← Findings 🕐 31 min read
Findings

The 90-Day AI Quick Start: What to Do Monday Morning

Brandon Sneider · March 2026

The shadow AI audit is the most important action in this entire plan. Half of frontline employees with AI access use unapproved tools (HBR/Deloitte, 2025).

Executive Summary

  • You are making the right move. The organizations capturing 2x revenue growth and 3.6x shareholder returns from AI (BCG, n=1,250+, 2025) started with exactly the decision you just made: to get serious. This guide turns that decision into 90 days of specific, sequenced action.
  • This plan is designed for companies with 200-2,000 employees, no Chief AI Officer, and no dedicated AI team. That is most of corporate America. The path does not require a new department. It requires a disciplined 90-day sequence.
  • Only 5% of organizations generate substantial financial returns from AI (BCG, n=10,600, 2025). The organizations that capture value share a specific playbook. This guide follows that playbook: assess honestly, decide quickly, pilot with discipline, and scale with data.
  • Expected investment over 90 days: $15,000-$75,000, depending on company size and tools selected. Expected outcome: a running AI pilot with measured results, a governance framework, and a data-backed business case for enterprise rollout.
  • The single biggest risk is not starting wrong. It is starting vague. Every week in this guide has a specific deliverable, a named owner, and a definition of “done.” Follow the sequence. Skip the theory.

Before You Start: Three Ground Rules

1. This is a CTO/CIO-led initiative, not an IT project. The executive who owns business outcomes must own this program. Delegating it to a director-level IT leader signals that AI is a technology experiment, not a strategic priority. BCG’s data is unambiguous: organizations where a C-level executive personally sponsors AI programs are 2x more likely to capture returns.

2. Budget for the full cost, not just the license. GitHub Copilot Business costs $19/seat/month. The real cost — including review overhead, debugging, training, and governance — runs 2.5x the license fee in Year 1 (DX Research/Atlan, 2025). That multiplier is the reason most pilots die at budget review: leadership approved the license, not the real cost. This guide builds the honest budget from day one.

3. You are building a capability, not buying a tool. The organizations in the 5% invested 70% of their AI budget in people and processes, and 30% in technology (BCG 10-20-70 rule). Every week in this plan includes both a technology action and a people/process action. Skip the people side, and results will not follow.

Phase 1: ASSESS (Weeks 1-2)

Week 1: See What You Are Working With

Goal: Establish a factual baseline of where AI exists in your organization today – sanctioned and unsanctioned.

Action Owner Expected Cost Definition of Done
Conduct a shadow AI audit CTO + Security Lead $0 (internal labor) Written report listing every AI tool in use, by whom, for what, with what data
Complete the AI Native Assessment (25-question self-assessment) CTO + direct reports $0 Scored assessment with stage classification and dimension breakdown
Inventory current tool stack and contracts IT Lead $0 (internal labor) Spreadsheet of every tool, license cost, renewal date, SSO status
Name a program owner (you, or your most trusted technical leader) CTO $0 Named individual with 20% time allocation for 90 days

Shadow AI Audit: How to Do It in Five Days

The shadow AI audit is the most important action in this entire plan. Half of frontline employees with AI access use unapproved tools (HBR/Deloitte, 2025). You need to know what is actually happening before you can make good decisions.

Day 1-2: Network and financial scan. Have IT pull DNS logs, SaaS spend data (check Zylo, Productiv, or credit card statements), and browser extension inventories for the past 90 days. Look for: ChatGPT, Claude, Gemini, Copilot (personal accounts), Cursor, Perplexity, Jasper, Notion AI, Grammarly, and any domain ending in .ai.

Day 3: Anonymous survey. Send a 5-question anonymous survey to all employees. The questions: (1) Do you use any AI tools for work? (2) Which ones? (3) For what tasks? (4) How often? (5) What data do you put into them? Keep it anonymous. You want honesty, not compliance theater.

Day 4: Manager interviews. Talk to 5-8 team leads across engineering, sales, marketing, legal, and operations. Ask: “What are your people actually doing with AI?” Managers know more than IT does about real usage patterns.

Day 5: Compile the report. The deliverable is a one-page summary: number of tools found, estimated monthly spend (personal subscriptions your employees are expensing or paying out of pocket), data exposure risk (what company data is going into consumer AI tools), and the three most common use cases.

What you will likely find: 30-60% of your knowledge workers are already using AI, mostly consumer-grade tools with no data governance. The median shadow AI spend for a 500-person company is $2,000-$8,000/month in personal subscriptions and expensed accounts. This is not a problem to fix. It is demand to channel.

