A McLean Forrester Whitepaper
A Practical Guide for Senior Leaders
The Question Behind the Question
If you typed “where do I start with AI for my business” into a search engine, that phrasing tells me three things: you have already decided AI matters, you don’t yet know what to do about it, and you are tired of articles that tell you to “start with strategy” without telling you how.
This whitepaper tries to do better. It will give you:
- A way to locate where your organization actually sits today.
- A framework for AI investment depth, with honest tradeoffs at each level.
- A specific recommended starting move you can authorize this quarter.
- The conditions under which the conventional advice, “start in the back office”, is wrong.
- Realistic cost ranges, so you can size a budget conversation.
- The risks worth your attention beyond the ones that get the headlines.
It is written for senior leaders who already know AI matters and want to spend the next 90 days making progress rather than the next 18 months recovering from a bad first move.
Two Honest Disclosures Before We Start
First, the framework in this paper, three levels of AI investment depth, is McLean Forrester’s perspective. It is a useful lens for thinking about where AI fits and what it costs you, but a reader familiar with Gartner’s frameworks or the academic literature on enterprise AI maturity will find different vocabulary for similar ideas. Use whichever language best fits the conversation you are having with your board.
Second, the headline statistics about AI failure rates are real, but they are contested. The widely-cited MIT NANDA report finding that 95% of generative AI pilots fail to deliver measurable business value uses definitions of “pilot,” “failure,” and “value” that other researchers have reasonably questioned. McKinsey’s 2025 survey shows 88% of organizations using AI but two-thirds not scaling; that is measuring something different. The directional finding is robust: most AI initiatives are not yet producing the value organizations expected. The precise numbers should be held loosely.
What is not contested is the underlying pattern: enterprise AI fails far more often than enterprise software in general, and it usually fails for reasons that are not technological.
Where Are You Today? A Quick Self-Assessment
Before talking about where to go, locate yourself. Most organizations sit somewhere between Stage 1 and Stage 2 below.
Stage 0 — Not yet engaged.
No formal AI use. Some employees may use ChatGPT on personal accounts, often against unwritten policy. No governance, no training, no investment.
Stage 1 — Ad-hoc literacy.
Individuals across the organization use commercial AI tools, sometimes paid by the company, sometimes not. No org-wide license, no training program, no defined use cases. Productivity gains exist but are not measured. Data is leaking into consumer-tier tools without anyone tracking it.
Stage 2 — Organized horizontal AI.
Enterprise license deployed (Microsoft Copilot, Google Workspace AI, ChatGPT Enterprise, Claude for Enterprise, or similar). Training rolled out. Acceptable-use policy in place. Basic governance. Productivity benefits measured at least informally. No proprietary data integration yet.
Stage 3 — At least one production AI system integrated with proprietary data.
One workflow uses retrieval against your data: a customer service assistant grounded in your knowledge base, an internal search tool, a contract review accelerator. Human review of outputs. Measured ROI on at least one use case.
Stage 4 — Multiple production systems with workflow redesign.
AI is embedded across several business processes. Workflows have been redesigned around AI rather than AI dropped into existing workflows. Governance is mature. Cross-functional AI roles exist.
Stage 5 — Domain-specific AI as competitive differentiator.
Custom models or deeply curated systems built on proprietary knowledge that competitors cannot replicate. AI is part of the product, not just the operations. Often regulated industries or knowledge-intensive verticals.
If you are at Stage 0 or Stage 1, your next move is Stage 2, and the rest of this paper is most relevant to you. If you are at Stage 2, your next move is a targeted Stage 3 pilot. The most expensive mistakes happen when organizations try to leap from Stage 1 directly to Stage 4.
The Three Levels of AI Investment Depth
Stages describe organizational maturity. Levels describe the kind of AI you are deploying. They are related but not identical.
Level 1: Commercial Generative AI
ChatGPT, Claude, Gemini, Copilot. Off-the-shelf large language models that are accessed through subscriptions or APIs. Low cost, fast deployment, broad capability.
What you get. Productivity gains in writing, summarization, research, code assistance, and brainstorming. The reported range varies wildly. Gartner has cited 5–10% in surveyed organizations, but actual gains depend heavily on the work being done, the user’s prompting skill, and whether time saved gets reinvested or just absorbed. Treat any productivity number you read, including that one, as directional.
What you don’t get. Reliability for high-stakes decisions, competitive advantage, and your competitors have the same tools.
What it actually costs. $20–60 per seat per month for enterprise licenses, plus rollout costs (training, policy, light governance) typically running $50K–$200K depending on org size and rigor.
