AI is everywhere. Including here.
Boards are asking about it. Vendors are selling it. Consultants are packaging it. Most of the advice reaching your desk is either too abstract to act on or too optimistic to trust.
The first thing worth saying is that the fundamentals have not changed. Good vendor selection still matters. The trade-offs between sole-source and multi-vendor, between build and buy, between platform bets and best-of-breed are the same trade-offs they were five years ago. AI raises the stakes of getting them wrong, but it does not rewrite the rules. Make these choices deliberately, not by default.
The second thing is that organisational muscle matters more than any particular technology or tool. AI is indeed moving fast, but the path forward is far from obvious. The models, the regulatory landscape, and the competitive environment are all in flux. The businesses that will benefit the most are the ones building their capability to monitor what is happening, experiment with what might work, and adopt what works. And to build the muscle, do the reps. If your organisation cannot run a proof of concept or a pilot and evaluate the result with any discipline, the specific AI tool you pick is beside the point.
Third, your cybersecurity posture is probably behind where you think it is. Traditional defences are built around endpoint protection and layered controls. AI is introducing novel attack vectors that move faster than those defences can adapt. The most useful investment is not another product but a stronger security culture across the organisation. Culture responds to change faster than policy does. Make sure your security team is staying current with how AI is being used offensively, not just defensively.
Fourth, get the data foundations right. This is the unglamorous part, and the most important. AI is only as useful as the data it works with. If yours is fragmented, inconsistent, or poorly governed, no AI investment will deliver what the vendor promised. Treat data quality and architecture as a prerequisite, not a parallel workstream. Start treating data like the asset it is.
The last point is about decision making. The capability of AI-assisted development is, frankly, remarkable. In fact, it has moved beyond AI-assisted to AI-performed. It is now possible to build software at a speed and cost that would have been unthinkable just a few months ago. The question for any leader is not “can we build this?” but “should we?” Stay focused on what creates competitive advantage. Build where it differentiates. Buy where it does not. I personally would not be vibe coding* an in-house payroll system, for example.
The common thread across all of this is judgment. AI does not reduce the need for it. If anything, it raises the premium on leaders who can tell the difference between a genuine opportunity and an expensive distraction.
*Vibe coding, where you describe what you want in plain language and AI writes the software.