The 25-Question Self-Assessment

Complete the AI Native Adoption Assessment Tool (see companion document: AI Native Adoption Assessment Tool). The assessment scores your organization across five dimensions – Tooling, Governance, People & Culture, Process & Integration, and Strategy & Vision – and maps you to a stage on the AI Native Adoption Cycle:

Score Stage What It Means for Your 90-Day Plan
0-15 Stage 0: AI-Unaware You are starting from zero. This guide is written for you. Follow every step.
16-30 Stage 1: AI-Curious You have awareness but no action. This guide gives you the action plan.
31-50 Stage 2: Experimenting You have pilots running. Use this guide to add governance and measurement.
51-70 Stage 3: Standardizing You are further along. Focus on Weeks 5-12 of this guide.

Most organizations reading this guide will score between 10 and 40. That is the right range for this plan.

Common Mistakes, Week 1

  • Skipping the shadow AI audit because “we don’t think people are using AI.” They are. HBR data (2025) shows 50% of frontline employees with access use unapproved tools. The question is whether you have visibility.
  • Spending the week evaluating tools instead of assessing your starting position. Tool selection comes in Week 3. This week is about understanding what you have.
  • Assigning the audit to a junior analyst. The shadow AI audit requires access to network logs, financial data, and management conversations. It needs someone with cross-functional authority.

Week 2: Identify the Gaps and the Opportunity

Goal: Translate the audit and assessment into a prioritized gap analysis and a clear picture of where AI can help first.

Action Owner Expected Cost Definition of Done
Map your dimension gaps from the self-assessment CTO $0 Spider chart showing your five dimension scores with gaps highlighted
Identify 5-10 high-volume, repeatable workflows across the company CTO + Department Heads $0 (internal labor) Ranked list of workflows by time spent, error rate, and frequency
Benchmark your current developer tool adoption rate Engineering Lead $0 Percentage of developers currently using any AI coding tool (sanctioned or not)
Estimate your full AI budget requirement using the 10-20-70 rule CTO + Finance $0 (internal labor) Draft budget document covering licenses (10%), technology/data (20%), and people/processes (70%)

Workflow Mapping: Where AI Helps First

The self-assessment tells you where your organization sits. The workflow mapping tells you where the money is. Interview 5-8 department heads and ask three questions about their highest-volume tasks:

  1. How many hours per week does your team spend on this task?
  2. What is the error or rework rate?
  3. Is this task mostly boilerplate/repetitive or mostly judgment/creative?

Tasks that are high-volume, high-repetition, and low-judgment are where AI delivers the fastest, most defensible ROI. The evidence is clear on what works at this stage:

Task Category AI Effectiveness Evidence
Code autocomplete and boilerplate HIGH – 25-35% speed gain GitHub, Stack Overflow, universal consensus
Unit test generation HIGH – 83% coverage vs. 54% traditional QA industry data
Documentation generation HIGH Mintlify, Copilot docs features
Meeting notes and summarization HIGH Gartner 2025 Market Guide; 95% configuration
Customer support tier-1 deflection HIGH Intercom Fin: 65% resolution rate at $0.99/resolution
Contract review and analysis MODERATE-HIGH Harvey AI: 30% reduction in review time

Budget Reality Check: The Honest Numbers

This is where most AI programs go wrong. A CFO sees “$19/seat/month” and approves a $50,000 annual budget. The real cost for a meaningful pilot is higher – and pretending otherwise is how pilots get killed in month four.

For a 200-person company (50 developers, 150 knowledge workers):

Cost Category 90-Day Pilot Cost Annual Run-Rate (If Scaled)
AI coding tool licenses (50 devs x $19/seat/mo x 3 months) $2,850 $11,400
Knowledge worker AI tools (25-person pilot x $30/seat/mo x 2 months) $1,500 $54,000 (at scale)
Training and change management $5,000-$15,000 $30,000-$60,000
IT configuration, SSO, governance setup $3,000-$8,000 $5,000-$10,000
Program owner time allocation (20% for 90 days) $15,000-$25,000 (opportunity cost) N/A
Total 90-day pilot investment $27,350-$52,350
Total annualized cost at full scale $100,400-$135,400

For a 1,000-person company (150 developers, 850 knowledge workers):

Cost Category 90-Day Pilot Cost Annual Run-Rate (If Scaled)
AI coding tool licenses (150 devs x $19/seat/mo x 3 months) $8,550 $34,200
Knowledge worker AI tools (50-person pilot x $30/seat/mo x 2 months) $3,000 $306,000 (at scale)
Training and change management $15,000-$40,000 $90,000-$180,000
IT configuration, SSO, governance setup $5,000-$15,000 $10,000-$20,000
Program owner time allocation (20% for 90 days) $15,000-$25,000 (opportunity cost) N/A
Total 90-day pilot investment $46,550-$91,550
Total annualized cost at full scale $440,200-$540,200

These numbers align with BCG’s 10-20-70 framework and real deployment data from mid-market companies spending an average of $600,000 annually on AI initiatives (CloudZero/Zylo, 2025).

Present this budget honestly. CFOs respect honesty more than they respect optimism. The organizations in the 5% budgeted for the full cost upfront and proved ROI against it. The 95% budgeted for the license and got surprised.

