Five judgements, each with a confidence level attached. Pretending to certainty you do not have is how organisations build expensive capabilities that deliver hidden risk not ROI. These are the judgements I use to work out where capability is breaking down or building risk.
Back to the practiceSomeone who gets a genuinely useful answer out of a language model every morning can draw the obvious conclusion: the technology works, and what remains is procurement. However the model was never the difficult part. Data fit to use, a workflow that can absorb a decision, and people who can tell a good output from a merely plausible one — none of that got easier. I have watched organisations with a working in-house capability decide they no longer needed one because the tools had become so easy to use. The shallow is displacing the deep, inside organisations large enough to know better.
The business case that clears an investment committee is the one naming positions removed. It also narrowly caps the return at whatever those salaries were, and can rush an organisation into automating a decision it never designed carefully — because the saving was the point rather than the decision. The work worth automating is usually the decision being made inconsistently right now: the same case handled three ways by three officers on the same day. And where an automated decision affects a person's circumstances, someone must be able to intervene and be accountable. That is not just a compliance position. It is what keeps the capability alive after the first bad outcome — which is inevitable.
Governance is typically written by risk, legal and an external adviser, then handed down to operational staff as an obligation. Those staff could have told you on day one which controls would be routed around by Thursday, and nobody asked. What you get is a framework complied with on paper and worked around in practice — worse than having none, because it creates false evidence of control where control does not exist. Anyone who must apply a control in operational work belongs in the room where it is designed. That is the difference between a governance asset that holds under pressure and governance liability that merely documents.
Two years and several million dollars on, the organisation cannot maintain what it owns, cannot assess what it is being sold next, and cannot tell its board what it actually got. Moderate confidence, because some organisations have chosen this deliberately and it is working for them — buying capability you have decided not to build is a legitimate strategy. Drifting into it without deciding is not.
I've seen production capabilities survive technical problems and fail an organisational one. A restructure moves the team, changes the owner, splits the responsibilities or removes the people who knew why the system worked the way it did. Nothing is wrong with the model on Monday; by Friday, nobody owns the decision it supports. Capability is not just what the organisation has built. It is the set of people, responsibilities and relationships that keep it alive, effective and compliant.
Organisations reach the far side of a serious investment cycle and find they are not meaningfully more capable than when they started. That is rarely because the model failed. AI capability depends on six foundational pillars moving together — and, crucially, those things usually belong to different parts of the organisation. Most programmes invest in one or two pillars and assume the rest will follow.
Strengthen technology without the people ready to absorb it and you get the adoption gap. Install governance without the process maturity to run it and you get policy theatre. The pillars were built against the established assurance frameworks rather than in place of them, so a finding maps back to NIST AI RMF and ISO 42001 and not to a vocabulary only Emeris uses. The diagnosis usually names something the organisation has been living with for a year without having the language to describe it.
If one of those judgements describes your organisation, that is the conversation to have. No deck, no discovery process, no proposal arriving three days later unless you ask for one. It is a diagnostic conversation, not a sales pitch.
Thirty minutes is usually the difference between a description and a diagnosis.