What an AI strategy settles
An AI strategy answers four questions: Which tasks do we take on first? Which technology fits them? How do we handle data and risk? Who owns it? Microsoft's Cloud Adoption Framework breaks this into five building blocks: use case identification, a technology strategy, a responsible AI strategy, a data strategy and how to adopt AI (Microsoft Learn, accessed October 11, 2026). The seven steps below put those blocks into an order.
The roadmap in seven steps
1. Choose the first use case
Start with a task, not a tool. A task is a good first candidate if it repeats often, a person can check the result, the data is already digital and someone in the company wants the benefit. Tasks that call for a lot of judgment are a weaker start: there, the software prepares the groundwork and a person decides.
2. Map the current workflow
Walk through the workflow with the people who do it today. Where does the data come from, where does it go, where does work wait? That includes systems, interfaces, the state of the data and the team's AI skills. The AI readiness assessment gives you a structure for doing this ahead of time.
3. Pick the approach
Which approach fits depends on where you start:
- Recurring workflows built on emails, PDFs and data transfer: AI process automation
- AI features in software you already run: AI integration services
- Knowledge in documents that should be findable, with sources: a RAG system
- Confidential data and AI use on personal accounts: a Corporate LLM
Write the decision down so that data protection and IT security can follow it.
4. Settle rules and ownership
Before the pilot, it should be clear who owns the project, which data may go into which tool and which legal obligations apply. Three items belong on the list:
- Usage rules: An AI policy sets out what is allowed.
- Data protection: The GDPR can apply to a company outside the EU, for example if it offers goods or services to people in the EU or monitors their behavior there (Art. 3). If it applies, a provider processing personal data on your behalf needs a data processing agreement under Art. 28. Your organization assesses whether a data protection impact assessment under Art. 35 is required, with advice from its data protection officer where one is designated (GDPR on EUR-Lex).
- EU AI Act: It defines four risk levels. If you do business in the EU, the task is to classify your application and know the transparency duties (European Commission, accessed October 11, 2026). For the frame across the whole company, see our guide to AI governance.
This is not legal advice.
5. Run the pilot on real data
A pilot answers what a concept cannot: does it work with your data, your systems and your people? Decide beforehand how you will measure success, and check every result at first. Loosen the checks only once the run is stable. NIST's AI Risk Management Framework is a useful reference for the risk thinking behind this. It organizes AI risk management into the functions Govern, Map, Measure and Manage and is intended for voluntary use (NIST AI RMF, accessed October 11, 2026).
6. Train the team
A solution nobody understands goes unused or gets used wrong. Plan training that shows what the tools can do, where their limits are and which data may go in. Do it whether or not a rule requires it: this is the step that turns a pilot into everyday work.
7. Manage operations and expansion
After the pilot, operations begin. Someone reads samples, adjusts the solution when systems or rules change and decides which use case comes next. Pick a few metrics for this that you already measured before the pilot, such as the handling time per case or the share of results that need rework.
Common mistakes
Microsoft's Cloud Adoption Framework names three patterns that hold AI efforts back (Microsoft Learn, accessed October 11, 2026): teams experiment a lot and see little return, different parts of the organization build conflicting solutions, and security concerns and low confidence restrict what people are allowed to use. Steps 1, 4 and 6 above address exactly these.
Roles in an implementation
- Sponsor: Management or a department head sets the goal and the budget.
- Process owners: They know the workflow and check the results.
- IT and data protection: They assess systems, interfaces and data flows.
- AI lead: One person pulls the threads together and keeps the list of AI applications in use.
Checklist before the pilot
- The use case is described in one sentence.
- The success measure is set.
- The data needed is digital and its protection needs are known.
- The approach is chosen and documented.
- Owners are named and a usage policy exists.
- Any required data processing agreement is signed and open data protection questions are settled.
- The team knows what is allowed and who approves results.
Sources
All sources accessed October 11, 2026: Microsoft Learn, Cloud Adoption Framework: AI strategy; NIST, AI Risk Management Framework; European Commission, AI Act; Regulation (EU) 2016/679. This guide is not legal advice.