Common Mistakes, Week 2

  • Trying to boil the ocean. You do not need to map every workflow. You need 5-10 high-impact candidates. Perfection is the enemy of the 90-day timeline.
  • Confusing shadow AI demand with validated use cases. Just because marketing is using ChatGPT does not mean ChatGPT is the right tool. The demand is real. The tool selection comes next.
  • Presenting a license-only budget to finance. If you present $19/seat/month and the real cost is 2.5x that in Year 1 (DX Research/Atlan, 2025), you lose credibility when the true costs surface. Present the honest budget now.

Phase 2: DECIDE (Weeks 3-4)

Week 3: Select Tools and Draft Policy

Goal: Make the tool selection decision and draft the governance foundation. Both happen this week. Neither should take longer.

Action Owner Expected Cost Definition of Done
Select primary AI coding tool based on your existing stack CTO + Engineering Lead $0 (decision, not purchase) Written decision with rationale, referencing the Easiest Path Framework
Select knowledge worker AI tool for the pilot CTO + IT Lead $0 (decision, not purchase) Written decision with rationale
Draft AI Acceptable Use Policy (1-2 pages) CTO + Security + Legal $0 (internal labor) Signed policy document distributed to all employees
Define success metrics for the pilot CTO + Program Owner $0 Written metrics document with baselines and targets

Tool Selection: Follow Your Stack

Do not evaluate 10 tools. The Easiest Path Framework (see companion document: The Easiest Path to Useful AI Adoption) maps the right starting point to your existing technology stack:

Your Stack Start Here Cost Why
Microsoft (Azure, M365, VS Code) GitHub Copilot Business $19/seat/mo Best governance-to-cost ratio; IP indemnification; SSO; 42% market share
Google (GCP, Workspace) GitHub Copilot Business + Gemini Code Assist Free $19/seat/mo + $0 Copilot for coding, Gemini free tier for GCP-specific work
AWS GitHub Copilot Business + Amazon Q Developer Free $19/seat/mo + $0 Copilot for general coding, Q for AWS infrastructure
Multi-cloud / Mixed GitHub Copilot Business $19/seat/mo Cloud-agnostic; universal standard
Atlassian (Jira, Confluence) GitHub Copilot Business + enable Atlassian Intelligence $19/seat/mo + included Copilot for code, Atlassian AI for workflow/knowledge

The pattern is clear: GitHub Copilot Business at $19/seat/month is the right starting point for almost every organization at Stage 0-2. It has the largest market share (42%), the strongest governance tooling (180-day audit logs, SCIM, SAML, SSO), IP indemnification, and the most proven enterprise deployment record.

Do not start at $168/seat/month with the full Microsoft AI stack. Prove value at $19 first.

For knowledge workers beyond developers, the pilot tool depends on your environment. M365 Copilot ($30/user/month) for Microsoft shops. Gemini for Workspace for Google shops. Meet with your existing vendors before buying new ones.

The AI Acceptable Use Policy: Two Pages, Not Fifty

Most organizations either have no AI policy (risk) or a 40-page policy nobody reads (also risk). The right answer is two pages that cover five topics:

Page 1: What Is Allowed

  • Approved tools (list them by name – no ambiguity)
  • Approved use cases (code generation, documentation, summarization, research)
  • Who has access (by role or team)
  • Where to get help or request new tools

Page 2: What Is Not Allowed

  • Customer PII, financial data, or trade secrets in any AI tool without approved data classification
  • Using personal AI accounts for company work
  • Deploying AI-generated code to production without standard code review
  • Sharing AI-generated content externally without human review
  • Circumventing approved tool lists

What to skip in version 1: Detailed regulatory compliance frameworks, model-specific risk assessments, philosophical positions on AI ethics. These matter, but not in week 3. Get the basics in place. Iterate quarterly.

Sign it. Distribute it. Move on.

Defining Success Metrics Before You Start

The 95% that fail have one thing in common: they deployed first and defined success later. The 5% defined success first, then measured against it.

For your pilot, track five metrics weekly starting in Week 5:

Metric What It Measures Baseline (Set Now) Target (Week 12)
Active usage rate % of pilot users completing AI-assisted tasks weekly 0% 60%+
User satisfaction 1-5 scale self-report on AI tool value N/A 3.5+ average
Task completion time Time for specific tasks (before and after AI) Measure in Week 4 20-30% improvement
Code review overhead Time spent reviewing AI-generated code Current baseline Stable or declining
Shadow AI rate % of AI usage on unapproved tools From audit (Week 1) Below 15%

The single most important metric is active usage rate. If people are not using the tool by Week 8, the pilot has failed – and the reason is almost always training, not technology.

Common Mistakes, Week 3

  • Analysis paralysis on tool selection. You are picking a pilot tool, not signing a decade-long contract. GitHub Copilot Business at $19/seat is the right starting point for 80%+ of organizations. Pick it and move.
  • Writing a 30-page acceptable use policy. Nobody will read it. Two pages, five topics, signed and distributed.
  • Defining vague success metrics. “Improve productivity” is not a metric. “60% weekly active usage by Week 12” is a metric.

