Most businesses buy the AI tool first and work out the rules later. Often there are no rules at all, just a message saying go ahead and try it, and that ends up costing more than the tool did.
What the forecasts point at
In February 2025, Gartner forecast that companies will abandon 60% of AI projects that lack AI-ready data through 2026. In June 2025, it predicted that more than 40% of agentic AI projects will be scrapped by the end of 2027, because of escalating costs, unclear business value or inadequate risk controls.
Neither forecast is about the model. Knowing which data a tool may use, and putting controls on what it can reach, are decisions a business makes before the tool arrives, and in most rollouts nobody was asked to make them. What changes when a tool can act covers the agent side in more detail.
What "rollout first" looks like in your business
Everyone on your team gets access to a generative AI tool. There is no policy on what data may go into it, no guardrails on what it can reach and no named owner if something goes wrong, although for the first few weeks it all feels fast.
Sooner or later one of your people pastes a client contract into a prompt to get a quick summary, meaning no harm by it, and that data has now left your building in a way nobody can account for. Or a connected tool reaches further into your systems than it should, because nobody drew the boundary.
Why we put the rules first
Track opens with Govern, and no tool is chosen until it is done. Before anything touches a live system, your leadership approves the policy, the data guardrails and the access controls. Your rollout, including sign-in and permissions, then happens inside that structure.
The same discipline sits behind ISO 27001 and ISO 9001, and we have run IT services this way since becoming independent in 1999. It is also how you move faster later, because you are not stopping every few weeks to fix something a policy would have prevented.
If the tool is already out
Most businesses have already rolled something out, or their people have done it for them. Rules first still applies, because it is about the order of what happens from today. Three things can happen this week, before a full policy exists:
- Write the one rule on what never goes in, and send it to everyone. Client documents and personal data about named people are the usual pair.
- Ask who is using what, on which account, and say in the same message that nobody is in trouble for the answer.
- Stop widening. Whoever has access keeps it for now, and nobody new is connected until someone has checked what they could reach.
None of that is the policy. It holds the position while the policy gets written, and it gives the half-day workshop a starting point. The whole structure for a business your size is set out in an AI governance framework for 50 to 500 people.
The uncomfortable trade-off
Govern is the least exciting phase of Track, because nobody gets excited about a data policy and it does not feel like progress. What it decides is whether everything you build after it is safe to keep.
A policy written before your rollout costs a few days, while one written after a data incident can cost you the client whose data it was, and possibly several others who hear about it.