AI Operating Model: The Mid-Market CEO's Playbook for Moving Beyond Pilots

Adoption is no longer the constraint. The Stanford HAI AI Index reports that the proportion of surveyed organisations using AI jumped to 78% in 2024 from 55% in 2023, and McKinsey's 2026 survey finds that 44% of respondents say AI is now scaling across their enterprise, up from 38% a year earlier. Scaling, however, is not the same as value. McKinsey also finds that 37% of respondents attribute at least some EBIT impact to AI, about the same share as the year before, and that AI high performers remain just 6% of respondents.

BCG's September 2025 research frames the gap more bluntly. It classes 5% of companies as future-built, 35% as scalers that are beginning to generate value, and 60% as laggards reporting minimal revenue and cost gains. Those proportions describe a management problem rather than a technology problem. The tools are available to everyone at similar prices. What differs is whether a company has decided who owns AI, what it will fund, how it will measure results and what it will stop doing.

For a mid-market chief executive, the implication is uncomfortable. Scattered experiments, each sponsored by a different function and paid for from a different budget, create enthusiasm and anecdotes but rarely an income-statement effect. Deloitte's survey of 3,235 leaders in 24 countries found that only 25% have moved 40% or more of their AI pilots into production. If three companies in four cannot get four in ten pilots live, the issue is not a shortage of experiments. It is the absence of a mechanism that decides which experiments graduate.

Europe adds a particular reason to be disciplined. Many mid-sized European firms operate across several jurisdictions, languages and employee-consultation arrangements, so a decision to automate a step in one country is rarely a decision for the whole group. That raises the coordination cost of every pilot and lengthens the path from trial to routine use. A single owner and a short list of cases cut that cost sharply, because every country manager is negotiating one agenda rather than a dozen.

The cost of drift is easy to underestimate because it is spread thinly. Licences accumulate under departmental budgets, external advisers and contractors build prototypes that nobody maintains, and staff use unsanctioned tools because the sanctioned route is slow. None of this appears as a line in the plan, yet each element consumes management time, creates data and security exposure, and makes the eventual rationalisation harder. A modest amount of structure introduced early costs far less than the clean-up that follows a year of unmanaged enthusiasm.

What to do: before approving another pilot, ask for an inventory of every AI initiative in the business, including those bought as features inside existing software. For each, record the sponsor, the annual cost, the data it touches and the measurable outcome it targets. Most mid-sized companies discover that the list is longer than expected and that nobody has read it end to end. That discovery is the beginning of an operating model, and it takes two to three weeks, not a quarter.

Europe's official statistics show how recent and uneven this adoption is. Eurostat reports that 20.0% of EU enterprises with ten or more employees used AI technologies in 2025, up from 13.5% in 2024. In 2023 the figure was 8.1% and in 2021 it was 7.7%. Use has more than doubled in two years, which explains why so many boards feel they are already late, and why the pressure to be seen to act has produced a rash of disconnected pilots.

The distribution matters more than the average. Eurostat's size breakdown shows that 17% of small enterprises, 30.36% of medium enterprises and 55.03% of large enterprises used AI in 2025. Country spread is wider still: Denmark recorded 42.03% against 5.21% in Romania. A mid-market company is therefore competing in a market where the largest rivals have usually crossed the threshold from trial to routine use, while many peers have barely started.

Large firms are also pulling ahead on agents. McKinsey reports that 40% of respondents from large organisations are scaling AI agents, up from 27% a year earlier. Large organisations have central data teams, procurement muscle and the ability to absorb failed projects. A mid-sized company has none of those buffers, which is why copying a large-company programme, with its centre of excellence and its dozens of use cases, is usually the wrong template.

Sector matters as well. A manufacturer with plant data, a distributor with transaction histories and a professional-services firm with documents and know-how face different first cases and different risks. Country and sector averages are useful context but poor targets. We suggest the board look at the three or four rivals it actually meets in tenders and negotiations, and ask where each is visibly using AI in front of customers: in pricing, in speed of response or in cost to serve. That picture is more actionable than any national statistic.

The mid-market has one structural advantage: a short chain of decision. A chief executive can place one person in charge, redirect a budget in a week and reorganise a process without a multi-year change programme. What to do: benchmark your sector and country honestly against the Eurostat size classes, decide whether you are trying to catch up or to leapfrog, and use the speed of your decision-making as the explicit basis of the plan.