Week 4: Procure and Configure

Goal: Licenses purchased, SSO configured, security review complete, environments ready for Week 5 pilot launch.

Action Owner Expected Cost Definition of Done
Procure licenses for the pilot team IT Lead + Procurement $1,000-$5,000 (first month) Licenses assigned, billing confirmed
Configure SSO and security controls IT / Security $0-$3,000 (labor) SSO working, content exclusion policies set, audit logging enabled
Complete security review of selected tool(s) Security Lead $0 (internal labor) Written security assessment: data flows, retention, encryption, compliance
Set up baseline measurements for success metrics Program Owner $0 (internal labor) Baseline numbers recorded for all five pilot metrics
Select and brief the pilot team (see below) CTO + Program Owner $0 Pilot team identified, briefed, and scheduled for Week 5 training

Security Configuration Checklist

For GitHub Copilot Business (the most common starting point):

  • SSO integration via SAML (required for enterprise control)
  • Content exclusion policies (exclude repositories containing customer data, credentials, or proprietary algorithms)
  • IP indemnification enabled (included with Business tier)
  • Audit logging enabled (180-day retention at Business tier)
  • Copilot Chat data: verify that prompts and suggestions are not retained for model training (this is the default for Business/Enterprise, but confirm)
  • Firewall and network: no special configuration needed (Copilot runs in the IDE, communicating via HTTPS)

Timeline: 1-3 days for SSO, 1-2 days for content exclusion policies, 1 day for audit log review. This is configuration, not development.

Selecting the Pilot Team

The composition of your pilot team is the second-highest predictor of pilot success, after executive sponsorship. Get this wrong and your pilot produces data that nobody trusts.

Size: 15-30 people for a 200-person company. 30-50 for a 1,000-person company. Large enough to produce meaningful data. Small enough to support well.

Composition:

Role Count Why
Enthusiastic developers (already using AI informally) 5-10 They will adopt quickly and find advanced use cases
Skeptical developers (experienced, respected, cautious) 3-5 Their eventual endorsement carries more weight than any executive memo
Non-developer knowledge workers 5-10 Tests AI value beyond coding
Team leads / managers 2-3 They will need to manage AI-augmented teams
One person from Security or Compliance 1 Identifies governance issues in real time

The skeptics matter more than the enthusiasts. When a respected senior developer who was publicly cautious about AI says “this actually helped me on that contract review module,” that converts more people than any training deck. Deliberately include 2-3 skeptics. Their honest feedback also improves the program.

Common Mistakes, Week 4

  • Starting the pilot without SSO. If developers can use personal accounts, you have no usage visibility and no data governance. SSO first, licenses second.
  • Selecting only enthusiasts for the pilot. A pilot of AI fans produces enthusiasm, not credible data. Include skeptics.
  • Skipping the security review. Your CISO will kill the program at Week 8 if they were not involved at Week 4.

Phase 3: PILOT (Weeks 5-8)

Week 5: Launch and Train

Goal: Pilot team is live, trained, and producing real work with AI tools. Training uses the champion model, not mandatory webinars.

Action Owner Expected Cost Definition of Done
Deploy tools to pilot team and confirm working access IT Lead $0 (already procured) Every pilot member can access the tool from their primary work environment
Conduct hands-on training sessions (2 hours, small groups) Program Owner + 1-2 Champions $2,000-$5,000 (facilitator time) Every pilot member has completed a real work task using the AI tool
Identify and activate 3-5 champions within the pilot team Program Owner $0 Champions named, briefed, and allocated 30-60 minutes/week
Set up the weekly measurement cadence Program Owner $0 First weekly metrics collection scheduled for end of Week 5

Training That Works: The Champion Model

The data on AI training is stark. Employees receiving hands-on, interactive AI training report 144% higher trust in employer-provided AI (HBR, 2025). Employees receiving lectures or slide decks report almost no change in trust or usage.

Do not run a mandatory all-hands webinar. Instead:

Session format: 2-hour workshops, 5-8 people per session, in a conference room with laptops open. The facilitator demonstrates a real task (writing a unit test, summarizing a document, drafting a policy memo), then each participant does the same task with their own real work. Nobody leaves without having completed a real task.

Champion activation: Identify 3-5 people in the pilot group who naturally help colleagues, are respected across teams, and are willing to share both wins and failures. These are your champions. They spend 30-60 minutes per week answering questions, demonstrating use cases in team meetings, and flagging friction points to the program owner.

This is the model that scaled Citi from zero to 70% adoption across 182,000 employees with 4,000 volunteer champions. PwC Netherlands went from 300 to 6,000 (100% of their workforce) in one year using the same approach. Neither used mandates. Both used peer influence.

The critical insight from PwC: Select champions for influence, not enthusiasm. The people with the most natural influence across teams, regardless of their AI enthusiasm, became the most effective champions. PwC used organizational network analysis to identify them. You can do this informally: ask three managers, “Who does everyone on your team go to when they need help?”

