Thought Leadership · 2026
Direction before speed
A mid-market leader’s playbook for turning data and AI into real business value — safely, and with your people ahead of the curve.
Since 2017, DATA³ has spent every working day inside senior leadership teams, helping them turn data and artificial intelligence into results they can defend in the boardroom. Nine years and more than 300 engagements later, one pattern is impossible to ignore: the technology has changed almost beyond recognition, but the problems leaders bring to us have not. Disconnected data. Manual process. Low trust in the numbers. Now, a new layer of AI sitting on top of all three.
This paper sets out the three disciplines that separate the organisations quietly compounding value from AI from those still circling it, one pilot at a time.
None of this is theoretical. It is drawn from hundreds of live client engagements across sectors, tested against independent research from McKinsey, Gartner, RSM and MIT, and applied first inside our own business before we recommend it to anyone else’s. If you lead a mid-market organisation weighing where to focus your data and AI investment next, this paper is written for you.
We founded DATA³ in 2017 and have spoken with business leaders about their data and AI challenges every day since. In 2017, the conversation centred on disconnected data, manual processes, bottlenecks and a quiet lack of trust in the numbers. In 2026, leaders tell us exactly the same things. The tools have transformed. The underlying problems have not moved.
We track this formally. Across the organisations we assess, we score data maturity against six dimensions. The average score today sits at 44 out of 100, barely up from 42 a few years ago — steady technology investment sitting on a foundation that has strengthened only slightly.
AI readiness looks more stretched again. The average organisation we assess scores just 17 out of 100 — technical infrastructure performs best of the six dimensions we score, and even that manages only 26%; risk management for AI specifically sits at 9%.
Independent research points to the same gap at a larger scale. McKinsey’s November 2025 State of AI survey found 78% of organisations now use AI in at least one business function, yet only 6% qualify as “AI high performers” delivering material earnings impact.1 A 2026 mid-market survey by Netrio found just 26% describe their AI use as scaled and governed enterprise-wide.2 Most organisations, in other words, are running faster before they have decided — or secured — where they are actually going. The rest of this paper sets out how the leaders getting this right approach value, risk and people, as one connected discipline rather than three separate initiatives.
Most disappointment with AI is not a technology problem. It is a data problem wearing a technology costume.
Picture two train routes between two cities. One takes ninety minutes longer. Almost everyone chooses the faster option — less time travelling feels like the rational choice. Except the fast route ends four miles outside the city centre, while the slower one delivers you exactly where you needed to be. Choose speed without checking the destination, and you arrive somewhere you never intended, then pay again — in time, in a taxi, in frustration — to get to where you should have started.
That is the trap we see most often. AI is transport: it helps you move faster, automate more and execute at a pace no team could manage manually. Data is the compass: it tells you where you actually are, and which direction is worth moving in. Debating “data versus AI” misses the point — the value sits in data and AI working together, in that order.
The evidence for the gap is now well documented beyond our own client base. Separate research from Google Cloud, surveying 3,466 senior leaders across 24 countries, found 74% report measurable ROI within the first year of deploying AI.3 The open question is rarely whether AI pays back — it is whether it pays back at the scale leadership expected when they approved the budget.
Across the engagements we run, and inside our own business, three practices consistently separate teams that bank real value from teams that produce impressive demos.
RSM’s 2026 US middle-market survey found 97% of organisations call their AI pilots successful, yet only 17% pursue transformation at enterprise scale, and 34% cite data quality and availability as the biggest barrier to scaling further.4 It is the same pilot-to-scale gap we see close up, at a national level.
The organisations getting the most from AI are not the most cautious. They are the ones who treat risk as something to actively manage rather than passively hope avoids them. Three failure patterns show up repeatedly.
Data leakage. What goes into a public AI tool cannot reliably be pulled back out. In 2023, engineers at Samsung reportedly pasted proprietary source code and confidential meeting notes into ChatGPT; once submitted, that information had left the company’s control.5 The lesson generalises well beyond one company: sensitive information typed into an unconfigured, ungoverned tool becomes a permanent risk the moment it is submitted.
Brand and reputation. How you talk about AI in public matters as much as how you use it in private. In 2025, Klarna’s chief executive publicly acknowledged that replacing several hundred customer-service roles with AI had gone too far, and the company began rehiring.6 The framing — “AI instead of people” rather than “AI supporting people” — shaped how customers and media responded as much as the technology itself did.
Bias and discrimination at scale. Workday, the HR software provider, is defending a US collective action alleging its AI-powered recruitment tools disproportionately screened out applicants over 40.7 When one person makes a poor judgement, it affects one decision. When an algorithm shapes thousands of decisions, an undetected flaw compounds before anyone notices it exists.
