What is an AI readiness assessment?

An AI readiness assessment scores how prepared an organization is to adopt AI. Ahlchemy Fulcrum scores four legs — drivers, foundation, governance and capability — assigns a 1–5 maturity level, and identifies the single binding constraint to start with.

Which AI models and providers does it recommend?

It gives a vendor-neutral recommendation of the best-fit engine (access route) and model for the customer, weighing options across Anthropic Claude, OpenAI/ChatGPT, Google Gemini, xAI Grok, Meta Llama and Mistral, based on the use case, data sensitivity and regulatory obligations.

Does it cover AI governance and compliance frameworks?

Yes. A dedicated governance leg scores AI policy, use-case risk classification and accountability, mapped to NIST AI RMF, the EU AI Act and ISO/IEC 42001.

Is there a free way to try it?

Yes. Demo mode is a free preview that runs the core assessment and shows a sample starting point with AI assist and saving switched off.

Guide

How to Use Fulcrum

A discovery instrument you run live, during the call. You score what you hear across four legs; it finds the one weakest leg — the binding constraint — and resolves an honest starting point with a phased roadmap you can leave behind.

What it's for

Companies want to start their AI journey at the exciting use case. The discipline this tool sells is starting at the constraint, not the ambition — the right first move is a function of the weakest of the four legs, which is usually driver clarity, the data foundation or governance, not the fun part.

Run it live, in four legs

Set the scene. Fill in client, attendees, and date at the top. It autosaves as you go, so a call is never lost.
Score Leg 1 — the Driver as they talk: what's really pushing this, whether success is defined, whether there's a named sponsor and funded budget, and whether the stated driver matches the real one. The gap between stated and real is often the first insight worth naming.
Score Leg 2 — the Foundation: data readiness, platform & security posture, and how people reach AI today. Data reality blocks more AI work than model choice ever does.
Score Leg 3 — Governance & Responsible AI: a documented AI policy, risk classification of use cases, and clear accountability for outputs — mapped to NIST AI RMF / EU AI Act / ISO 42001. Thin governance is a gate, not a detail.
Score Leg 4 — the Capability: whether the team can evaluate AI output rather than trust it, their technical literacy, and whether they can sustain what you build after you leave.
Capture what they said in the notes field under each leg — verbatim quotes are gold in the readout.
Hit Resolve Starting Point once the driver questions are answered (more legs = a sharper result).

How it decides

Each leg meters 0–100 as you answer. The binding constraint is the lowest leg — that's what the recommendation keys on. It resolves to one of four starting points, in priority order:

Governance & Sanctioned Path — when sprawl is the driver or AI access is ungoverned. Guardrails before projects.

Manufacture Clarity — when the driver is a vague mandate with no measurable outcome. Don't build yet; convert it into a decision.

Foundation First — when the driver is real but the data/platform can't support it. Ship the unglamorous enabler first.

Narrow Pilot — when driver, foundation, and team are all ready. One small, legible, low-risk win that builds the muscle.

Two flags can fire alongside any result: a guardrail flag when AI access is ungoverned (a sanctioned path belongs in Phase 0), and a capability flag when the team is the weak leg (run a guided pilot so the win survives your exit).

The buttons

Resolve Starting Point generates the recommendation, reasoning, phased roadmap, and board-ready success criteria. Print / Save PDF produces a clean client leave-behind (it hides the controls and unselected options). New Assessment clears everything for the next call. Everything autosaves to this browser between sessions.

Field notes

Why most AI projects stall

Generation became free. Judgment didn't. The projects that fail rarely fail on the model — they fail on the operating system around it: integration, data, governance, and someone deciding what's actually worth shipping. These are real patterns, anonymized. Each one is a leg of the diagnostic, skipped.

95%

of enterprise generative-AI pilots delivered no measurable P&L impact.

The 5% that created real value didn't have better models. They had better operations — integration, clean data, and judgment. AI isn't a model you buy; it's a system you operate.

Source: MIT NANDA, "The GenAI Divide: State of AI in Business" (2025) — 300 deployments, 150 leaders

40% / 90%

Roughly 40% of companies have an official, sanctioned AI subscription — but around 90% of employees use their own AI for work anyway. Half your organization is already building in the shadows, often with customer data, in tools you don't control.

63%

of U.S. internet households now use AI tools — up from 51% a year earlier. The capability is everywhere; the governance almost never keeps pace with it. Parks Associates, 2026

The dashboards were green. The damage was in the tails.