What to Train On (Specific to Week 5)

For developers on GitHub Copilot Business:

  • Tab completion basics (accepting, rejecting, cycling suggestions)
  • Chat-based code generation for boilerplate and scaffolding
  • Test generation from existing code
  • Documentation generation
  • What NOT to use it for (complex business logic, security-critical code, architecture decisions)

For knowledge workers on M365 Copilot or equivalent:

  • Document summarization
  • Meeting note generation
  • Email drafting from bullet points
  • Data analysis in spreadsheets
  • What NOT to trust without verification (any factual claims, legal conclusions, financial calculations)

Common Mistakes, Week 5

  • Running a one-hour webinar and calling it “training.” Webinars produce compliance, not competence. Hands-on workshops with real tasks produce 144% higher trust (HBR, 2025).
  • Not allocating protected time for champions. Champions asked to do this on top of existing workloads burn out within 8-12 weeks (Prosci). Allocate 30-60 minutes of protected weekly time.
  • Training on features instead of tasks. Nobody cares that Copilot has “ghost text suggestions.” They care that they can generate a full unit test suite in 30 seconds. Train on tasks, not features.

Week 6: Measure and Adjust

Goal: First full week of measurement data collected. Identify early friction points and address them before they become adoption blockers.

Action Owner Expected Cost Definition of Done
Collect Week 5-6 metrics (usage rate, satisfaction, task time) Program Owner $0 Metrics dashboard updated with two weeks of data
Run the 5-question pulse survey Program Owner $0 Survey results compiled and reviewed
Hold champion sync (30 minutes, all champions) Program Owner $0 Friction points documented, solutions assigned
Address top 3 friction points IT Lead + Champions $0-$2,000 Fixes deployed or workarounds communicated

The 5-Question Pulse Survey (Run Monthly)

Keep it short. Five questions, scored 1-5, plus one open-text field:

  1. I understand why our organization is adopting AI tools. (Awareness)
  2. I know what I am expected to do differently with AI. (Clarity)
  3. I can use AI tools effectively without help. (Confidence)
  4. AI tools make my work better, not just faster. (Perceived value)
  5. What is the biggest obstacle to your AI usage? (Open text – this is where the real intelligence lives)

Question 5 is the most important. The patterns in open-text responses tell you what is actually blocking adoption. Common early findings: “I don’t know when to use it,” “The suggestions are wrong too often,” “I don’t have time to learn,” “I’m worried about code quality.”

The Adoption Dip: Expect It, Plan for It

Microsoft’s own data from deploying M365 Copilot to 300,000+ employees reveals a predictable pattern:

  • Weeks 1-3: Initial delight. Usage spikes as people experiment.
  • Weeks 3-10: The dip. Novelty fades. Employees revert to old habits. Usage drops.
  • Week 11+: Sustained adoption for employees who received targeted support during the dip.

You are entering the dip zone. This is normal. Organizations that do not intervene during weeks 3-10 lose the majority of their users permanently. Organizations that deploy champions, provide targeted skilling, and celebrate early wins during this period achieve 76% satisfaction and 85% regular usage (Microsoft Inside Track, 2026).

Your intervention: champions actively reaching out to pilot members, sharing specific use cases in team meetings, and the program owner directly contacting any pilot member whose usage drops below once per week.

Common Mistakes, Week 6

  • Ignoring the adoption dip. Usage will decline from the Week 5 spike. This is expected. The mistake is interpreting it as failure rather than a normal adoption curve that requires intervention.
  • Measuring only usage, not satisfaction. High usage with low satisfaction means people are forcing themselves to use a tool that is not helping. Measure both.
  • Not acting on pulse survey results. If the survey says “I don’t know when to use it,” that is a training gap you can close this week. If you collect feedback and do nothing, trust erodes.

Week 7: Deepen and Expand Use Cases

Goal: Move beyond basic adoption to task-specific use cases that produce measurable time savings. This is where the pilot starts generating the data that builds the business case.

Action Owner Expected Cost Definition of Done
Identify 3-5 specific, measurable use cases per team Champions + Team Leads $0 Written use case list with estimated time savings per occurrence
Run before/after time comparisons on 2-3 key tasks Program Owner + Pilot Members $0 Documented time savings with specific task descriptions
Add AI code review tool to the development workflow (if applicable) Engineering Lead $0-$500/mo (CodeRabbit or similar) AI code review running on pilot team’s repositories
Share first wins internally (brief email or Slack post from CTO) CTO $0 One communication highlighting a real, specific win

The Use Case Density Test

By Week 7, each pilot team should have identified at least 2-3 tasks where AI saves meaningful time. If they have not, the training was too generic. The fix: pair a champion with each team for a 30-minute session focused on their specific work.

