AI spending is rising fast. CFO’s want forecasts and budgets. Vendors promise productivity gains, operational insight, lower costs, faster decisions, and entirely new ways of working.
Most enterprises are still trying to work out what any of that actually means in practice.
Across many organisations, AI adoption has moved ahead of governance. Procurement teams are signing agreements before architecture standards are settled. Business units are rolling out copilots and assistants independently. Pilot projects are multiplying while very few are tied to measurable operational outcomes.
That creates risk. Enterprises are building long-term dependency into systems they barely understand yet.
The current AI market feels familiar to anyone who has lived through earlier enterprise technology cycles. Early excitement drives aggressive adoption. Vendors compete to become the dominant platform. Buyers accept opaque pricing because they do not want to miss the opportunity. Questions about operating cost, portability, governance, and long-term resilience get pushed into the background.
At some point, market conditions tighten. Costs surge. Budgets become harder to justify. Boards start asking tougher questions. Procurement teams revisit contracts that were signed during the rush phase. Suddenly every AI investment needs to prove its value.
That moment is coming.
The important question for CIOs is whether the organisation is building an AI ecosystem that can survive changing economics, vendor consolidation, and growing scrutiny around ROI.
Right now, most are not.
The Problem Is How Enterprises Are Buying AI Today.
A surprising number of AI programmes are still operating like disconnected experiments rather than coordinated enterprise capabilities.
Different departments are buying different tools. Security reviews vary widely. Some teams are using public models with sensitive internal information. Others are paying for premium subscriptions that nobody is tracking centrally. Procurement often has little visibility into how AI services are actually being consumed after the contract is signed.
Under light usage and early experimentation, those weaknesses stay hidden.
Scale changes the picture.
A pilot chatbot serving twenty internal users may cost very little. Connect the same system into enterprise search, document retrieval, workflow automation, and agent-based orchestration, and the economics change quickly. Token consumption rises. Context windows get larger. Retrieval systems add infrastructure overhead. Premium reasoning models become the default because users prefer better outputs.
No organisation has reliable ways to forecast those costs. The technology is too new.
Gartner has repeatedly noted that enterprises are struggling to move generative AI projects from experimentation into measurable business value.[1] McKinsey research shows similar patterns. Adoption rates are high. Scaled financial impact is much harder to find.[2]
CIOs are increasingly being asked to defend AI investment using normal business disciplines rather than innovation narratives.
Nobody gets unlimited runway forever. The investment phase is ending for vendors and enterprise consumers of AI alike.
Vendor Lock-In Is Becoming the Real Strategic Risk
Most enterprise buyers still think about AI procurement as tool selection. That mindset is already outdated.
What enterprises are really buying is dependency.
Large AI vendors are competing to become the operational layer inside the enterprise. Once workflows, knowledge systems, internal search, collaboration patterns, and automation pipelines are built around a particular ecosystem, switching becomes difficult and expensive.
This lock-in goes well beyond infrastructure.
Prompts become embedded in workflows. Teams adapt operating processes around specific model behaviour. Retrieval systems depend on proprietary connectors. Internal knowledge bases are structured around a vendor’s orchestration layer. AI assistants become tied into productivity suites that employees use all day.
After enough integration work, replacing the underlying AI provider becomes a major migration project.
That shifts the balance of power from buyer to vendor.
Many organisations learned this lesson during ERP adoption. AI may accelerate the problem because the dependency reaches further into operational decision-making and knowledge work.
Some CIOs are already discovering another issue. The portability of AI assets is often poorly defined in contracts. Enterprises may own their data but not necessarily the surrounding implementation logic, orchestration structures, fine-tuning configurations, or workflow frameworks.
That becomes important when pricing changes or strategic direction shifts.
AI Procurement Needs a Different Approach
Most procurement processes are still built around traditional enterprise software assumptions. AI does not behave like normal software.
The cost structure changes continuously. Model capability changes continuously. Vendors release new versions constantly. Consumption patterns are difficult to forecast early on. Small architectural decisions made during pilots can create long-term constraints.
Procurement teams need to shift from buying products to designing ecosystems.
That starts with modular thinking.
Where possible, enterprises should avoid tightly coupling business processes to a single model provider. Ideally, the orchestration layer should be separated from the underlying models. APIs should be standardised. Workflows should allow for multiple model options where practical.
Pricing transparency also matters far more than many organisations realise.
AI pricing can become opaque very quickly:
- token consumption
- retrieval costs
- context window pricing
- storage charges
- premium model tiers
- fine-tuning fees
- agent execution overhead
- API rate scaling
Without careful oversight, enterprises can drift into cost structures that are difficult to predict and even harder to optimise.
Procurement teams should push hard for visibility into:
- expected consumption models
- upgrade pricing assumptions
- portability rights
- data export capability
- migration support obligations
- ownership of prompts and workflows
Those discussions are often uncomfortable during fast-moving adoption phases. They become much more uncomfortable later if they are ignored.
Many AI Governance Models Are Too Narrow
When organisations talk about AI governance, the discussion usually centres around privacy, security, ethics, and legal review.
Enterprise AI governance however also needs to cover economics, architecture, operational accountability, and lifecycle management.
A governance model that only reviews compliance risk will miss major strategic exposure.
For example:
- Who decides which models are approved for which tasks?
- Who tracks whether expensive models are being used unnecessarily?
- Who measures operational value?
- Who owns rollback decisions when a model update affects quality?
- Who governs prompt libraries and reusable workflows?
- Who monitors shadow AI adoption?
Many organisations do not yet have clear answers.
The NIST AI Risk Management Framework provides a useful starting point because it treats AI risk as an operational issue rather than a once-off compliance exercise.[3]
In practice, effective AI governance usually needs four broad capabilities.
