovate. AI promises all three.

But when an AI system can’t explain how it arrived at a decision, it becomes a black box. You can’t see inside, you can’t trace the reasoning, and you can’t defend the outcome.

In the private sector, that’s a customer service nightmare.
In the federal space, it’s a compliance time bomb.

Federal decisions must be transparent, traceable, and defensible, especially under FOIA. If an algorithm can’t show its work, then it’s not a decision-support system. It’s a legal liability.

Explainability Across the Spectrum

Explainability looks different depending on the type of AI model.

• Decision trees and random forests are relatively straightforward, you can trace the logic, for example: “If income < $40K and dependents > 2, then eligible.” Simple, auditable, explainable. Shows the criteria, shows the qualifications, explanation is ready.

• K-means clustering is trickier. It groups data by similarity but understanding why a record belongs to one cluster versus another isn’t always obvious, especially to someone outside the data science bubble.

• Recurrent neural networks (RNNs) and today’s generative AI models (transformers like GPT) are another beast entirely. They operate on billions of parameters, learning patterns far beyond human intuition. Try explaining one of those decisions in a FOIA response. Good luck.

The complexity of the model doesn’t absolve us from the responsibility to understand it.

That’s why Explainable AI (XAI) is not just a research niche. It’s a necessity.

Tools That Bring Light to the Black Box

Fortunately, the field has evolved. Techniques like SHAP and LIME can identify which inputs most influenced a model’s prediction. Counterfactual reasoning can explore “what-if” scenarios to explain outcomes. And attention visualization can show which parts of the data an AI focused on most when generating its answer.

These tools don’t make complex models simple, but they do make them defensible. They turn AI outputs from mysteries into evidence. And evidence is what agencies need when the public, the press, or Congress comes knocking.

Subscribe now

Trust Is Earned Through Transparency

At its core, explainability is about trust.
In government, trust is currency and once you lose it, good luck getting it back.

When citizens believe AI is making opaque, unchallengeable decisions about their lives, skepticism turns into outrage. Outrage turns into oversight. Oversight turns into moratoriums.

Explainability doesn’t just protect agencies legally; it protects their mission.

The Path Forward

The lesson from our fictional DPA is simple: if you can’t explain it, don’t deploy it.

AI systems used in the public sector must be built on principles of transparency, accountability, and traceability. That means:

• Designing models that are interpretable by default.

• Integrating explainability tools into production pipelines, not as afterthoughts.

• Documenting data sources, training methods, and decision logic as part of the AI governance process.

Because when the inevitable FOIA request or congressional inquiry comes, “we don’t know how it works” isn’t just a bad answer, it’s the beginning of a crisis.

Explainable AI isn’t about slowing down innovation. It’s about making innovation sustainable.

If we want AI to serve the public, we need to make sure the public can understand, and trust, how it serves them.

Why This Matters to Me

As a CIO and Chief AI Officer, I see this challenge every day. We’re building systems that are more capable, more autonomous, and more integrated into decision-making than ever before. But capability without clarity is dangerous.

Our responsibility isn’t just to make AI work, it’s to make it understandable. Because in the end, technology doesn’t earn trust. People do. And that trust begins with transparency.

Share

AI isn’t magic. It’s not a silver bullet that will instantly transform your business. The companies that succeed with AI and machine learning aren’t the ones that rush to deploy the latest shiny model, they’re the ones that start with a disciplined approach to framing the problem. As you know from my previous writings – they’re the ones that generally start small.

Too often, AI projects fail not because the technology doesn’t work, but because the problem was never defined in a way that connects business goals with technical design. If you want your AI initiative to drive measurable value, here are twelve questions that I have expanded upon from Aurélien Géron worth asking before you write a single line of code.

1. Define the objective in business terms

Don’t start with “we need an AI model.” Start with: what business problem are we trying to solve? Maybe it’s reducing customer churn, speeding up claims processing, or improving fraud detection. The key is to translate technical curiosity into a concrete business outcome like revenue growth, cost savings, or risk reduction.

2. How will your solution be used?

A model that produces insights no one acts on is useless. Will the output guide decision-making, trigger automation, or enhance customer experience? Knowing how it will be embedded into workflows ensures adoption.

3. What are the current solutions or workarounds?

If teams are already manually reviewing transactions, or using rule-based systems, that’s your baseline. Understanding the status quo helps you quantify improvement and manage expectations.

4. How should you frame this problem?

Is it supervised (predicting churn), unsupervised (detecting anomalies), reinforcement (optimizing recommendations), or something else? Is real-time performance needed, or can it be batch/offline? Framing the problem correctly sets boundaries around what’s technically feasible.

5. How should performance be measured?

Accuracy, precision, recall, F1 scores are useful, but don’t stop there. A fraud model that reduces false positives by 5% may sound small, but if it saves thousands of wasted investigations, that’s massive business value.

6. Is the performance measure aligned with the business objective?

Your technical metric must be tied back to business KPIs. For example, “model accuracy” is fine, but if your goal is reducing churn by 10%, make sure the performance metric reflects that impact.

Subscribe now

7. What’s the minimum performance needed?

Perfect accuracy isn’t realistic. Sometimes a model that’s only 70% effective is still a win if it beats the existing approach. Define what “good enough” looks like to justify deployment.

8. What are comparable problems?

Chances are that your problem isn’t entirely unique. Look for industry case studies, open-source solutions, or vendor tools you can adapt. Reinventing the wheel is often the slowest (and costliest) path.

9. Is human expertise available?

AI isn’t about replacing people; it’s about augmenting them. Domain experts are critical for feature engineering, data validation, and interpreting results. If you don’t have them, your project is at risk before it starts.

10. How would you solve the problem manually?

If you can’t describe a manual solution, you may not understand the problem well enough. Manual steps often reveal decision criteria that can guide model design.

11. List the assumptions you’ve made so far

Assumptions creep in everywhere: “We assume the data is clean.” “We assume customers behave consistently.” Write them down.

