How to build a sustainable AI workflow in your company

Every week I meet companies telling me the same story. Someone on the team started using ChatGPT to write emails faster. Then another person found an AI plugin for Notion. Meanwhile IT blocked access to certain tools for security reasons, and the CEO announced in an all-hands that “AI is a strategic priority.” The result is a chaotic accumulation of individual experiments — no shared architecture, no governance, no measurable ROI.

This article describes the path I use with my enterprise clients to move from that chaotic phase to a structured, sustainable AI adoption. It is not a linear process — organisations skip phases and circle back — but having a map helps you understand where you are and what to do next.

Phase 1 — An honest assessment of the current state

Before introducing any tool, you need to understand what is already happening. In every company I work with there is a layer of shadow AI: tools individuals use without the organisation knowing anything about it. Surfacing these practices is the first step — not to suppress them, but to understand where genuine demand exists.

The instrument I use is an informal audit in three passes: sample interviews (15–20 minutes per person, ten different profiles across functions), an anonymous survey on AI tool usage and perception, and an analysis of the most repetitive processes by department. The output is an opportunity map: where AI can remove low-value work and where, conversely, it risks creating problems if introduced carelessly.

Phase 2 — Define the security perimeter first

The IT team and the DPO must be allies, not obstacles. The problem is that they are often brought in too late — after someone has already shared sensitive data with an external model. The security conversation must happen before the first incident, not after.

For companies handling sensitive data — healthcare, finance, legal, public administration — the choice is not between using AI or not using it. It is between using it in a controlled way or using it chaotically. The concrete options are: cloud-based models with adequate Data Processing Agreements, on-premise deployment on owned infrastructure, or APIs with data non-retention clauses. Each carries different costs and constraints that need to be weighed against the specific use case.

The choice is not between using AI or not. It is between using it in a controlled way or using it chaotically.

Phase 3 — Identify two or three pilot use cases

The destination is not “the company uses AI.” It is “this specific process costs 40% less and produces better results.” To get there you need to start with concrete, measurable, low-risk use cases.

The best candidates for a pilot share certain characteristics: the process is repetitive and well-defined; a reference metric already exists (time, cost, quality); the required data is available and in a usable format; the team involved is willing to experiment. Typical examples include generating first drafts of documents, analysing customer feedback, automatically classifying support tickets, and summarising long reports.

What does not work as a pilot: ambiguous processes where human judgement is irreplaceable; tasks requiring implicit context that is difficult to make explicit; areas where a mistake carries immediate legal or reputational consequences.

Phase 4 — Build internal capability

A sustainable AI workflow does not depend on an external consultant keeping it alive. It requires internal people who understand how it works, how to configure it, and how to correct it when it produces wrong outputs. This competence is not acquired in a two-day course — it is built by doing, failing, and iterating on real cases.

The model that works best is the “distributed centre of competence”: a small group (two to four people) with deeper expertise who act as a reference point for the rest of the organisation. Not a centralised team doing AI for everyone else, but a hub that enables others to do it themselves. The most effective training is anchored to the team’s real processes, not to the generic use cases vendors put in their slide decks.

Phase 5 — Measure, communicate, and scale selectively

After three months of a pilot, the most critical moment is not deployment — it is internal reporting. Results must be communicated credibly, without inflating the numbers to justify future investment. If the pilot worked well, the data speaks for itself. If it worked partially, analysing honestly why it fell short is more useful than pretending a complete success.

Scalability is not automatic. A use case that works for the marketing team does not necessarily work for the operations team. Every expansion requires adapting the workflow, not copying and pasting it. The organisations that scale AI most effectively are those that treat every new use case with the same rigour as the first pilot: a clear hypothesis, a defined success metric, a structured feedback loop.

AI does not transform a company because it is powerful. It transforms it because someone decided how to use it, who is accountable for it, and how the outcome is measured.

The path I have described takes between six months and a year for mid-sized organisations. It is not fast. But it is the time needed to build something that outlasts the initial enthusiasm and survives the first public mistake.