The first is strategic oversight. Somebody needs visibility into the entire AI portfolio across the business. Otherwise duplication becomes inevitable. Different teams end up solving the same problem repeatedly using different tools and different contracts.
The second is technical governance. Enterprises need architecture standards, observability, model monitoring, version control, and integration discipline. AI systems cannot be treated as isolated productivity tools once they begin influencing operational workflows.
Economic governance is becoming equally important. AI spending behaves differently from conventional enterprise licensing. Consumption can rise rapidly without obvious warning signs.
Human governance remains critical throughout all of this. AI outputs still require critical review, especially in engineering, industrial operations, finance, healthcare, and regulated environments where incorrect outputs can carry operational consequences.
The organisations getting the best results from AI are usually the ones treating it as an assistant layer around professional expertise rather than a replacement for judgement.
Some AI Strategies Are More Fragile Than Others
A market correction would expose weaknesses very quickly. This bubble too will burst.
Single-vendor dependency sits near the top of the list of risks.
If core workflows rely entirely on one provider, pricing changes or service disruptions become enterprise-wide operational risks. The same applies when productivity tooling, orchestration, and knowledge retrieval are deeply tied into one ecosystem with no fallback capability.
Cost exposure is another major weakness.
Many enterprises still lack detailed visibility into AI consumption. Autonomous agents create additional uncertainty because they can generate significant compute activity without obvious human interaction. Premium models often get used for low-value tasks simply because they produce better responses.
That may be tolerable during experimentation. It becomes difficult to defend at scale.
Weak governance maturity creates another category of exposure. Shadow AI is already widespread in many organisations. Teams adopt tools independently because central processes move too slowly or because governance frameworks have not kept pace with demand.
Boards eventually notice when critical systems and sensitive workflows are operating outside formal oversight.
There is also a softer but equally important problem. Some AI programmes still cannot explain what business outcome they are trying to improve.
Activity metrics dominate many discussions:
- number of users
- number of prompts
- number of pilots
- number of assistants deployed
Those are not business outcomes.
A CIO defending AI investment during budget pressure needs operational evidence:
- reduced cycle times
- improved throughput
- lower support burden
- higher quality outputs
- reduced rework
- faster access to institutional knowledge
Without that connection, AI programmes have questionable value.
The Organisations Doing This Well Are Taking a More Disciplined Approach
The stronger enterprise AI strategies share a few common characteristics.
- They treat AI as infrastructure rather than novelty.
- They centralise standards without blocking experimentation.
- They separate experimentation from operational deployment.
- They monitor economics continuously rather than annually.
- They focus heavily on workflow fit instead of chasing the newest model release.
- Most importantly, they remain cautious about over-automation.
There is growing evidence that users can become overly reliant on AI-generated outputs, particularly when systems appear authoritative.[4] In engineering and operational environments, that creates real risk. Confident language can mask weak reasoning or incorrect assumptions.
Human review therefore remains essential.
The most effective organisations are training staff to work with AI critically:
- validate outputs
- challenge assumptions
- compare against source data
- understand model limitations
- recognise hallucination risk
That mindset matters far more than prompt tricks or model comparisons.
What CIOs Should Do Next
The first step is visibility.
Most organisations need a proper inventory of current AI usage:
- vendors
- subscriptions
- business owners
- integrations
- data exposure
- workflow dependencies
- operational use cases
Many CIOs will discover far more AI adoption than they expected.
Contract reviews should follow quickly after that. Procurement teams need to understand:
- exit rights
- portability clauses
- data ownership
- pricing escalation risk
- migration obligations
- model dependency exposure
Those discussions are easier before deep operational dependency forms.
Governance frameworks should then move beyond compliance checklists into operational management. As AI systems move from experimentation into “production”, they will need lifecycle oversight, cost monitoring, architecture standards, and clear accountability structures.
At the same time, enterprises should begin separating experimental AI initiatives from operational AI services.
Not every pilot deserves enterprise rollout.
Some use cases are valuable learning exercises. Others justify scaled investment because they deliver measurable operational benefit. Those categories should not be treated the same way.
Over the longer term, the organisations with the strongest position will probably not be the ones with the largest number of AI workflows.
They will be the organisations with:
- strong internal knowledge structures
- disciplined governance
- clean operational data
- adaptable architecture
- technically informed leadership teams
Model capability will continue changing rapidly. Vendors will continue consolidating. Pricing structures will evolve. Regulation will increase. None of that is likely to slow down.
Flexibility matters more than prediction.
Final Thought
AI clearly has enormous potential inside the enterprise. That part is real.
The problem is that hype cycles encourage organisations to optimise for speed of adoption instead of quality of implementation. During the rush phase, weak governance, poor procurement discipline, and fragile architecture decisions are easy to ignore.
Those weaknesses become visible later.
CIOs do not need to slow AI adoption to build resilience. They do need to become much more deliberate about how AI systems are procured, governed, integrated, and measured.
The organisations that come through the next phase strongest will not necessarily be the earliest adopters.
They will be the ones that stayed disciplined while everyone else was moving fast.
References
[1] Gartner research on generative AI ROI and enterprise adoption trends, 2024–2025. https://www.gartner.com
[2] McKinsey & Company, “The State of AI” research series, 2024–2025. https://www.mckinsey.com
[3] National Institute of Standards and Technology (NIST), “AI Risk Management Framework (AI RMF 1.0),” January 2023. https://www.nist.gov/itl/ai-risk-management-framework
[4] Research into AI-assisted cognition and over-reliance on AI-generated outputs referenced in human-AI interaction studies and enterprise AI enablement discussions. (Technical Leaders internal content)