Strong use case examples from real deployments:

  • “Generating unit tests for our payment processing module took 3 hours manually. With Copilot, it takes 40 minutes.” (Measurable: 2 hours 20 minutes saved per occurrence)
  • “Summarizing the weekly client status meeting used to take 25 minutes of note cleanup. The meeting AI produces a clean summary in 2 minutes.” (Measurable: 23 minutes saved per meeting)
  • “First-draft contract review that took our legal team 4 hours now takes 90 minutes with AI-assisted analysis, plus 30 minutes of human verification.” (Measurable: 2 hours saved per contract)

Weak use case examples (too vague to build a business case):

  • “It helps me code faster.” (How much faster? On what tasks?)
  • “I use it every day.” (For what? With what result?)
  • “It’s pretty useful.” (This is not data.)

Common Mistakes, Week 7

  • Accepting vague “it helps” feedback instead of specific time measurements. The business case requires numbers. “Saves 2 hours per contract review” survives a CFO meeting. “Pretty useful” does not.
  • Not addressing the code review bottleneck. AI-assisted developers produce 98% more PRs, but code review time grows 91% (Faros AI, 135K+ developers). If your development teams are in the pilot, add AI code review tooling now to prevent the bottleneck that erases individual speed gains.
  • Keeping wins invisible. A brief CTO communication (“Here is a specific result from our AI pilot”) builds organizational momentum and signals leadership commitment.

Week 8: Stress Test and Document

Goal: Final week of active piloting before evaluation. Stress test governance, compile results, and document everything you will need for the Week 9-12 business case.

Action Owner Expected Cost Definition of Done
Run a security review of pilot activity (audit logs, data flows) Security Lead $0 (internal labor) Written security assessment: any incidents, data exposure risks, policy violations
Compile all metrics into a pilot results dashboard Program Owner $0 Dashboard with 4 weeks of weekly data across all five metrics
Document all use cases with measured results Program Owner + Champions $0 Use case library with task descriptions, time savings, and frequency
Conduct pilot team retrospective (1 hour, all participants) Program Owner $0 Written summary of what worked, what did not, and what should change for scale

The Security Review You Need at Week 8

This is not a full security audit. It is a targeted review of what happened during the pilot:

  1. Audit log review: Pull the 8 weeks of Copilot/tool audit logs. Look for: usage patterns, any content exclusion policy violations, any attempts to access restricted repositories.
  2. Data flow verification: Confirm that no customer PII, credentials, or classified data entered the AI tool. Your content exclusion policies should have prevented this, but verify.
  3. Policy compliance: Did every pilot member follow the acceptable use policy? Were there any shadow tool usage instances during the pilot?
  4. Incident review: Were there any AI-related quality issues? Code bugs traced to AI suggestions? Incorrect document drafts that reached clients?

The deliverable is a one-page security assessment that says either “no material issues found” (most likely) or “here are the issues we identified and how we will address them at scale.” Either outcome is useful. The CISO needs this before they will approve enterprise rollout.

Common Mistakes, Week 8

  • Skipping the retrospective. The pilot team’s honest feedback is the richest data source you have. Spend one hour collecting it.
  • Not running the security review. If Security raises concerns at Week 10 that could have been caught at Week 8, you lose two weeks and significant credibility.
  • Letting the pilot end without documentation. Memories fade. Data decays. Document everything now while it is fresh.

Phase 4: EVALUATE AND SCALE (Weeks 9-12)

Week 9-10: Build the Business Case

Goal: Translate pilot results into a data-driven business case for enterprise rollout. This is the document that either kills the program or funds it. Treat it accordingly.

Action Owner Expected Cost Definition of Done
Calculate pilot ROI (time saved x cost per hour vs. total pilot cost) Program Owner + Finance $0 Written ROI calculation with assumptions documented
Draft the enterprise rollout business case CTO + Program Owner $0 Business case document ready for leadership review
Develop the rollout governance plan CTO + Security + Legal $0 Governance plan covering access, data, training, and measurement
Prepare the leadership presentation CTO $0 Presentation deck with data, not opinions

Building the ROI Calculation

The formula is straightforward. The discipline is in using real numbers, not estimates:

Time Savings Calculation:

  • Total hours saved per week across pilot team (from your measured use cases)
  • Multiply by average fully-loaded hourly cost of pilot team members
  • Multiply by 48 weeks (annual projection)
  • This is your gross annual benefit

Cost Calculation:

  • License costs (annualized)
  • Training and change management costs (annualized, using the 10-20-70 framework)
  • IT administration and governance costs (annualized)
  • Productivity dip during onboarding (typically 2-3 weeks of reduced output per new user)
  • This is your total annual cost

The business case passes if: Gross annual benefit exceeds total annual cost by at least 2x. Most successful pilots show 3-5x return at the task level. Organizational returns are lower because not everyone adopts at the same rate – model at 60% adoption for conservative projections.

What makes a CFO say yes: Specific dollar amounts tied to specific tasks. “Our 50-person development team will save 1,200 hours per year on unit test generation, equivalent to $90,000 in developer time, at a total program cost of $45,000.” That is a sentence that survives a board meeting.