12. Verify assumptions if possible

Before investing heavily, test your assumptions. If your customer data is messy or incomplete, no model will save you. Catch these issues early to save time and budget.

Closing Thought

AI success isn’t about bigger models or more GPUs. It’s about disciplined problem framing. By walking through these twelve questions, you create a bridge between business need and the technical solution. That’s how you avoid hype-driven dead ends and deliver real, measurable outcomes.

The Launch of Gradient Descent LLC

With all that said, I am happy to announce that I have launched an AI and technology consulting firm – Gradient Descent LLC. You can find it at gradientdescent.biz. Gradient descent is a common mathematical method that is used to optimize AI algorithms. That is the intent of the firm – to optimize daily operations of an organization through the application of artificial intelligence and technical solutions. The firm is available for advisory services, fractional CTO work, and speaking engagements such as corporate seminars and training sessions. If you are interested in engaging Gradient Descent or know of someone that might be, please feel free to forward this information.

Cheers!

Share

When we talk about AI in the workplace, it’s easy to jump straight to the big stuff—automation, data science, and “digital transformation.” While many organizations are chasing massive AI adaptations for a large ROI, that’s a short-sighted view and a misunderstanding of AI use in general. Honestly, the biggest and most immediate wins aren’t in massive transformation; they’re in the small, everyday “micro-efficiencies” that make your day smoother.

They’re the five-minute tasks that AI quietly takes off your plate, the ones that, when added up across your week (and your team), give you real time back. Organizations should be focusing on the small, quick, and easy wins with generative AI for the overall workforce, while also reviewing organizational processes to determine what can be streamlined with AI to create a more efficient operation.

Here’s what focusing on the small stuff looks like in practice.

Scheduling Without the Back-and-Forth

If you’ve ever gone a few rounds just trying to find a meeting time that works for everyone, AI can handle that now. It can check calendars, propose options, send reminders, and even reschedule automatically when something shifts. Nothing flashy, just a cleaner inbox and fewer “Does this time still work?” emails. This frees up administrative assistants from managing calendars; your new administrative partner is your Gen AI copilot.

Meetings That Summarize Themselves

Transcribing, summarizing, and making meetings accessible is one of AI’s best quality-of-life improvements. Tools like Otter, Fireflies, or Microsoft Copilot can record a virtual meeting, generate notes, and highlight next steps. All this can be done before you even close your laptop. Everyone stays in sync, even if they couldn’t attend.

Managing the Inbox Avalanche

We don’t need more email; we need a smarter email inbox. AI can help prioritize what really matters, categorize what doesn’t, and even draft replies in your own tone. It’s like having an assistant who knows which messages deserve your attention and which can wait.

Drafts, Reports, and Writing Help

Generative AI shines when you need to start a memo, draft a briefing, or clean up a few paragraphs. You still edit and refine, but instead of starting from scratch, you’re shaping something that already exists. For most people, that’s a major unlock. For example, you can load a previous document or template and then add your new thoughts. The AI will review both and merge them into a new version ready for your edits. This process alone can save hours, if not weeks, of work.

And if you’ve got a long report to get through? AI can summarize the key points in plain language. No more scrolling through 50 pages just to find what matters.

Visuals in Minutes, Not Hours

From editing an image to creating a quick chart or slide, AI-powered tools now make design work accessible to anyone. You don’t need to wait for a specialized team or software; you can just describe what you need and let the model do the heavy lifting.

Subscribe now

Beyond Admin: Technical and IT Support

AI isn’t just for comms or admin work; it’s also showing up in more technical spaces. Think about code generation, cybersecurity alerts, or even prioritizing IT help desk tickets. The goal isn’t to replace expertise; it’s to give those experts faster, smarter tools to do their jobs.

Smarter Search and Knowledge Sharing

Every organization struggles with “Where did we put that file?” AI-powered knowledge retrieval fixes that. You can ask natural questions, “What was our 2023 policy on data retention?” and get direct, cited answers instead of digging through folders.

Creating Your Personalized Information Feed

Finally, AI can help you keep up without being overwhelmed. You can have it curate news articles, policy updates, or internal communications tailored to your role or interests. It’s like having a personalized information feed that works.

The Bigger Picture

Generative AI isn’t just about big transformation projects. In fact, it may not be the answer—or at least the whole answer—to a major transformation project. But it is about freeing people up to focus on the work that really matters. Every time AI takes one of those small, repetitive tasks off your plate, it returns something far more valuable: your time and attention.

This isn’t just theory. After my own organization released Copilot, I surveyed the staff to find the results of any changes in their daily work processes. The results were clear: those who engaged the tools regularly reported a time savings of up to three hours per day.

This reframes the central question. It isn’t, “How can we overhaul everything with AI?” but rather, “Where can AI quietly give us time back today?”

That’s where the real value starts.

Share

The role of the CIO has changed over the years. And now it is more important than ever to have full engagement with your CIO in the business setting. Technology advances fast and there is just more to come. Anyone who doubts the importance of the CIO's role can look around their office and notice how many paper processes are left. If your organization's technology tools or network went down, would you continue to operate?

Share

Earlier this week, I joined the National Capital Region’s Department of Defense Historians at the Pentagon to talk about the good, the bad, and the ugly of developing and deploying artificial intelligence solutions across an organization. It was a fantastic discussion, and I had the privilege of sharing the stage with some incredibly talented colleagues who are pushing creative AI solutions inside their organizations.

A few things stood out:

• Tools aren’t always available. Because of the sensitive nature of their work and environment, some commercial AI tools can’t be used. Others must be modified to meet security restrictions—leading to dated datasets, which we all know can degrade AI performance over time.

• Innovation finds a way. One presenter showcased incredible work with Google’s NotebookLM—using it to turn textual historical accounts into short, engaging video sound bites with spoken narration and visualizations. Imagine the impact of that in a museum setting: a quick and compelling way to both advertise and educate the public.