The MIT AI Risk Repository, an independent academic effort to map the field, groups AI risk into seven domains: discrimination & toxicity, privacy & security, misinformation, malicious use, human-computer interaction, socioeconomic & environmental impact, and system safety & limitations.8 Naming a risk inside one of those seven domains turns a vague unease into something a leadership team can actually discuss, assess and manage.
The exposure in the mid-market is not hypothetical. A 2026 survey by Netrio found 73% of mid-market organisations had experienced a confirmed AI-related security incident or a near miss in the past year, while only 26% described their AI use as scaled and governed enterprise-wide, and just 42% had a formally enforced AI policy.2
We take clients through three stages to move from exposure to control.
AI is usually billed on usage, so spend stays invisible until the invoice arrives — and the better a tool works, the more people use it, and the faster the bill grows. The fix does not require a new department: configure which capabilities are switched on by default, set spend alerts at business and individual level, and write down, briefly, what usage is and is not approved. Reviewed quarterly, that is enough to turn an unpredictable cost into a managed one.
Training tends to follow one of three shapes: an unplanned “wild west” most organisations start in by accident; a top-down cascade from a central team; or a champions network that translates responsible use into the daily reality of each department. The third consistently produces the most durable behaviour change. Done properly, risk control is not a brake on AI adoption — it is what makes scaling it possible at all.
Every leader we work with eventually discovers, first-hand, that organisations typically spend several times more on the services around a piece of software — implementation, integration, training, support — than on the licence itself. The installation is the easy part. Getting an organisation to actually change how it works is where the budget, and the difficulty, really sit.
Research consistently puts the failure rate of digital transformation initiatives at close to seven in ten, and the usual cause is not that the technology fails to work.9 It is that changing embedded habits, across an entire organisation, is genuinely hard — and most transformation budgets treat change management as an afterthought rather than a core workstream.
We see this precisely in AI adoption. Give an entire team identical access to the same tool, the same licence and the same training session, and a consistent split appears: roughly half use it regularly, and half barely touch it. That is not a technology gap. People who say “I don’t have time” more often mean “I don’t know how” or “I’m worried about looking incompetent trying.” Fear, unfamiliarity and comfort with the existing way of doing things are the real barriers, and a single training day does not move them.
Two things reliably move the reluctant half. First, seeing a named colleague — not a case study from a famous company — save real hours using a tool; proof from someone sitting three desks away lands harder than any benchmark. Second, clarity: telling a team plainly that using a tool is now part of the job, rather than an optional extra. Underneath both, ongoing coaching — weekly or monthly, for months rather than one afternoon — reliably outperforms training treated as a box to tick.
None of this argues for removing people from the loop. It argues for the opposite. Treat AI the way you would a capable but overconfident new starter: brief it clearly, check its work, coach it, and expand what you trust it with as it earns that trust. AI drafts and checks; people own the judgement calls, the relationships, and everything that ultimately reaches a customer. Handled this way, AI does not reduce the value of experienced people — it makes their judgement the thing that scales.
Treated separately, each of these themes eventually breaks down. Value pursued without risk control is fragile — a single leak, biased outcome or public misstep can erase years of quietly compounded gains overnight. Risk control without genuinely enabled people becomes paperwork: a policy nobody reads, beside tools nobody was taught to use well. And enabling people without clear direction just moves an organisation faster towards a destination nobody chose.
The organisations pulling ahead treat value, risk and people as one connected discipline, each reinforcing the others. Enabled people spot better automation opportunities and surface the client-facing ideas that create real differentiation. Automating the right processes frees the time and budget to invest properly in training and governance. Client-facing AI, built responsibly, teaches the organisation lessons that sharpen internal practice. None of the three works in isolation for long.
This is the approach we apply inside our own business, before we recommend it to a single client: pointing AI at named problems, connecting it to knowledge we already hold, building the governance that lets us move quickly without moving recklessly, and treating our own team’s adoption as a capability worth investing in continuously.
We built this firm on a simple belief: your data sets the direction, and AI gets you there faster — but only once you have decided where “there” actually is. Nine years on, we believe that more than ever.
We are data and AI thinkers and builders, founded in 2017 to help ambitious mid-market organisations access the kind of data and AI capability usually reserved for much larger enterprises. We work as data strategists, analysts, visualisation specialists and full data-and-AI transformation partners — and we aim to be our clients’ partner for life, not their project for a quarter.
If any part of this paper reflected a conversation happening inside your own leadership team, the next step is a straightforward one. We offer a free 90-minute data and AI assessment for leadership teams who want an honest, evidence-based view of where they stand on value, risk and people — and what to do about it next.
The rest of this guide is free — tell us where to send it and it unlocks right here on the page.