AI strategy: from scattered pilots to measurable results

Most businesses now use AI somewhere, but ask what it has done for profit and the answers get vague. In McKinsey's global survey, nearly nine in ten respondents reported regular use of AI in at least one business function, while 37% attributed at least some impact on operating profit (EBIT) to it (source: McKinsey, August 2026).

The same survey describes a small group of high performers, about 6% of respondents, who attribute 5% or more of EBIT to AI (source: McKinsey, August 2026). They redesign workflows around AI instead of inserting it into existing ones, and more often have a defined way to measure its impact. An AI strategy starts where your business earns or loses money, not with the tools.

How widely do businesses use AI?

Size matters. In 2025, 17% of small EU enterprises used AI technologies, against 55.03% of large ones (source: Eurostat, December 2025). For a smaller business the useful question is which competitors use AI on the work your customers pay for.

Why AI use often produces so little

• No baseline: without a measurement beforehand, nobody can tell what a tool saved.
• Time saved that evaporates: an hour gained only counts if it goes to other work.
• Gains that go to the customer: if you bill by the hour, every efficiency gain lowers your invoice.
• AI on side issues: a clever fix for a minor process does not move profit.

Six questions for the management team

Does AI touch our business model?

Which of your services could a customer, competitor or new entrant do faster, cheaper or themselves with AI? For some it is a productivity tool; for others it attacks the revenue model. The Business Model Canvas shows which building blocks are exposed.

Where is the productivity?

Look for repetitive work such as proposals and first-line questions. Use the value chain to pick activities where saved time turns into money or capacity. Where staff are scarce, freed time is often worth more than saved cost; see talent and labour shortages.

Which data do we have?

Anyone can buy a standard model. The difference comes from your own data: customer history, quotes, prices, claims. The VRIO test shows whether it is an advantage or an archive.

Build, buy or partner?

Buy for generic tasks. Building or partnering pays where AI touches what sets you apart and you can keep the knowledge in house. Watch dependence on one vendor, a form of supply chain risk.

How do we govern it?

Decide who approves new tools, which data may go in and who checks the output before it reaches a customer. The voluntary AI Risk Management Framework of the US National Institute of Standards and Technology is built around four functions: govern, map, measure and manage (source: NIST, January 2023).

What does it mean for our people?

Look at tasks, not jobs: which tasks shift, who needs to learn what, and how you bring worried employees along. In the EU, supporting their AI literacy is also a legal duty.

What does the EU AI Act require?

The EU AI Act entered into force in August 2024 and applies in phases (source: European Commission, October 2026). It regulates AI by risk: the higher the risk of a use, the stricter the rules. What counts is the use and your role, not the size of your business.

• Providers: place an AI system on the EU market or put it into service, wherever they are established.
• Deployers: use an AI system in their work and are established or located in the EU. Most smaller businesses are deployers.
• Outside the EU: providers and deployers are covered when the output of their AI system is used in the EU. Purely personal, non-professional use is not covered.

Based on the European Commission's summary of the AI Act. Separate rules apply to providers of general-purpose AI models.

One duty reaches almost every business using AI: providers and deployers must take measures to support the AI literacy of their staff. The Digital Omnibus on AI, Regulation (EU) 2026/1744, clarified that this does not mean guaranteeing a specific level for each person (source: EUR-Lex, July 2026). In practice: know which tools are in use, agree rules and train people.

Timeline as published by the European Commission's AI Act Service Desk, consulted October 2026. The Digital Omnibus on AI moved both high-risk dates later.

Small businesses are covered too, with measures to ease the burden on SMEs that the Digital Omnibus extends in part to small mid-cap companies (source: EUR-Lex, July 2026). Other jurisdictions take different routes. In its white paper the UK government chose not to legislate at first and to let existing regulators apply five cross-sector principles, such as transparency and fairness (source: GOV.UK, March 2023). In the US, the NIST framework is voluntary guidance, not law. Check the rules in every market where your AI or its output is used.

From scattered pilots to an AI strategy in six steps

1. 01

   Map your revenue model

   Where does revenue come from, and what does AI make cheaper for customers and competitors?

2. 02

   Take stock of current use

   List which AI tools employees already use, for what and with which data.

3. 03

   Choose a few uses with measurable value

   Two or three, each with a baseline: hours, lead time, errors or revenue per employee.

4. 04

   Set rules for governance and data

   An owner, data rules per tool, a check on output and training for the AI literacy duty.

5. 05

   Choose build, buy or partner

   Buy for generic tasks; build or partner where your own data and knowledge make the difference.

6. 06

   Measure, scale or stop

   After a quarter, compare with the baseline and record what happened to the freed time. Scale what works, stop the rest.

Worked example: a mid-sized insurance broker

Halden Brokers is a fictitious broker with 35 staff and €4,200,000 revenue. It arranges insurance, handles claims and advises business clients on risk. Commission, its main income, rewards volume rather than time.

Fictitious Firmfocus example. Amounts in euro; the logic works in any currency.

• Revenue model: time saved only pays if it moves to work clients pay for, so Halden charges a fixed annual fee for risk advice.
• Capacity: renewals take about 6,000 hours a year, and the pilot showed AI saves a third, or 2,000 hours. Half goes to risk advice at €110 an hour, worth €110,000 a year or about 2.6% of revenue. The other 1,000 hours, two-thirds of a full-time role at 1,500 productive hours, absorb growth without hiring.
• Governance: rules on which tools may process client data, a check on every AI output that reaches a client, training for everyone, and no AI screening of job applicants before the high-risk rules are checked.

Small business or larger organisation

AI is one of six strategic themes; every other topic is under Strategy.