• AI is not just for engineers. Don’t discount the ability of artists, historians, and non-technical professionals to create extraordinary things with these tools. While AI doesn’t generate truly “new” ideas (it recombines what’s already there), humans do. The magic comes from the partnership.

Human + AI = ?
That’s the equation we’re all still solving—but the results are already powerful.

Share

Everyone seems to be talking about Generative AI (Gen AI). From ChatGPT to image generators to business chatbots, the technology has dominated headlines and boardroom conversations. But here’s the thing: while Gen AI is powerful, it isn’t the end-all-be-all of artificial intelligence. It’s broad, general, and great for conversation, research assistance, and drafting initial documents, but it doesn’t provide the deep expertise or specialized analysis needed for high-stakes decisions.

Why? Because Gen AI is trained on the web. That means answers can be biased, hallucinated, or flat-out wrong. You still need a human in the loop to validate whether the output is useful. As one tech industry leader put it, Gen AI is like having a pocketful of PhDs on speed-dial, but I am saying that you still need the judgment to know what to do with their advice.

Lessons From Machine Translation

Before Gen AI hype took over, one of my organizations adopted machine translation for important public-facing documents. Early on, we required a native speaker to review every translation to ensure meaning wasn’t lost. At first, edits were frequent. But over time, as the translation models improved, the need for human edits declined until it was nearly zero. Still, we made sure every translated document included a note: “Translated from English by AI. The English version is the document of record.”

That balance of embracing the efficiency of AI while keeping humans accountable will be the blueprint for how we integrate Gen AI into real workflows. The day may come when human review is unnecessary, but that day isn’t here yet.

Agentic AI: The Next Buzzword?

Now, tech leaders are hyping Agentic AI, these are systems of AI agents that act autonomously to perform specific tasks. Unlike general-purpose Gen AI, agentic systems can be tuned for sales, customer service, or even internal operations. Salesforce, for example, has rolled out its AgentForce tools to automate parts of sales engagement and operations with the company's leader, Marc Benioff, noting that he requires less headcount to get the job done. As of September 2025, this has resulted in the company having a 4,000 person layoff. Some companies are pairing this with layoffs, fueling fears that AI is simply a cost-cutting mechanism.

And while agentic AI can indeed reduce headcount in some areas (customer service centers are the ripest for automation), the reality is more nuanced. Good AI agents aren’t just “ChatGPT on your website.” They need specialized training, domain-specific knowledge, and strong guardrails to prevent embarrassing failures.

Consider Microsoft’s infamous Tay chatbot (2016), which was quickly pulled offline after Twitter users trained it to produce offensive content. Or Air Canada’s hallucinating chatbot (2023), which misled a customer about refund policies forcing the airline to honor the fabricated claim. Elon Musk's Grok that called itself MechaHitler. And the simple fact that the BBC conducted a research study in February 2025 that found the Chatbots by Microsoft, OpenAI, Google, and Perplexity provided inaccurate information about news stories 51% of the time. These cases show why organizations can’t skip the hard work of oversight, guardrails, and engineering.

To put it in perspective, the hype around Agentic AI is really part of a larger pattern: the natural rise and fall of AI excitement.

Subscribe now

The Hype Cycle Is Calming Down

The early magic of Gen AI made it feel like Artificial General Intelligence (AGI) was just around the corner. But reality is catching up: these tools are pattern recognition machines, not conscious thinkers. They remix what’s already out there; they don’t generate true breakthroughs on their own.

That said, breakthroughs can come from pairing Gen AI with human ingenuity. Researchers and innovators who ask the right questions and feed the right data into these systems will continue to unlock advances in science, technology, and art. But the creative spark, the leap into the unknown, still belongs to humans.

Beyond Gen AI: The Wider AI Toolbox

It’s worth remembering that Gen AI is just one tool in a much larger AI toolbox. Other technologies are often more powerful for specific use cases:

• Computer vision: for manufacturing, healthcare imaging, and robotics.

• Recommendation engines: for retail, entertainment, and digital platforms.

• Transcription and translation engines: for accessibility and global communication.

• Predictive analytics and machine learning models: for finance, supply chains, and scientific research.

The future of AI is not about chasing hype cycles but about choosing the right tool for the job. Gen AI can make us more efficient, but specialized AI will continue to drive real productivity gains.

Final Thoughts

Generative AI is here and available for all to use. It’s a versatile, sometimes dazzling tool that belongs in every organization’s toolbox but only if used wisely. The companies that thrive will be those that combine Gen AI with domain-specific AI systems, enforce human oversight where it matters, and resist the temptation to blindly follow the hype.

AI will advance the human race, but only if we learn to see clearly through the noise.

Share

Generative AI isn’t just another buzzword, it’s a transformative force that can supercharge creativity, automate routine tasks, and unlock entirely new revenue streams. But here’s the reality check: diving headfirst into deployment without a plan can create more problems than solutions. Think security risks, underwhelming ROI, or the dreaded “we bought licenses, no one uses them” scenario. Those missteps only fuel employee skepticism and reinforce the idea that AI is more hype than help.

An August 2025 MIT Media Lab Project NANDA study found that 95% of corporate AI implementation projects, primarily generative AI pilots, fail to deliver measurable business returns. Translation: lots of effort, very few wins. Generative AI is not a silver bullet, it won’t magically turn your organization into something it wasn’t before. What it can do, when properly planned and deployed, is give you a competitive advantage by augmenting employee capabilities, freeing up time, and unlocking new possibilities.

And, just like any major tech rollout, it’s about small wins first. Those small, visible victories build momentum and trust across the organization.

This multi-article guide lays out a step-by-step roadmap to introduce generative AI thoughtfully, maximize its benefits, and make sure it sticks. Let’s start with step one: understanding your starting point.

Understanding Your Starting Point

Before you buy licenses, sign contracts, or spin up an instance of a large language model, take stock of your organization’s resources: your people, processes, data, and infrastructure.

• Assess your data and infrastructure. Do you already have clean, well-labeled datasets? Is your cloud or on-prem environment robust enough to handle the compute demands of modern AI?