Why this is your starting point if you are at Stage 0 or 1. Not because it is transformational, but because it is the only way to build organizational fluency that makes everything else possible. Skipping this stage produces leaders who approve AI projects they do not understand.
Level 2: AI Grounded in Your Data
The technique most often used at this level is Retrieval-Augmented Generation (RAG) but the category is broader. The idea is that the AI keeps the language fluency of a commercial LLM/SLM but is given controlled access to your proprietary data so it can answer questions about your business, not just the internet.
What you get. Domain-relevant accuracy without training a model from scratch. A safer way to put AI in front of customers and internal users. Critically, this is where you can start designing AI into workflows rather than around them.
The tradeoffs. RAG sounds clean in a slide deck and is messy in practice. Output quality is dominated by retrieval quality, which is dominated by how your documents are chunked, embedded, and indexed. Many production RAG systems underperform a thoughtfully-prompted commercial LLM/SLM with manual context. Fine-tuning is sometimes a better choice; agentic workflows with tool use are sometimes better than either. Level 2 is a category of approaches, not a single architecture, and the specific architecture decision is harder than the category decision.
What it actually costs. A focused single-domain pilot: one customer service workflow, one internal knowledge base, typically $75K–$400K for a working production system, depending on data complexity and integration requirements. Full enterprise rollouts across multiple domains run $500K–$3M and up. Ongoing operations (compute, model API costs, maintenance) usually 15–30% of build cost annually.
McKinsey’s 2025 finding on what differentiates high performers at this level: defined processes for when model outputs need human validation. Not the model choice. Not the data architecture. The governance discipline.
Level 3: Domain-Specific AI Built on Your Proprietary Knowledge
Custom-trained or deeply grounded systems that function as domain experts in your business: a clinical decision support tool that knows your hospital’s protocols, an underwriting assistant that knows your firm’s risk policies, a service operations agent that knows your equipment, your customers, and your service history.
What you get. Precision and context-awareness no general model can match. Sustainable competitive differentiation, because the model embeds knowledge competitors do not have.
What you actually need to be ready. Mature, governed proprietary data. Codified expert knowledge, meaning the knowledge is out of your top performers’ heads and into structured form. Production AI experience from Level 2 work. Real budget. Programs that produce meaningful Level 3 results typically run $1M-$5M+ in initial build and require ongoing investment to keep current.
Concrete readiness gates. You are ready for a Level 3 program when (1) you have at least one Level 2 system in production with measured ROI; (2) you have a senior owner accountable for the relevant business outcome, not just the technology; (3) the data needed to ground the model exists in accessible, governed form; and (4) you are prepared to redesign the workflow it touches, not just bolt the model on. If any of these are missing, Level 3 will fail no matter how good the model is.
Where to Start: Six Recommendations, in Order
1. Authorize an Enterprise AI License This Quarter
If you take only one action from this paper, take this one. If your organization is not on an enterprise AI subscription with proper data controls, your employees are using consumer-tier tools anyway, often with proprietary data, often against policy, often invisibly. You are already paying the risk; you are just not getting the productivity.
Pick one of the major enterprise AI offerings, deploy it, train your people, and write a simple acceptable-use policy. This is the lowest-risk, highest-immediate-value move available to a senior leader today.
2. Start Where Your Data and Decisions Live, Not Where the Headlines Are
Conventional advice says start in the back office. That is right for many organizations and wrong for some. The principle behind it is what matters:
Start where the data is cleanest, the decisions are most repeatable, and the risk-to-reward ratio is best.
For operationally complex businesses such as manufacturing, financial services, logistics, healthcare delivery, insurance, regulated industries, that is almost always the back office. Finance, procurement, supply chain, IT operations, and compliance have structured data, repeatable decisions, and measurable outcomes. Start there.
For experience-led businesses such as direct-to-consumer retail, hospitality, media, B2C SaaS, professional services, the customer-facing surface may genuinely be where the most valuable, most differentiated, and most data-rich AI opportunities live. Personalization, search, recommendations, and conversational service interfaces are the front line of competition. The “back office first” rule applies less cleanly there.
Our version of the rule: don’t start where the AI is most visible. Start where the data is most usable.
3. Treat Workflow Redesign as the Main Event
McKinsey’s 2025 research found one variable that predicted AI value realization more strongly than any other: whether the organization fundamentally redesigned how the work gets done around AI rather than dropping AI into existing workflows. Organizations that redesigned the work were nearly three times more likely to realize measurable business value.