Capability · Trust · the human in the loop

The autonomous-support rollback

What happened

A ~$14B fintech pointed a raw model straight at its customers, cut average resolution time from 11 minutes to 2 across 2.3M chats, and projected ~$40M in savings by replacing its support agents. The quarter's dashboards looked spectacular.

Why it stalled

Within a year it was quietly rehiring humans. The average was fine; the tails weren't — the edge cases, the angry customer, the moment that needed accountability. The metric that mattered (trust) never showed up on the dashboard until it was gone.

The lesson: don't aim a raw model at a customer until it's earned it. Point AI at internal enablement first, and measure the tails, not the average.

Driver · clarity

The gorgeous, useless dashboard

What happened

An executive asked an AI for a command-center dashboard. It arrived in 41 seconds — trend lines, a "readiness score" of 94.2, a "digital maturity index." It looked like a quarter of work from a BI team.

Why it stalled

It solved no stated problem. Nobody had asked for it. No decision changed because of it. The headline metrics were invented by the model. Polish used to be expensive — that's why we trusted it. Now polish is free, and it's the easiest thing in the world to mistake for substance.

The lesson: when something impressive appears, ask what decision actually changes because of it. If nothing changes, it's theater.

Foundation · data readiness

Same prompt, different data

What happened

The same model got the same word-for-word prompt — "write our Q3 executive strategy" — twice. Once against clean, current data; once against the company's actual operational data.

Why it stalled

Clean data produced a sound, defensible plan. The real data — duplicate customer records merged into one, a refund policy pulled from a stale 2019 file, a half-finished field — produced a confident, dangerous one: consolidate three "different" customers who were the same person, and "eliminate any customer who touches the red flag." Same model. The variable was never the model.

The lesson: the data layer decides the outcome. An exciting use case on a broken foundation produces a demo that never survives production.

Governance · the sanctioned path

The shadow workforce

What happened

A company with no approved AI path assumed that meant no AI risk. In reality, most of the staff were already pasting work — contracts, customer lists, support transcripts — into consumer chatbots on personal accounts to hit their numbers.

Why it stalled

You can't govern what you've refused to acknowledge. Banning AI doesn't stop adoption; it just pushes it into tools with no logging, no DLP, and no contract protecting your data. The first incident is a data-exposure one, and it ends the whole program.

The lesson: give people a sanctioned, governed sandbox — and make it easier than the shadow one — or they'll keep building the shadow one with your customer data.

None of these were model problems.

They were operating problems — a binding constraint named too late, or never. That's the entire point of the diagnostic: find the one leg that's holding everything back before you spend a quarter proving it the hard way.

Example deliverable

A sample report

This is a complete assessment for a fictional company, Meridian Retail Group, so you can see exactly what the engagement produces. The top is shown in full; the starting-point detail, phased roadmap, governance mapping and engine recommendation are what we deliver in the paid engagement.

Illustrative only — Meridian Retail Group is not a real client. Your own report is generated live from your answers.

Recommended starting point for Meridian Retail Group

Context: Retail & e-commerce · Private · PCI-DSS, CCPA / CPRA

Governance & Sanctioned Path

Guardrails before projects. Bring the shadow usage into the light.

Level 3 · DevelopingOverall readiness 54/100

Driver

Ready

Foundation

Partial

Governance

◀ Binding constraint

Capability

Partial

Why here

The driver is genuine and the data foundation is coming along (foundation 61/100), but AI is already in the building through ungoverned consumer tools — customer and order data is walking out the door into accounts you don't control (governance 32/100). This is the most urgent problem even though it isn't the one leadership asked about. You don't have an adoption problem yet; you have a governance problem, and the fix is a safe, approved way to use AI before a single flagship use case ships.

The discipline — what not to do yet

Do not lead with the flashy personalization use case. A win built on an ungoverned foundation is one data-leak incident — one PCI or CCPA exposure — away from ending the whole program.

Phased roadmap

Phase 0

Contain

Inventory what tools are already in use, by whom, with what data
Set a clear acceptable-use policy people can actually follow
Close the worst data-exposure paths first

Phase 1

Sanction

Stand up one approved, governed path to models
Route access through identity — logging, controls, DLP
Make the sanctioned path easier than the shadow one

Phase 2

Enable

Train teams on the approved path and critical evaluation
Publish patterns for safe, common use cases
Now a real pilot can ride on solid rails

Success criteria the board recognizes

Sanctioned AI access path live and adopted
Shadow-tool usage measurably down
Acceptable-use policy signed and understood

Governance mapping

Controls mapped to the frameworks in scope — NIST AI RMF (Govern / Map / Measure / Manage), the EU AI Act risk tiers, and ISO 42001 — with PCI-DSS and CCPA/CPRA obligations called out where customer data meets model access.