• Map your workflows. Look for the “low-hanging fruit”—repetitive, manual, or creative processes ripe for augmentation. Think of customer support triage, marketing content generation, compliance checks, design prototyping, or code scaffolding.

• Gauge organizational maturity. Are your teams comfortable with iterative experimentation and occasional failure? Do you have pockets of “AI champions” ready to test, evangelize, and spread best practices?

My Rollout Story: Finding the Champions

Before I rolled out generative AI (GenAI) at my organization, I knew I wasn’t starting from scratch—I already had a handful of curious, enthusiastic staff who were eager to explore and requesting GenAI tools to use within the organization. These were the folks who immediately read the AI Use Policy and Procedures document I published. They drafted use cases, sent them my way for review, and volunteered to pilot tools.

Right there, I had found my acolytes, my “AI champions.” They would become my first line of evangelists, helping to spread adoption among their peers. But I knew I couldn’t rely only on the enthusiastic few. What about everyone else?

Subscribe now

Surveying the Landscape

I didn’t have the time, or the clones, to interview everyone in person. So, I built a baseline survey.

• 47 questions, ~15 minutes to complete.

• Mix of formats: multiple choice, Likert scale, and open-text questions.

• Focus areas: comfort with AI, prior experience with AI or similar tools, concerns, preferred training formats (in-person, on-demand video, tutorials, etc.), and areas of work they thought could benefit.

I gave the organization two weeks to complete it, and the results were gold. The survey gave me a clear picture of organizational readiness, surfaced concerns I could address directly, and helped me plan training tailored to actual needs, not assumptions.

Infrastructure & Security Considerations

On the technical side, I was confident our infrastructure could handle commercially available tools and custom apps built from existing APIs. But the bigger concern was data security. AI without guardrails is like giving your intern the keys to the company safe, what could go wrong?

We took several steps to lock down sensitive data. The biggest was deploying a script that locked all organizational files to their owners. Yes, it created some headaches, people had to re-share documents intentionally rather than rely on inherited access, but it drastically reduced the risk of accidental data leaks inside or outside the organization. Combined with network segmentation, it gave us the peace of mind that information would only flow where it was meant to.

Key Takeaway

The clearer your baseline, the sharper your vision for generative AI’s “north star.” Before you roll out flashy pilots or enterprise licenses, invest the time to understand your people, your processes, and your security posture. That foundation is what turns generative AI from an overhyped experiment into a sustainable advantage.

Share

Due to my background in the global media industry and a decade of experience as a CIO, I recently had the opportunity to consult with the leadership team of a medium-sized media organization about hiring a new Chief Information Officer. What unfolded was a revealing and, frankly, concerning conversation.

The executive team, comprised of the CEO, COO, and CFO, admitted, without hesitation, that they had no idea how to work with a CIO. They didn’t know what the CIO should be responsible for, how to assess their performance, or even how to communicate with them effectively. One comment from the CEO stuck with me: “We don’t even know the right questions to ask.” To make matters more complicated, they weren’t even sure who the CIO should report to.

This company had recently let go of their former CIO due to operational failures that revealed a deeper issue: the IT team lacked critical capabilities. The board took notice, and for good reason. They flagged this to the CEO and the broader leadership team as a systemic failure of oversight. It was a wake-up call, and a necessary one.

Based on this experience, I wanted to share some key insights for hiring IT executives, especially at the leadership level, and highlight the role executive teams must play in understanding their IT environments.

Understand Your Business

Before you can evaluate or hire a CIO, you need to understand your own business. This might seem obvious, but it’s surprising how many executive teams lack fluency in the operations of their departments, especially IT.

Each executive should be fluent in their own domain, but they should also have a baseline understanding of what other departments do, particularly departments as essential as IT. If you can't communicate effectively with a peer executive, that's a leadership gap.

This applies not just to CEOs hiring CIOs, but also to CIOs hiring VPs of Infrastructure, Application Development, or Cybersecurity. If you don’t have deep expertise in a specific area, you need to learn enough to ask good questions, evaluate candidates, and understand what "good" looks like.

In this case, we were talking about a media company, a business that fundamentally depends on technology to deliver content. Yet their IT department was underfunded and underappreciated. That’s a strategic misstep. Every company today is a tech company to some degree, but media companies live and die by their ability to use tech effectively.

If you can’t get your media to the masses, you don’t have a viable product. Your IT investment should reflect that reality.

Understand the Role You're Hiring For

How can you hire someone if you don’t understand what they do? You can’t. And you shouldn’t.

If you don’t understand the CIO role, pause the hiring process. Bring in someone who does. It could be a trusted advisor, a former CIO, or a panel of experienced technology leaders. Use them to help define the role, vet the candidates, and support your decision-making.

The same logic applies when a CIO is hiring senior IT leaders. You should already know the functions of the roles you’re hiring. That knowledge should guide your interview questions, helping you evaluate both technical proficiency and cultural fit.

And here’s a critical piece of advice: don’t have subordinates interview their potential boss. That dynamic is backwards. It undermines the authority of the incoming executive and creates unnecessary politics.

If you want a technical vetting process, build an evaluation panel of outside professionals who are peers or senior to the role you're hiring. This approach ensures the process remains unbiased and free of internal agendas.

Subscribe now

Establishing the Right Reporting Structure

One of the recurring issues I see is confusion around where the CIO should sit in the org chart. In some companies, the CIO reports to the CFO, which can limit their strategic impact. In others, they report to the COO, which might make sense if operations are tech heavy. But ideally, in a digital-first world, the CIO should report directly to the CEO.

Why? Because technology strategy is business strategy.

CIOs today aren’t just overseeing infrastructure and help desks. They are pivotal in product delivery, customer experience, data strategy, and innovation. Burying them two or three layers down in the org sends the wrong message and diminishes their ability to contribute.

If you want to get the most out of your CIO, give them a seat at the table.

