AI ATLAS · REQUIREMENTS · OPTIONS · EVIDENCE

Enterprise AI Adoption & Decision Map

Choose a delivery approach from the work, constraints and evidence—not from a preferred product.

Original guidance curated by Ravikumar Sathyamurthy · Source review: 13 October 2026

Decision explorer Technology examples Validation & references

Enterprise AI adoption mind map showing five alternative or complementary paths: adopt existing, configure or extend, build custom, combine approaches, and defer or use conventional automation. Data, security, evaluation, cost, ownership and experience apply across every path. — View mind map at full size · Download image

Listen: how to use both adoption routes

This updated narration introduces the five adoption paths and walks through both “Help me get started” and “Assess an enterprise use case”. It explains the questions, how to read your result, what still needs checking and the next step to take. Listen once for an overview, then choose one task and pause the audio as you follow your preferred route. If you are unsure, use the unconfirmed options rather than guessing; use the result to support a discussion, not as approval to buy or build.

Full guide · approximately 8 minutes 50 seconds

Download the narration · Go to the decision explorer

What outcome must the organisation achieve?
Business value · Required capabilities · Mandatory controls · Sustainable operations

These are alternative or complementary paths. Buying, extending and building can coexist. Custom development does not require training a foundation model.

Find an approach that fits your task

Start with one task. Beginners and leaders can use the guided route; use the enterprise assessment when you have evidence about requirements and readiness.

Choose general answers—no company information is needed. “I’m not sure” is a useful answer. This route helps you plan your next check; it cannot confirm that a product is suitable.

What would you like help with?Pick the closest task. “Specialised” means a specific business experience, not automatically a custom build. What information would it need?Company documents, employee details and customer records need approved access and data handling. Public information still needs accuracy checks. Should it only suggest, or also take action?Drafting an email is assistance. Sending it or changing a record is an action, which needs permissions and appropriate approvals. Have you tried an available tool for this task?An impression is not validated fit. Record what you tested and the exact missing capability before choosing an approach.

How to use the enterprise assessment

Answer the six questions for one use case. Choose unconfirmed options where evidence is missing. Discuss the result with the process, data, security, technology and budget owners. It is not procurement or deployment approval.

Primary outcomeWhat do you want to improve?
Employee productivity: help people write, summarise or analyse. Business process automation: move a task through steps, such as handling requests. A distinctive application: deliver a specific customer or business experience. Operate and govern AI: manage access, risk, costs and support across tools.Fit of available solutionsHave you checked whether an available tool can do the job?
Not yet assessed: you have not tested options. Validated: an available solution meets every essential need, including required controls. Core fits: it works for the main task but needs configuration or integration, such as approved company knowledge. Critical gap: a must-have need remains unmet after assessment—not simply a preference for a different design.Nature of the workDoes the task follow fixed steps or need flexible judgement?
Drafting or advice: a person uses and checks the answer. Stable rules: steps are known, such as routing a request using defined fields; ordinary automation may be enough. Variable steps: the next action depends on the situation, such as investigating an unfamiliar issue using several tools. Flexible work does not automatically require an autonomous agent.Data and mandatory controlsIs using AI with this information and task allowed?
Not validated: the relevant owners have not checked it. Approved: data and security owners have confirmed the proposed use and controls. Cannot be met: a compulsory condition remains unresolved, such as an approved storage region, access restriction or required human approval. Sensitive data alone does not mean AI is prohibited; the permitted use must be assessed.Implementation and ongoing ownershipWho will run and support it after launch?
Not confirmed: responsibility, skills or funding are unclear. Confirmed: named owners and adequate resources cover operation, support, updates and costs. Cannot support: ongoing ownership is unavailable. Buying a product still needs an owner; a custom solution usually needs engineering support as well.Evidence of business valueDo you have evidence that it is worth doing?
Hypothesis: you expect a benefit but have not measured it. Measured benefit: a trial compared results with today’s process and showed acceptable value. Not justified: costs or risks outweigh the benefit. Consider quality, task completion, user experience and support effort—not just time saved.

People who support AI adoption

Four supporting responsibilities: business ownership, technical support, user adoption and governance.

These responsibilities can sit within existing teams or be supported by qualified partners. Match the technical skills and support capacity to the approach you choose.

Different technology roles—not interchangeable products

Examples illustrate what a path can use. Validate exact features, licensing, region, lifecycle status and data terms directly with the vendor.

Evidence required before committing

Define success: document the task, users, baseline, expected value, critical capabilities and unacceptable failure modes.
Verify fit: test existing options against mandatory requirements. Record the precise gap before commissioning development.
Check applicable laws: assess whether the EU AI Act and other relevant requirements apply to the use case, organisational role and deployment context. Review current obligations and applicable dates with legal or compliance owners. NIST provides risk-management guidance; it is not a substitute for applicable law.
Validate controls: permission-aware access, residency and retention, contractual training use, audit, human approvals, safe actions and incident response. Use ISO/IEC 27090 guidance to assess AI-specific security threats, including data poisoning and model theft, alongside established security controls. Check who can operate the service, where data is stored and processed, and whether critical work must continue without internet connectivity. Confirm these requirements before selecting a deployment.
Pilot representative work: evaluate successful task completion, factual accuracy, failure handling, accessibility, latency and support demand. Synthetic or approved test data only.
Compare whole-life cost: licences, consumption, integration, evaluation, support, change management, maintenance and exit costs. Include the impact on employee productivity.
Assign ownership: business sponsor, platform/service owner, security and data owners, commercial oversight, rollback criteria and review dates.

Atlas companion guidance: AI ecosystem · AI costs & FinOps · Licensing & value · Digital Workplace

Official source register

The decision rules are our editorial synthesis. Vendors document their own offerings; they do not endorse this map. No customer case-study content or third-party diagrams have been reused.