The AI Operating Model
Framework

Most AI strategies focus on what to build — which models to deploy, which use cases to prioritise, which vendors to select. That's necessary, but is it sufficient? The harder and more important question is whether the organisation is designed to make AI work at scale.

Gartner's 2025 research found that only 19% of AI leaders have a strategy fully embedded in their business strategy, and 41% lack widespread participation in their AI programme. McKinsey's analysis of agentic AI adoption points to the same root cause: technology is rarely the bottleneck. Governance gaps, unclear accountability, poor data foundations, and change management failures are.

The AI Operating Model addresses this gap. It draws on published research from McKinsey, Deloitte, Gartner, BCG, MITRE, NIST, and the World Economic Forum, synthesised through my own experience working in organisations to design and embed new operating capabilities. It is not a consulting deliverable — it's a working tool I use and continue to evolve.

The framework organises AI operating model requirements into three conceptual layers. Unlike a checklist or implementation guide, it describes conditions — things that need to be designed, owned, and maintained — rather than tasks to complete once and move on from.

Click any layer to see the components within it.

Most AI strategy guides — including Gartner's excellent reference guide — are structured as execution sequences: Strategize, then Plan, then Execute. That's useful for getting started. But it implies a waterfall that doesn't reflect how operating model components actually work.

Governance, data foundations, talent, and culture aren't things you address in the Execute phase and then stop. They are ongoing structural conditions. If they're not designed and owned properly from the beginning, the technology layer — no matter how good — won't deliver at scale.

The AI Operating Model is organised by conceptual layer rather than execution phase. The strategic layer sets direction and structure. The operational layer delivers capability. The enabling layer sustains it. All nine components operate simultaneously — and all five cross-cutting themes run through every one of them.

It's also built to work in regulated environments. The governance and responsible AI components incorporate the NIST AI Risk Management Framework, EU AI Act risk classifications, the IIA Three Lines Model, and ISO/APQC process standards — not as compliance checklists, but as design inputs that shape how the operating model is built.

The framework synthesises published research, practitioner frameworks, and regulatory standards. I've drawn on these to build a coherent design framework — the synthesis, structure, and design decisions are my own original work, but the intellectual foundations are real and properly acknowledged here. I'm grateful to the researchers and practitioners whose thinking informed mine.