How to Interview a CIO

Interviewing a CIO isn’t the same as interviewing other executives. The blend of skills you’re looking for includes deep technical understanding, strategic thinking, leadership, and business acumen.

Here are some guidelines:

1. Ask about impact. What business outcomes have they influenced through technology?

2. Dig into failures. What major projects failed under their watch, and what did they learn?

3. Explore communication style. Can they translate tech-speak for the boardroom?

4. Gauge cultural alignment. Are they a builder, a fixer, a transformer? What does your company need?

5. Test their knowledge. Use an external panel of tech leaders to evaluate their technical depth.

Building a Partnership Culture

If you want your CIO to succeed, the rest of the executive team needs to see IT as a business partner, not a service provider. This means inviting them into strategic conversations early, not just calling them when something breaks. I talked about this in my Chief information Officer equals Business Partner…Business Strategist article.

Culture matters. IT can’t operate in a silo. They need to collaborate with marketing, product, finance, and operations. That collaboration starts at the top.

Final Thoughts

Hiring the right CIO isn’t just about filling a role, it’s about setting your organization up for long-term success in a digital world. But success starts with understanding.

If you don’t understand the role, invest the time to learn. Bring in experts to help you assess candidates. Create a structure where your CIO can thrive. And above all, treat technology as the strategic asset it is.

Because at the end of the day, if you can’t get your message to your audience, someone else will.

Share

Let's face reality: IT budgets are constantly under scrutiny. I have not worked in an organization where leadership hasn’t asked, “How can we reduce the IT budget?” Many people in business see the big budgets of the IT department and think COST CENTER, a big expense line to trim. What they don’t always realize is this: every business today is a technology business. Technology is the backbone that keeps everything running smoothly.

Demonstrating ROI is your way of proving the value of your projects and initiatives, beyond just technical outcomes. You need to show everyone that you are providing a RETURN ON INVESTMENT for the organization.

ROI in IT often comes down to a mix of tangible and intangible benefits:

• Tangible benefits could include reduced operational costs (such as less maintenance and fewer outages), increased productivity, or enhanced revenue through improved business operations (maybe that came from a transition from CAPEX to OPEX).

• Intangible benefits, while harder to quantify, can be just as critical. These include enhanced security posture, increased employee satisfaction, or improved organizational agility.

Calculating and Presenting ROI

When calculating ROI, clarity is king. Here's a simplified ROI formula to consider:

ROI = (Net Benefits ÷ Cost) × 100

Consider an IT project aimed at automating customer service processes. If the automation reduces manual hours by 25%, calculate the savings in labor costs, factor in the project implementation cost, and then present your ROI clearly and concisely. For example:

• Cost: $200,000 (implementation)

• Annual Labor Savings: $100,000

• ROI: ($100,000 ÷ $200,000) × 100 = 50%

Translate your ROI into business terms, clearly communicating to senior leadership how the investment directly benefits organizational operations, profitability, or strategic agility.

Subscribe now

Real-World Example from My 2021 IT Strategic Plan

Here is an example from the accomplishment of one of my objectives from my 2021 IT Strategic Plan. If you remember in my IT Strategic Plan Series I had an IT Strategic Goal of:

Goal 1: Ensure reliable, secure, high performing information technology services to support business needs

We will maintain and update the enterprise architecture in alignment with the NEA’s strategic goals and business strategy. We will review the NEA’s business processes and ensure that we thoroughly understand and evaluate them to determine what can be automated.

Objective 1.1 Mobile Computing and Collaboration

Continue support for mobile computing and prepare for further use of the technology and security in order to provide the NEA workforce with a more efficient and flexible work environment. New technology allows employees to communicate, collaborate, and work more efficiently. The NEA will leverage these technologies to empower the workforce with innovative, collaborative tools.

From this strategic goal, its objective, and working with the business side of the organization came the identification of automating the collection of panelists’ information. This was identified by the business as a tedious time-consuming endeavor that was performed over the phone. I worked with the business and found that it took nearly 3 hours of each grant coordinator’s time to collect this information. It was done via phone which generally required numerous attempts to complete the task – all equating to the total of 3 hours.

Acquiring the use of the DocuSign system turned out to be $20,000. When you run the numbers:

Cost of the application: $20,000 year

Labor Savings: 3 hours x 800 panelists x the hourly cost of a grant coordinator ($80,000/2,080 (hours of work within a year)) = $92,307

ROI: ($92,307 / $20,000) x 100 = 461%

461% RETURN ON INVESTMENT!

This is certainly a number worth showing off. By implementing this system, we have a 461% Return on Investment. This gives nearly 3 hours of time back to each grant coordinator (per panelist) and provides an easier and more secure method for the panelist to provide information to the organization. This provides the tangible benefits of increased productivity and the intangible costs of enhanced security posture and increased employee and panelist satisfaction.

The Bottom Line: Own Your Strategic Value

If you want to elevate IT from the perception of a cost center to a strategic partner, mastering ROI storytelling is non-negotiable. It’s not enough to build or fix technology, you must translate your work into business outcomes that leadership understands and cares about. Whether it’s saving time, reducing risk, or unlocking new capabilities, your job is to make that value crystal clear.

So next time someone asks to cut your budget, you’ll be ready with a compelling answer: “Here’s how we’re driving real business value, with measurable ROI to prove it.” Because at the end of the day, that’s how IT wins respect, resources, and strategic influence.

Share

Throughout this series, we've explored the critical steps involved in crafting a robust multi-year IT strategic plan—from defining clear goals and measurable KPIs, mastering strategic communication, and continuously adjusting for ongoing success. As we conclude, let's focus on ensuring the longevity and lasting impact of your strategic efforts.

Strategic Planning as an Ongoing Process

Remember, strategic planning isn't a once-and-done exercise. It's an iterative, continuous process. The strength of your strategic plan is not just measured by its immediate success, but by its ability to adapt, evolve, and continuously align with the organization's evolving landscape.