Use-case fit — value × feasibility

The personalization engine the business wants is high value but low feasibility today — sequence the governance enablers first. A governed internal-support assistant is the easy, high-confidence first win once the sanctioned path exists.

Recommended engine & model

For a PCI/CCPA-bound retailer, route access through a cloud platform under your existing contract and region rather than a direct consumer app, so data handling, logging and DLP are enforced by default. Match the model tier to the task — a fast, lower-cost tier for high-volume support classification, a frontier tier only where reasoning genuinely demands it.

🔒

This is the top of a full report

The complete starting point, the phased roadmap, governance mapping and the engine & model recommendation are delivered as part of your engagement.

Book a conversation

Reference

Engine & Model Solutions

The use case comes first; the engine and model come second. This is a vendor-neutral map of the major GenAI platforms and access routes — a decision framework to pick the best fit for a customer, not a leaderboard.

This is a framework, not a scoreboard. Specific models, prices, context windows and certifications change monthly — treat named products as a starting point and confirm current specs. Use the Recommend engine & model action on a result to apply these criteria to a specific customer.

The model is only half the decision

Picking the right AI, ML, or generative engine matters — but it's equally critical to put the right security and governance around it, and to build real skill in prompting. Prompting is a craft: it's developed through use as much as through training. Budget for hands-on practice, internal patterns, and review — not just a tool-selection decision. A capable team on a governed platform will out-perform a better model used carelessly.

Prompting that compounds

Prompting is the highest-leverage skill in an AI program and the one most teams underinvest in. These patterns hold across every engine and model — they're how you get consistent, reviewable output instead of one-off luck.

Set role, goal, and audience. Say who the model is acting as, what "done" looks like, and who the output is for. Ambiguity on any of the three is where results drift.
Show, don't just tell. One or two worked examples (few-shot) of the input→output you want steer the model more reliably than a paragraph of description.
Supply the context — don't rely on what it "knows." Paste the real document, data, or house style. Treat the model as capable but uninformed about your business until you've told it.
Ask for the exact structure you'll consume. Request the format downstream work needs — a table, headed sections, or strict JSON — so output is usable without reformatting.
Constrain and verify. Set boundaries (length, scope, what not to do), ask the model to flag where it's unsure, and check claims against sources. Confidence is not accuracy.
Build a prompt library. Capture the prompts that worked, version them like code, and share them. Prompting improves fastest when a team refines a common set rather than each person starting over.

Orchestration — using one AI to feed another

The strongest results often come from a chain, not a single call: each model does what it's best at and hands a clean, structured artifact to the next. This is a core capability to build — and to govern — not an afterthought.

The pattern in this very tool — Claude → Gemini. When we design branding, Claude drafts a precise, structured image-generation prompt (subject, style, palette, composition, negative constraints), and Gemini renders it. Claude plays to reasoning and tight specification; Gemini to image synthesis. Neither does the whole job alone — the handoff is the point.

Generate → render — a reasoning model writes the spec; a media model produces the asset (text→image, text→deck, text→code). The specifier and the renderer are different strengths.

Draft → critique → revise — a second pass (same or different model) reviews the first output against a rubric before it ships. Cheap insurance against obvious misses.

Plan → execute — a planner decomposes the task; faster/cheaper models run the sub-steps; results are reassembled. Reserve the frontier tier for the planning and the hard parts.

Extract → synthesize — a fast model pulls structured data from many sources; a stronger model reasons over the compiled set. Separate the grunt work from the judgment.

Make the handoff reliable: pass a contract (the exact fields the next step expects), not loose prose, and validate it before handing off; keep a human or an automated check at the seam, because chained errors compound; and govern the whole chain — data handling, logging and cost apply to every hop, not just the first. Match the model to the step: don't pay frontier prices for extraction, and don't hand final synthesis to a tiny model.

Choose in this order

Access route (engine) first. Compliance and data handling decide more than the model does — pick the route that satisfies the customer's regulatory and residency needs before anything else.
Provider / family second. Within an acceptable route, choose the vendor whose strengths and ecosystem fit the workload and the customer's existing stack.
Model tier last. Match capability to the task: a fast/cheap tier for high-volume simple work, a frontier tier only where the task genuinely needs it.