What makes a CFO say no: Vague promises. “AI will make us more productive.” That does not survive a hallway conversation, let alone a board meeting.

The Enterprise Rollout Governance Plan

The governance plan for scale addresses everything the pilot surfaced, plus the complexity of broader deployment:

Component What It Covers Owner
Access governance Who gets which tools, at which tier, with what data access IT + Security
Data classification What data can enter AI tools, by classification level Security + Legal
Training program Champion network design, onboarding curriculum, ongoing learning Program Owner + HR
Measurement framework KPIs, reporting cadence, escalation triggers Program Owner
Budget and cost management Per-team allocation, usage monitoring, renewal governance Finance + IT
Vendor management Contract terms, renewal timeline, exit strategy Procurement
Policy update cadence Quarterly AUP review, annual strategy review CTO

Common Mistakes, Weeks 9-10

  • Presenting opinions to leadership instead of data. “We think AI is working well” loses to “pilot results show 27% time savings on code generation tasks across 15 developers over 4 weeks, at a cost of $3,800.” Lead with data.
  • Ignoring the costs in the ROI calculation. A business case that shows only benefits, not costs, gets rejected by anyone who has seen a vendor deck. Show the full cost. The ROI still works.
  • Not involving Finance in the business case. If Finance validates your numbers, the business case has institutional credibility. If they see it for the first time in the leadership meeting, they will question every assumption.

Week 11: Address Findings and Plan the Rollout

Goal: Resolve any security, compliance, or governance issues from the pilot. Design the phased enterprise rollout.

Action Owner Expected Cost Definition of Done
Resolve all security/compliance findings from the Week 8 review Security + IT $0-$5,000 All findings closed or mitigated with documented plan
Design the phased rollout plan (which teams, in what order) CTO + Program Owner $0 Rollout timeline with team-by-team deployment schedule
Expand the champion network (1 champion per 10-20 employees) Program Owner $0 Champions identified for every team in the first rollout phase
Update the Acceptable Use Policy based on pilot learnings CTO + Security + Legal $0 Updated policy signed and ready for distribution

Phased Rollout Design

Do not deploy to everyone at once. The champion model requires a manageable ratio (1 champion per 10-20 employees), and your training capacity is limited. Phase the rollout:

Phase 1 (Months 4-5): Expand to all developers. Developers are the easiest expansion because the tool (GitHub Copilot) is the same as the pilot and the use cases are proven. Target: 80% active usage within 60 days.

Phase 2 (Months 5-7): Expand to knowledge worker teams with highest-value use cases. Start with the departments where your pilot identified the strongest time savings. Target: 60% active usage within 90 days.

Phase 3 (Months 7-12): Remaining teams. Expand based on the champion network’s readiness and demonstrated results from Phases 1-2.

Champion network sizing:

Company Size Phase 1 Champions Full Rollout Champions
200 employees 5-10 10-20
500 employees 15-25 25-50
1,000 employees 25-50 50-100
2,000 employees 50-100 100-200

Common Mistakes, Week 11

  • Rushing to “flip the switch” for everyone on day one. Deployment without champion coverage produces the adoption dip with no recovery mechanism. Phase it.
  • Not updating the Acceptable Use Policy. The pilot revealed real-world usage patterns. Update the policy to reflect what you learned, not what you assumed in Week 3.

Week 12: Present to Leadership with Data

Goal: Deliver the business case to executive leadership. Secure approval and budget for enterprise rollout. This is the 90-day capstone.

Action Owner Expected Cost Definition of Done
Present business case to C-suite / executive team CTO $0 Presentation delivered, questions answered, decision documented
Secure budget approval for enterprise rollout CTO + CFO $0 Approved budget for Phase 1 rollout
Announce the program to the broader organization CEO or CTO $0 Company-wide communication explaining what is coming and why
Kick off Phase 1 of enterprise rollout Program Owner Per rollout plan First rollout cohort receiving tool access and training

The Leadership Presentation: Structure

The presentation that works follows a specific structure. This is what earns budget:

Slide 1: One sentence. “We ran a controlled 8-week AI pilot with [X] employees. Here are the results.”

Slide 2: The numbers. Pilot ROI, broken into time saved, cost avoided, and total investment. Use the exact numbers from your ROI calculation. No rounding, no ranges.

Slide 3: Specific examples. Two or three concrete use cases with before/after measurements. “Contract review: 4 hours reduced to 90 minutes + 30 minutes of human verification. 15 contracts reviewed during the pilot. 37.5 hours saved.”

Slide 4: Security and risk. “Security reviewed 8 weeks of audit logs. Zero data exposure incidents. Zero policy violations. [Or: ‘Two policy violations identified and mitigated – here is what we changed.’]”

Slide 5: The ask. Enterprise rollout plan, phased timeline, total budget, expected annualized ROI. Show the full cost (10-20-70), not just licenses.