Institutionalizing the Process

To ensure longevity, embed strategic planning into your organizational culture. Develop routines for periodic updates, regular stakeholder engagements, and consistent strategic reviews. By institutionalizing these processes, strategic planning becomes a natural and integral part of organizational operations, rather than an exceptional effort.

I like to hold quarterly reviews on our progress for achieving our strategic plan. I hold these with the internal team and then report out on them to the rest of the executive team when appropriate.

Foster Leadership Commitment

Sustained leadership commitment is essential. Regularly engage executive leadership to maintain their support and buy-in. Clearly articulate the ongoing benefits and strategic importance of your initiatives to keep leadership actively involved and supportive.

Empower Your Teams

Your IT strategic plan’s longevity also relies heavily on the strength and engagement of your team. Empower your teams with ownership, clear responsibilities, and the necessary resources to execute effectively. Foster professional development, encourage innovation, and support their ability to proactively respond to changes and challenges.

Knowledge Transfer and Succession Planning

A strategic plan can falter if it relies too heavily on one or two key individuals. Develop comprehensive knowledge transfer and succession planning processes. Document critical strategic decisions, maintain clear records of ongoing projects, and ensure multiple team members understand and can execute core strategic initiatives.

Subscribe now

Maintain Flexibility and Agility

Longevity doesn't mean rigidity. Your plan should remain agile, responsive, and proactive. Embrace flexibility to pivot when necessary, leveraging emerging technologies and best practices to maintain a strategic edge. Continual reassessment and agile responses to change will reinforce your plan’s long-term relevance.

Celebrate Strategic Thinking

Continuously reinforce strategic thinking across your organization by regularly highlighting the benefits derived from the strategic plan. Publicly celebrate milestones, innovations, adaptability, and successful outcomes. This not only boosts morale but reinforces the value and ongoing importance of strategic planning.

Regularly Refresh Your Vision

Periodically revisit and refresh your strategic vision. As organizational goals evolve and external conditions change, your strategic vision must adapt accordingly. Regularly realigning your vision keeps your strategy fresh, relevant, and effective for years to come.

Last words

These are my last words on IT Strategic Planning (at least for this series of articles).

Ensuring your strategic plan’s longevity is about building lasting processes, fostering continuous engagement, and embracing flexibility. By embedding strategic planning deeply into your organizational fabric, you secure a robust and enduring strategic direction that not only meets immediate objectives but prepares your organization for sustained future success.

Thank you for joining this strategic journey—here’s to your continued success!

Share

Read the How to Develop Your IT Strategic Plan Series from the beginning

Congratulations, you've created your strategic plan, communicated it effectively, and set up clear metrics for success. However, no strategic plan should be static. For sustained effectiveness, you need to continuously evaluate, adapt, and refine your plan to respond to changes in technology, organizational priorities, and external factors.

The Necessity of Flexibility

In IT, change is constant, new technologies emerge, cybersecurity threats evolve, and business objectives shift. Your strategic plan must remain agile to accommodate these changes effectively.

Regular Strategic Reviews

Establish a disciplined approach to regular reviews—quarterly or semi-annual check-ins where you reassess your plan’s relevance, progress, and alignment with current business realities. During these reviews:

• Evaluate KPIs and ROI: Are your projects delivering expected results? Identify where you're excelling and where adjustments may be required. (We will go over ROI in a future article)

• Assess Emerging Technology Trends: Keep a proactive eye on technology developments that may offer strategic advantages.

• Review Organizational Shifts: Ensure your plan stays aligned with broader organizational objectives and responds effectively to internal or external changes.

Incorporating Feedback

Proactively solicit and integrate feedback from stakeholders, technical teams, and external advisors. Real-time feedback can reveal opportunities for improvements, adjustments, or even pivots in your strategic approach.

Scenario Planning

Incorporate scenario planning into your reviews. Anticipate and model potential future events or trends that could impact your strategy. By considering scenarios such as rapid technological advancements, market disruptions, or security incidents, you prepare your team and organization to respond effectively when challenges or opportunities arise.

Adaptive Resource Management

Your resource allocation should remain flexible. Be prepared to reallocate funds, personnel, or technical resources as priorities evolve. Having clearly defined but flexible resource planning ensures you can quickly pivot when necessary without major disruption.

Transparent Adjustments

Transparency is critical when adjusting your strategic plan. Clearly communicate to stakeholders the reasons behind any changes, what the expected outcomes are, and how adjustments better align with current goals. Transparency maintains stakeholder trust and ensures continued alignment and support.

Subscribe now

Building Continuous Learning

Promote a culture of continuous learning within your IT organization. Encourage your team to engage with new technologies, attend industry conferences, and continuously refine their skillsets. This ongoing learning will strengthen your team's ability to anticipate changes and adapt proactively.

Document Adjustments

Every time adjustments are made, document clearly:

• What changes were implemented.

• Why these adjustments were necessary.

• The anticipated impact on strategic goals and metrics.

This practice not only maintains clarity and accountability but also provides valuable insights for future strategic planning.

Celebrating Adaptability

Just as you celebrate initial successes, also acknowledge and celebrate adaptability. Highlight instances where your team's proactive adjustments have mitigated risks, capitalized on new opportunities, or significantly enhanced outcomes. Celebrating adaptability encourages proactive thinking and flexibility across your organization.

Adjusting Your Plan = Enhancing Your Effectiveness

Adjusting your multi-year IT strategic plan is not about admitting fault; it's about enhancing effectiveness, staying relevant, and proactively responding to change. By embedding regular reviews, scenario planning, adaptive resource management, and fostering a culture of continuous learning and adaptability, your strategic plan remains a robust and dynamic tool, ensuring sustained organizational success.

Next week – Closing Thoughts: Ensuring Strategic Plan Longevity.

Share

Read the How to Develop Your IT Strategic Plan Series from the beginning

By now, you’ve established clear goals and identified critical KPIs of your strategic initiatives. However, the success of your multi-year IT strategic plan hinges not just on its technical merits but on your ability to communicate it effectively to all stakeholders.