This is the most important concept in this paper. A Level 1 deployment with redesigned workflows will likely outperform a Level 2 deployment without them. The AI investment is the smaller part of the program; the change management investment is the larger part. It means if AI roadmap must include process redesign.
Most AI failures are not technology failures. They are organizational failures to change the business processes and get the organization’s buy-in.
4. Codify the Knowledge in Your Top Performers’ Heads
The bridge from Level 1 to Level 2 is all about documentation. Your most valuable AI training data is the procedural knowledge currently held in the heads of your senior people: how do they decide which supplier to escalate, how do they triage which customer complaints get fast-tracked, how do they recognize a contract clause that needs legal review.
Most organizations have never written this down. The AI rollout is the forcing function that finally makes it happen. The work is unglamorous and pays off forever, with or without AI.
5. Match Data Rigor to Stakes
We see two common failure modes. The first is launching AI on dirty data because the pressure to do something is high. Output quality is unreliable, trust is lost early, and the program never recovers.
The second is waiting for the data to be perfect before launching. The data is never perfect. Competitors who tolerated imperfect data and improved through use have gotten three years of learning ahead.
The right answer depends on the stakes. For low-consequence applications (drafting, internal search, brainstorming), launch on imperfect data and improve through use. For high-consequence applications (clinical decisions, financial advice, anything where a wrong answer creates legal exposure), validate rigorously before deployment.
6. Sequence the Roadmap Around Decisions, Not Demos
A common pattern we see: the first AI pilot is whatever the most enthusiastic VP wants to demo. The second is whatever caught the CEO’s eye in a vendor briefing. By month 12, the organization has six pilots, no scaled deployments, and no clear story for the board.
The discipline that prevents this: pick the decisions you want AI to improve, prioritize them by value and feasibility, and sequence them. Don’t pick the use cases first. Pick the outcomes first.
The Risks Worth Your Attention
Here are the risks to watch out for:
Data leakage into commercial LLMs.
Employees pasting proprietary data, customer information, or source code into consumer-tier AI tools is probably happening at your company right now. It is the single most common AI risk realized in 2024–2026. Enterprise-grade subscriptions with proper data controls are the mitigation, which is part of why Recommendation 1 exists.
Regulatory exposure.
The EU AI Act, sector-specific rules in finance and healthcare, and emerging US state laws are creating compliance obligations that did not exist when most current AI projects were scoped. Programs scoped without legal review are common landmines.
Liability for AI-generated outputs in customer-facing contexts.
Your AI agent told a customer something wrong, expensive, or actionable in court. Who is liable, how do you prove what was said, and what is your recourse against the model vendor? Most organizations have not answered these questions.
Model deprecation and vendor lock-in.
The model your Level 2 system was built around will be deprecated, often with months of notice rather than years. Architectures that assume a specific model version produce expensive forced migrations. Architectures should abstract the model layer even it if costs more upfront to get ahead of this risk.
Quality drift.
Models update. Behavior changes. The system that worked last quarter behaves differently this quarter. Production AI systems need ongoing evaluation, not just initial validation.
Hallucinations.
Yes, also this. Mitigated mostly by retrieval grounding and human-in-the-loop review, both of which are governance choices, not technology choices.
Why Senior Leaders Should Care
The strategic implications come down to a few non-negotiables:
- The starting cost is low; the wrong starting cost is high, and not starting at all can become the nail in the coffin. An enterprise license for a commercial LLM is rounding error compared to a multi-million-dollar customer-facing AI program built on broken data.
- Workflow redesign is the dominant variable. Tools without process change produce marginal returns regardless of which level of AI you deploy.
- The risks that get publicized are not the risks that most often realize. Hallucinations were the early headlines, but now data leakage, regulatory exposure, and vendor lock-in are the actual ones to watch.
- AI literacy is a precondition for AI strategy. Leaders who have not used these tools personally cannot effectively govern programs that deploy them.
- The right sequencing depends on your business. Don’t take a generic playbook, including this one, without translating it to your context.
You do not need to have it all figured out. You need to start smart and start now.
Start Your AI Journey with McLean Forrester
The question that brought you here, “Where do I start with AI for my business?” starts with literacy this quarter. Then design a sequenced program around the decisions in your business that AI is most ready to improve, with workflow redesign treated as a main goal.
McLean Forrester works with senior leaders on exactly that sequencing, including the parts that don’t show up in the demo. If you want a candid conversation about where your organization actually is, what is worth doing first, and where the realistic risks live, we would love to have a chat.
Let’s start the conversation: info@mcleanforrester.com