The first design choice in an AI operating model is ownership. McKinsey finds that AI high performers are twice as likely as others to say that their senior leaders demonstrate commitment to AI initiatives, and twice as likely to report defined processes to measure the impact of those initiatives. Commitment and measurement are both properties of leadership attention, not of tooling. They are very hard to sustain when AI belongs to everyone, which in practice means it belongs to no one.

The accountable executive does not need a new title, and for most mid-sized companies a new hire would be premature. The role can sit with the chief operating officer, the chief financial officer, the chief technology officer or a business-unit head, provided that person holds three powers: control of the AI budget, the right to require data and process access from other functions, and the authority to stop a project. Without the third power, the portfolio only grows.

Beneath that executive, the structure can be light: a small group that curates data and tooling, a named business owner for each funded case, and a risk reviewer from legal or compliance. Deloitte reports that only 21% of companies planning agentic AI have a mature model for agent governance, which suggests that most organisations have not yet decided who answers for what an agent does. That decision is cheaper to take before deployment than after an incident.

A common failure is to give accountability to a committee that meets quarterly. Committees are useful for risk review and for sharing practice, but they dilute ownership of value. The executive should chair the monthly portfolio review personally, and the business owner of each case should present their own numbers. When the finance director signs off the baselines and the realised benefits, the figures acquire the credibility the board needs in order to trust them and move budget accordingly.

What to do: write a one-page mandate for the accountable executive. It should state the value target for the next twelve months, the budget under their control, the decisions they can take without committee approval, and the date on which the board will review the results. Publish it to the leadership team. If the mandate cannot be written in a page, the role is not yet clear enough to work.

Budget is where an operating model becomes real. McKinsey reports that 28% of respondents spend more than 10% of their enterprise-wide budget on AI, measured against ICT spending, and that about 20% say AI-related operating costs, including token costs, have constrained their AI use. Spending is rising, but so is the discipline required to control it. A company without a portfolio view cannot tell which spend is producing returns and which is simply recurring.

Our recommendation is a portfolio of three to five value cases, each with a business owner, a baseline, a target, a budget and a stage-gate calendar. Three to five is not a magic number. It is the range a mid-sized leadership team can actually review every month while still covering more than one function. BCG's finding that 70% of AI's potential value is concentrated in core business functions supports choosing cases in revenue, service, operations and finance, rather than in peripheral convenience tools.

Every case needs a kill rule agreed in advance: if the measured outcome is not within an agreed range at the second stage gate, the case is closed and the budget returns to the pool. Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls. Cancellation is going to happen anyway; the choice is whether it is planned and cheap, or late and expensive.

Funding should be staged rather than allocated annually in a lump. Release a small discovery budget to test feasibility and data availability, a larger build budget once the baseline and the owner are confirmed, and a scale-up budget only when the measured outcome meets its target. This pattern mirrors venture funding, and it suits AI because the cost of a wrong early assumption is small while the cost of scaling a weak case is large. It also gives the accountable executive natural moments at which to say no.

What to do: score each current initiative against value, feasibility, data readiness and risk, and place the results on the triage matrix shown below. Fund the best three to five, fold duplicates into them, and write a stop date next to everything else. Present the list to the leadership team as a decision, not a discussion. The first stop decisions are the hardest, and they are what give the remaining cases credibility with the organisation.

Technology that is dropped into an unchanged process rarely changes the economics of that process. McKinsey finds that nearly three-quarters of high performers fundamentally redesign workflows. Deloitte's survey is consistent: only 30% of organisations are redesigning key processes around AI, and 37% use AI only at a surface level. The companies capturing value are changing how work is done, who does it and what is checked, not simply adding an assistant to the existing flow.

This is the part of an operating model that most resembles ordinary change management, and it is the part most often skipped. A value case that targets, say, quote-to-cash or customer onboarding must specify the new process step by step, name the process owner, define where humans review and approve, and decide what happens to the capacity released. If the freed capacity is not redeployed or removed deliberately, the saving evaporates into the working day.

The case for choosing core processes is reinforced by BCG's analysis that 70% of AI's potential value sits in core business functions. For a mid-sized company, those functions are usually where the P&L is decided: pricing and quoting, sales follow-up, customer service resolution, procurement, finance close and production planning. They are also where domain experts are scarce and where documented knowledge, if captured, is a lasting asset.