Know Your Audience

Communication begins with knowing your audience. Not everyone in your organization speaks “tech,” and tailoring your message accordingly is crucial.

• Executives: They need concise, clear explanations focused on how your plan supports organizational objectives, profitability, risk management, and growth.

• Middle Management: They require clarity about operational impacts, resources required, and how it affects their teams directly.

• Technical Teams: They need detailed technical roadmaps, specific milestones, and clarity on responsibilities and dependencies.

As you can see, based on the requirements of the different levels of management, communication should occur at different times, in different meetings, in different settings. You don’t want to have the initial roll out of your plan to be at an All-Staff meeting where not everyone’s questions will be addressed and you are speaking in a language not everyone understands. This will just create confusion.

It is best to have meetings with your separate audiences before launching an All-Staff presentation of your IT Strategic Plan.

Simplify the Complex

Your strategic plan should not include intricate technological details. These should be left for project plans on your team. Anything that is considered “tech -speak” should be simplified when communicating to non-technical stakeholders. Use relatable analogies, clear visuals, and straightforward language to ensure your audience quickly grasps the strategic importance of your initiatives.

ZTA Example

For instance, my go-to explanation for non-technical audiences when discussing Zero Trust Architecture is this:

“The past method of technically securing your business environment was with a castle and moat style of security. Think of your business as the castle and the perimeter has a moat around it that prevents any unwanted visitors from getting to your castle. But once someone gets into the castle they have full access to wander around and collect things.

With a Zero Trust Architecture, you still have the castle and the moat, but when you get to the castle it is locked and you must authenticate to get in. Once you get in, all the other doors are locked and you must authenticate to get into any of the other rooms.

In other words, we do not trust any movement on the network without continuous verification of who it is and the knowledge that they should be in the rooms they are in.

Use Clear, Visual Communication

Visuals make complex concepts easily digestible. Utilize graphs, charts, timelines, and dashboards to succinctly showcase progress, dependencies, and results. Visual aids like:

• Roadmaps highlighting key milestones.

• Dashboards that show real-time KPI progress.

• Charts that illustrate ROI clearly.

This helps stakeholders quickly understand your message and engages them more effectively.

Subscribe now

Regular and Consistent Updates

Communication shouldn’t be a one-time event. Provide regular updates to all stakeholders on plan progress, challenges, and achievements. Establish a consistent interval such as monthly or quarterly updates ensure stakeholders remain engaged, informed, and supportive.

Discuss sending out a Quarterly newsletter

One way to accomplish this is through a quarterly newsletter to the organization. In the newsletter, you can identify any high priority items/projects that may affect operations, champion some of the accomplishments of your team, and definitely highlight any cross-organization successes.

Engage Stakeholders Proactively

Invite feedback regularly. Stakeholders who feel heard and involved are more likely to support your plan enthusiastically. Conduct periodic stakeholder meetings, surveys, and informal check-ins. Listen to concerns, clarify misunderstandings promptly, and show openness to adjusting based on stakeholder input.

Transparency Builds Trust

Always communicate openly about both successes and challenges. Transparency builds trust and credibility. Clearly articulate when things aren't going as planned, why adjustments are necessary, and how you're proactively managing risks.

Foster a Culture of Shared Ownership

Your IT Strategic Plan impacts the entire organization, not just IT. Foster a culture of shared ownership by framing your goals as collective organizational goals. This helps stakeholders feel invested in your/their success and fosters greater collaboration and accountability.

Celebrate Successes

Recognizing and celebrating milestones boosts morale, fosters engagement, and reinforces the value of strategic initiatives. Whether through newsletters, town halls, or recognition programs, acknowledging accomplishments publicly motivates continued enthusiasm and commitment.

The Importance of Communication

Effectively communicating your multi-year IT Strategic Plan isn't just about disseminating information—it's about inspiring alignment, fostering collaboration, and building a unified vision across the organization. By mastering clear, consistent, and engaging communication, you solidify IT’s role as a valued strategic partner, ultimately driving organizational success.

Next week, Part 6 – Adjusting Your Strategic Plan for Ongoing Success.

Share

Read the How to Develop Your IT Strategic Plan Series from the beginning

“What gets measured gets done.”

- Peter Drucker

If you've been following along from the beginning, you’ve already done some heavy lifting. By now you've set your goals, aligned them with your organization's broader strategic vision, and prioritized projects to achieve them. Now comes one of the most critical steps: defining and measuring success through Key Performance Indicators (KPIs).

Why KPIs Matter

Key Performance Indicators (KPIs) are the quantifiable indicators of progress toward an intended result. (KPI.org)

KPIs aren't just checkboxes; they're vital signs of your strategic health. Simply put, if you can't measure your success, how will you know when you've achieved it? Every strategic goal in your IT plan should have quantifiable KPIs that clearly indicate progress toward completion.

Let's say one of your goals is improving system reliability to enhance organizational productivity. Your KPIs might include:

• Reduction in system downtime (e.g., from 2% to 0.5%).

• Decrease in helpdesk tickets related to system outages.

• Increased user satisfaction ratings from periodic surveys.

By tracking these metrics regularly, you gain clarity about your team's progress and can proactively address issues before they become major problems.

Selecting Effective KPIs

Not every metric is created equal. Effective KPIs are SMART: Specific, Measurable, Achievable, Relevant, and Time-bound.

Here's a quick test for your KPIs:

• Specific: Is the goal clear? Instead of "improve cybersecurity," try "reduce security incidents by 30% annually."

• Measurable: Can it be quantified or tracked? If you can't measure it, rethink it.

• Achievable: Is it realistic given your resources and constraints?

• Relevant: Does it align clearly with strategic objectives?

• Time-bound: Do you have a clear timeframe?

Subscribe now

A Real-Life Example from My 2021 Strategic plan

Goal 1: Ensure reliable, secure, high performing information technology services to support business needs

Objective 1.1 Enhanced Security

The Office of Information & Technology Management (OITM) will include enterprise security management, continuous monitoring, and identity and access management which includes single-sign-on.