Slide 6: What happens if we don’t. Shadow AI continues to grow. Competitors are deploying. The gap widens. Frame positively: “We have the data to move forward confidently. The alternative is falling behind while our competitors make this exact move.”

What to avoid: Vendor marketing language. Buzzwords. Promises without data. Comparisons to companies 100x your size. Anything that sounds like it came from a sales deck rather than your own measured results.

Common Mistakes, Week 12

  • Presenting without Finance validation. If the CFO is seeing your numbers for the first time in the meeting, the meeting will become a debate about methodology, not a decision about strategy.
  • Overselling the results. Present exactly what you measured. If the pilot saved 200 hours across 25 people over 8 weeks, say that. Do not extrapolate to “this will save us $2 million.” Let leadership do that math. Understated confidence is more persuasive than inflated promises.
  • Not having the next step ready. If leadership says yes, you need to be able to say “Phase 1 begins Monday. Here is the team list, the training schedule, and the first-month budget.” Momentum dies in the gap between approval and action.

The Full 90-Day Timeline at a Glance

Week Phase Key Deliverable Owner
1 Assess Shadow AI audit report; Assessment scored CTO + Security
2 Assess Gap analysis; Workflow map; Draft budget CTO + Finance
3 Decide Tool selected; AUP drafted; Success metrics defined CTO + Legal + Security
4 Decide Licenses procured; SSO configured; Pilot team selected IT + Security
5 Pilot Tools deployed; Training delivered; Champions activated Program Owner
6 Pilot First metrics collected; Pulse survey run; Dip managed Program Owner
7 Pilot Use cases documented with time savings; Code review added Champions + Leads
8 Pilot Security review; Full metrics dashboard; Retrospective Security + Program Owner
9-10 Evaluate ROI calculated; Business case drafted; Governance planned CTO + Finance
11 Scale Findings resolved; Rollout designed; Champions expanded CTO + Program Owner
12 Scale Leadership presentation; Budget approved; Rollout launched CTO

Key Data Points

Finding Source Credibility
Only 5% of organizations capture substantial AI value BCG (n=10,600), 2025 HIGH – independent
5-6% of companies generate real AI value at scale BCG (n=1,250+) and McKinsey (n=1,993) independently HIGH – convergent finding
2.5x Year 1 TCO-to-license ratio for AI coding tools DX Research/Atlan, 2025 HIGH – independent
50% of frontline employees use unapproved AI tools HBR/Deloitte, 2025 HIGH – independent
144% higher trust with hands-on training vs. lectures HBR, 2025 HIGH – measured intervention
70% adoption via champion model (Citi, 182K employees) AI News, Fortune, 2024-2026 HIGH – named company, public data
100% adoption via champion model (PwC NL, 6K employees, 1 year) Flexos, 2025 MEDIUM-HIGH – independent
Adoption dip in weeks 3-10 is predictable and manageable Microsoft Inside Track, 2026 MEDIUM – self-reported, but independently confirmed
70-80% of AI value comes from people/processes, not tools BCG and PwC independently HIGH – convergent finding
Mid-market companies average $600K/year on AI initiatives CloudZero/Zylo, 2025 HIGH – independent
88% project success with strong change management vs. 13% without Prosci, 25 years, n=10,800+ HIGH – longitudinal

What This Means for Your Organization

You are starting from a position of strength. The decision to move from “thinking about AI” to “executing a disciplined plan” puts you ahead of 60% of enterprises still stuck at Stage 0-1 on the adoption cycle. The next 90 days determine whether you join the 5% capturing real returns or the 95% that spent money on tools without building the organizational capability to use them.

The single most important thing this guide asks you to do differently from most AI programs is to budget and plan for the human side of adoption from day one. The tools cost $19-30/seat/month. The training, change management, workflow redesign, and governance that make those tools productive cost 3-5x the license fee. Organizations that plan for this upfront build sustainable programs. Organizations that discover it at month four build PowerPoint decks explaining why the pilot did not work.

The champion model is not optional. Every company that has achieved 60%+ AI adoption at scale – Citi (70% across 182,000 employees), PwC Netherlands (100% across 6,000), Microsoft (85% regular use across 300,000) – did it through peer influence, not mandates and not webinars. If you build one organizational structure from this guide, build the champion network. Select for influence, not enthusiasm. Allocate protected time. Recognize contributions. The champion network is the infrastructure that turns a tool deployment into a capability.

The 90-day plan is the beginning. It produces a pilot with measured results, a governance framework, and a data-backed business case. What it does not produce is organizational transformation. That takes 12-24 months of sustained commitment – phased rollout, expanding champion networks, quarterly policy updates, and continuous measurement. This guide gives you the foundation and the momentum. The organizations in the 5% built on that foundation every quarter. The organizations in the 95% declared victory after the pilot and moved on to the next initiative.

If any part of this plan raises questions specific to your organization’s situation, that is a conversation worth having before Week 1 begins.

You have the plan. Start Monday.

Sources

Brandon Sneider | brandon@brandonsneider.com March 2026