People issues deserve explicit treatment. McKinsey reports that 37% of respondents attribute some EBIT impact to AI, which implies that most organisations cannot yet show employees a profit effect they can see. Without visible benefits, workers experience AI as extra monitoring or extra checking. Involving the team that performs a process in its redesign, and being clear about how released time will be used, is usually the most effective protection against quiet resistance and workarounds.

What to do: for each funded case, hold a two-hour working session with the people who do the work today. Map the current process, mark the steps where AI can draft, check or decide, and agree the controls. Pilot the redesigned process end to end in one team before extending it. Measure cycle time, error rates and cost per transaction against the baseline, and report them monthly in the portfolio review.

Agentic AI is moving from demonstration to deployment faster than most governance. BCG reports that agents already account for 17% of total AI value in 2025, and expects that share to reach 29% by 2028. A January 2025 Gartner poll of 3,412 webinar attendees found that 19% had made significant investments in agentic AI, 42% conservative investments and 8% none, while 31% were taking a wait-and-see approach or were unsure. The market is early and divided.

Early markets attract inflated claims. Gartner's warning that over 40% of agentic AI projects will be cancelled by the end of 2027 is a reminder that agents carry operating costs, error modes and security exposures that pilots do not reveal. An agent that acts on customer records or issues payments needs an owner, a permission model, logging, a human override and a cost cap. These are operating-model features, and they belong in the mandate of the accountable executive.

Regulation adds a date-driven layer. The European Commission states that the AI Act became applicable on 2 August 2026, with some exceptions, and that high-risk AI systems will be subject to strict obligations from 2 December 2027 following the AI Omnibus. We are not a law firm, and companies should take legal advice on classification. But the operating model should already contain a register of AI systems in use, a risk tier for each, and a named person who answers regulators and customers.

Cost control is the other half of governance. McKinsey's finding that about 20% of respondents saw AI operating costs constrain their AI use is a signal that tokens, usage-based pricing and agent loops can move spend faster than budgets. Set a monthly cost ceiling for each funded case, require usage to be tagged by case, and review unit costs, such as cost per resolved ticket or per processed document, alongside value. An agent that is cheap in testing can become expensive when it is called thousands of times a day.

What to do: build the register now from the inventory you created in the first step, tag each system by risk and by data sensitivity, and set approval rules for agents that act without a human in the loop. Start with low-risk, reversible tasks such as research, drafting and reconciliation, and move to higher-stakes actions only when logs show the controls working. Report agent incidents and cost overruns to the board as routinely as security incidents.

An operating model is proven by its rhythm, not its design. In the first thirty days the chief executive appoints the accountable executive, issues the mandate and commissions the inventory. By day sixty the leadership team has scored the portfolio, chosen three to five value cases, set baselines and targets, and published the stop list. By day ninety the first redesigned workflow is running in one team with measurement in place.

Between days ninety and one hundred and eighty the model establishes its cadence. A monthly portfolio review looks at value delivered, spend, risks and stage-gate decisions. A quarterly board update shows the same data in a single page. The first stage gate arrives, and at least one case is expected to be closed or reshaped. If no case is stopped in the first six months, the kill rule is probably not being applied, and the portfolio is being protected rather than managed.

Talent and data should follow value, not lead it. Training should be targeted at the people who own and run the funded cases, supplemented by a short common literacy programme for everyone else. Data work should be limited to what the funded cases require. A company that tries to fix all of its data before starting will wait years; a company that fixes the data each case needs will have a growing, reusable base within a year.

The board's role is to ask for evidence, not to admire activity. Three questions are enough at each quarterly review: what value was delivered against the baseline, what was stopped and why, and what risks or incidents arose. If management cannot answer them from portfolio data without preparing a special report, the operating model is not yet working. Boards that ask these questions consistently tend to find that management begins to organise itself around the answers.

What to do: put the six moves in the exhibit below on one page, assign a date and an owner to each, and treat the 180-day review as the point at which the operating model is either confirmed or redesigned. The goal is not a perfect structure. It is a repeatable routine in which AI spend is tied to measured outcomes, owned by named people and reviewed by the executive team.

Karter McKinley's Strategy & Transformation work supports leadership teams in setting up the mandate, portfolio and governance described here, and in running the first stage-gate reviews alongside management. We work from your own inventory and targets, and we do not assume a particular vendor or architecture.