We will assess current security risk policy for alignment with acceptable security risk thresholds and devise cloud security requirements to determine the security services and level of protection required for client data and information in the cloud.

We will focus on implementing the latest in proven cybersecurity techniques and technologies including upgrading to a Zero Trust Architecture (ZTA). [S]

Goal 1 Strategic Initiative

Objective 1.1 Enhanced Security - Transition 100% of the organization’s network architecture to Zero Trust Architecture by the end of FY2024 [R, T]

Goal 1 Key Performance Measure

Objective 1.1 Enhanced Security - 100% of the organization’s network architecture will be transitioned to a Zero Trust Architecture as represented by the progress against the CISA ZTA Maturity Model v2 [A, M]

(The letters at the end represent the areas of the strategic goal that align with the SMART KPIs.)

In developing each strategic goal, I had approximately 3 objectives under each associated with initiatives and key performance measures. Here, I trimmed it down for clarity.

KPIs Are Not “Set-It-and-Forget-IT”

Your KPIs should evolve with your environment. Real-time data can (and should) shape your strategy. That means regularly reviewing, updating, and sometimes even scrapping a KPI if it no longer serves your mission.

Strategic plans should breathe. KPIs are how you check the pulse.

Aren’t these Numbers just a Formality?

Absolutely not. KPIs are the currency of credibility. They translate your IT vision into tangible, measurable outcomes that your stakeholders can understand.

Mastering KPIs and ROI demonstrates that IT isn’t just supporting the business—IT is the business. And when you show clear progress with hard data, you're not just building dashboards, you’re building trust.

Next week, Part 5 – Communicating Your IT Strategic Plan Effectively.

Because the best plan in the world won’t matter if no one understands it.

Share

Read the How to Develop Your IT Strategic Plan Series from the beginning

Subscribe now

The promise of agentic AI, the vision of autonomous digital workers that can plan, decide, and execute complex workflows with minimal supervision, has captured the imagination of executives and technologists alike. From breathless press releases touting “Agent-to-Agent” protocols to demo videos of chatbots booking flights or troubleshooting hardware, it sometimes feels as if we’re on the brink of replacing entire teams with lines of code. But before we hand over the corporate reins to our silicon-savvy colleagues, it’s worth asking: how close are we, really?

The Hype Cycle Accelerates

At Google I/O 2025, the company rolled out what it calls a “new class of agentic experiences,” these are digital assistants that not only answer questions but can autonomously hunt down user manuals, queue up tutorial videos, and even place phone calls to local vendors with almost no human prodding. They painted a picture of digital coworkers who could seamlessly juggle travel bookings, expense reports, and calendar conflicts by quietly negotiating behind the scenes. It was compelling, and many vendors quickly branded their existing automation scripts as “AI agents,” capitalizing on the buzz without delivering anything fundamentally new. This rampant “agentwashing” inflates expectations and sets enterprises up for disappointment (MIT Technology Review).

Reality Check: TheAgentCompany Experiment

Contrast that vision with a recent Carnegie Mellon University study in which researchers built a fully simulated software firm, TheAgentCompany, and staffed every role, from HR to software development, with today’s leading AI agents. The result? Chaos. Pop-up windows halted some bots in their tracks, others rewrote chat usernames instead of finding the correct contact, and none came close to matching human reliability. The best-performing model, Anthropic’s Claude 3.5 Sonnet, completed just 24% of assigned tasks; Google’s Gemini 2.0 Flash managed 11.4%, and OpenAI’s GPT-4o only 8.6% (CMU School of Computer Science).

TheAgentCompany benchmark was exhaustive: 16 distinct “employees,” a mix of common office tasks, and 3,000 hours of engineering to ensure repeatability. That painstaking work revealed stark truth—today’s agents routinely flunk the basics of web navigation, task comprehension, and even social protocols that a human co-worker would find trivial (CMU School of Computer Science).

Why Definitions and Guardrails Matter

As MIT Technology Review’s Yoav Shoham warns, slapping the “agent” label on anything with a script can erode trust and provoke backlash before the technology matures. Without shared standards, companies can market rudimentary automation as cutting-edge AI, sowing confusion among customers and stakeholders. Worse, uncontrolled autonomy invites errors that can be subtle yet costly, like an agent inventing a nonexistent policy or misfiling confidential data. Shoham argues for clear definitions of autonomy, reliability metrics, and robust guardrails that monitor and correct AI outputs in real time (MIT Technology Review).

Subscribe now

The Human-in-the-Loop Imperative

None of this is to say agentic AI is a dead end. On the contrary, the underlying models are advancing rapidly, and structured architectures (layering LLMs with domain data, rule-based modules, and human oversight) can mitigate unpredictability. But even the smartest AI needs a human co-pilot to interpret context, validate edge cases, and steer multi-step workflows to completion. In enterprise settings, this hybrid approach isn’t optional; it’s a necessity. Whether it’s a support ticket that veers off script or a negotiation between two corporate agents with competing incentives, a human is still the best judge of nuance, ethics, and strategy.

Moving Forward with Realism

For executives charting a course through the agentic AI landscape, here are a few guardrails to keep in mind:

1. Define “Agent” Clearly
   Establish internal standards for autonomy levels, expected reliability, and approved use cases.

2. Benchmark with Rigor
   Adopt or replicate simulations like TheAgentCompany to measure actual performance under realistic conditions.

3. Embed Oversight
   Design systems that flag unexpected AI behavior, route exceptions to human reviewers, and log decisions for audit.

4. Invest in Collaboration
   Treat AI agents as coworkers-in-training rather than replacements. Build interfaces that surface AI suggestions and allow humans to fine-tune outputs.

By tempering enthusiasm with measured expectations and remembering that human judgment remains irreplaceable, organizations can harness the promise of agentic AI without succumbing to the mirage of full autonomy. The agents are learning, but for now, we’re still at the steering wheel.

Share