Everyone Is Using AI. Almost Nobody Can Prove It's Working.

Your organization is almost certainly using Artificial Intelligence (AI), but can you say what it is returning? For most mid-market leaders, the honest answer is “no”; they can’t prove AI is driving ROI, and that's the problem.

Executives know they need to adopt AI to stay competitive, and the response has been a surge of ad-hoc tool adoption across departments: intense excitement and effort, albeit disconnected systems, unmanaged cybersecurity risks, and no way to measure what any of it produces.

Grant Thornton's 2026 AI Impact Survey Report has a name for this condition: the "AI proof gap," which identifies the phenomenon of companies deploying AI they cannot explain, measure, or defend. The survey quantifies the problem. It found:

• Organizations with fully integrated AI are nearly four times more likely to report revenue growth than those still piloting, 58% versus 15%.
• 51% of executives named strategy as the biggest driver of AI return, yet only 22% reported having a fully developed and implemented AI strategy.
• 78% of executives say they lack full confidence that their organization could pass an independent AI governance audit within 90 days.

This is not one firm's finding. Boston Consulting Group's Where's the Value in AI? found that only 26% of companies had built the capabilities to move beyond proofs of concept, and that roughly 70% of implementation challenges were people and process problems rather than technology. McKinsey's State of AI survey reported that while nearly nine in ten organizations now use AI somewhere, only 39% see any positive impact on operating earnings.

The data confirms what we see in the field: strategy and governance do not slow down innovation.

A structured AI strategy gives your team the guardrails needed to move quickly and safely. One honest caveat, which the researchers themselves flag: these are correlational findings. A written strategy does not cause revenue growth by itself. Rather, a written strategy is a marker of the organizational discipline that, ultimately, goes on to drive revenue growth; and that discipline is buildable.

So, what actually constitutes a mature AI strategy? Moving from chaos to implemented outcomes requires an approach that goes beyond simply purchasing licenses. Keep reading to find out.

Read Also: Technology Stopped Being An IT Problem

Core Components Of A Strategy

A functional AI strategy is not an Information Technology (IT) roadmap. It's also not an AI policy. When we ask leaders whether they have an AI strategy, the most common answer is "yes, we have an acceptable use policy." This answer is incorrect.

A policy tells your people what they can and cannot do. A strategy, on the other hand, tells your business what AI is for. Many firms have the first and mistake it for the second. Moreover, a complete AI strategy looks like a business strategy fueled by technology, and it includes several non-negotiable components:

• Business Alignment: AI initiatives must tie directly to specific strategic goals, with quantifiable metrics that prove value and a named owner accountable for moving them.
• Governance & Risk Management: Establish clear policies and oversight structures to manage acceptable use, data privacy, bias, and cybersecurity risks. Every AI decision your organization makes should be one you can explain and defend.
• Data Foundation: AI cannot function without accessible, secure, and clean data. An AI strategy is inherently a data strategy.
• Technology & Operating Model: An honest inventory of your existing infrastructure and the tools already in use, plus the operational processes to deploy, monitor, and maintain AI in production rather than in perpetual pilot.
• Implementation & Talent: A roadmap that sequences initiatives, prioritizes quick wins, and identifies the talent or change management required for deployment.

Strategy In Practice: Hard Questions You Must Answer

When these components are practically applied to a business, they force leadership teams to make definitive choices about their operating models. A true strategy answers questions such as:

• The Pricing Dilemma: If you are a professional services firm, for example, and AI allows your team to draft a legal brief, design a marketing campaign, or generate engineering schematics in half the time, how does that impact your pricing? If you maintain a strict billable-hour model, you will cannibalize your own revenue. An AI strategy dictates whether you transition to value-based pricing or subscription models to capture the margin you just created.
• The Talent Redeployment Choice: When AI makes certain roles within your company 30% more efficient, you face an immediate workforce decision. Are you going to reduce staff to realize cost savings, or are you going to redeploy those same employees? If you redeploy them, your strategy must define exactly what that higher-value work is, whether that means deepening client relationships, launching new advisory service lines, or accelerating product development.
• The Liability & Governance Reality: For instance, if you are a healthcare or financial services firm utilizing generative AI to draft patient summaries or financial reports, who owns the risk if the model hallucinates a critical detail? A mature AI strategy establishes the human-in-the-loop workflows and quality assurance controls long before a vendor contract is signed.

Only after you have answered the questions that matter to your business should you select tools.

Assess, Prioritize, Improve, & Manage

Building this strategy does not require a massive, monolithic blueprint. GBQ's Business Technology Solutions team helps mid-market organizations tackle it modularly, through a disciplined four-step approach:

• Assess: Map your current organizational capabilities, existing tool usage, data readiness, and immediate risks. You cannot secure or scale what you cannot see. Every assessment should produce a risk register, so leadership knows exactly what it is accepting.
• Prioritize: Not every use case deserves investment. Rank opportunities against business impact, risk exposure, and readiness, and commit to the one or two that matter most.
• Improve: Implement the prioritized use cases with strict cost controls, access policies, and measurement frameworks aligned to business risk.
• Manage: Establish the ongoing operating cadences, change management, and executive oversight required to sustain value and adapt to new regulatory frameworks.

We are past the point where playing with tools is an acceptable strategy. The organizations reporting revenue growth from AI in every survey cited above made their decisions before they scaled. Start with the decisions. The tools will still be there when you are done.

About GBQ Business Technology Solutions

GBQ's Business Technology Solutions practice empowers the growth of our clients across six disciplines: risk management, cybersecurity, IT governance, AI and automation, data and analytics, and business systems.

If this article raised questions that you cannot yet answer about your own AI strategy, the first place to start is with a conversation. GBQ’s AI advisory services allow us to assess where your organization stands today, prioritize use cases worth your investment, and help build the governance that lets you prove what AI is returning.

To continue the conversation, schedule time with Doug Davidson, director of GBQ’s Business Technology Solutions practice. Or, contact him directly at ddavidson@gbq.com.

Net Effect is a biweekly column written  by Doug Davidson, director of the firm's Business Technology Solutions, published in the firm's Bottomline newsletter. Email ddavidson@gbq.com to have your technology questions addressed in a future column.