Access routes (the "engine")

Direct provider API — Fastest access to the newest models; you own governance, logging and data handling. Good for custom builds with an internal platform team.

Cloud platform (AWS Bedrock, Azure OpenAI / AI Foundry, Google Vertex AI) — Models run under your cloud contract, region and IAM; supports BAAs, data residency and swapping models behind one seam. The safe default for regulated or enterprise workloads.

Enterprise app (ChatGPT Enterprise, Claude Team/Enterprise, Gemini for Workspace, Microsoft 365 Copilot) — Fastest path to workforce productivity with admin controls and no build; less customization.

Self-hosted open-weight — Maximum control and data sovereignty; you run the infrastructure, scaling and safety. For air-gapped or highly sensitive environments with in-house ML capacity.

OpenAI — GPT / ChatGPT

Broadest ecosystem and mindshare; strong general-purpose and multimodal.

Pros

Largest tooling and integration ecosystem; deep developer familiarity
Strong general, coding and multimodal capability
Enterprise route via Azure OpenAI for in-tenant data, compliance and regional control

Cons

Fast release cadence can mean churn
Governance needs deliberate setup on the direct API
Top capability concentrated in higher-cost tiers

Best fit: Widest ecosystem, off-the-shelf workforce productivity, or Azure-centric enterprises.

Anthropic — Claude

Strong reasoning and long-context; safety-forward.

Pros

Strong at reasoning, long documents and careful instruction-following
Clear API data posture (no training on API data by default)
Available via AWS Bedrock and Google Vertex for enterprise/compliance routes

Cons

Smaller third-party ecosystem than OpenAI
Fewer consumer-facing features
Narrower multimodal breadth

Best fit: Regulated or document-heavy work; teams already on AWS or GCP.

Google — Gemini / Vertex AI

Deep Google Cloud and Workspace integration; strong multimodal.

Pros

Tight integration with Google Cloud, Workspace and BigQuery
Strong multimodal and long-context
Vertex AI adds enterprise controls, residency and multi-model access

Cons

Enterprise/developer experience can be uneven
Pulls you toward the Google ecosystem
Product naming and versions shift often

Best fit: Orgs already on Google Cloud/Workspace, or heavy multimodal and data-warehouse needs.

xAI — Grok

Fast-moving; real-time signal via X; strong on some reasoning/coding.

Pros

Access to real-time / X data
Rapid capability gains
Appealing where less-restrictive outputs or X integration matter

Cons

Newer enterprise, compliance and governance story
Fewer certifications and integrations
Smaller ecosystem and track record

Best fit: Real-time/social signal needs, or teams trading enterprise maturity for speed.

Meta — Llama (open weight)

Open-weight models you can self-host.

Pros

Self-host for data sovereignty, air-gapped or on-prem use
No per-token cost; full control and fine-tuning
Portable across clouds

Cons

You own ops, scaling, security and guardrails
Needs ML / infra talent
Frontier gap vs. top closed models on the hardest tasks

Best fit: Data-sovereignty or cost-at-scale needs with in-house ML capacity.

Mistral

Efficient open + API models; EU-based.

Pros

Strong open-weight options (self-host or API)
EU domicile helps GDPR / data residency
Efficient smaller models for cost and latency

Cons

Smaller ecosystem
Frontier gap on the hardest reasoning tasks
Fewer enterprise integrations than the majors

Best fit: EU data-residency needs, or cost-sensitive / self-host deployments.

Release history

Change Log

What's new in the Ahlchemy Fulcrum assessment.

v2.6Oct 2026 · current

Study tracks, now their own page — a dedicated learning area covering AI foundations (models, differences, APIs, model-and-tool pairing), a research library, the conference talk track, and full worked example reports.
Deeper worked examples — every example report now includes a recommended stack and models, a phased deployment timeline, the patterns that fit, and the starter templates to produce.
Drill-downs everywhere — studies, frameworks and case examples expand into as much depth as you want.

v2.5Oct 2026

Install & use offline — add Fulcrum to your phone or desktop and open it like an app; the pages keep working without a connection.
Shareable links for every section — the assessment, sample report, Why AI Stalls, solutions and more each have their own clean web address.
Version check — tap the version number top-left any time to see if a newer build is available.
Richer engine & model recommendation — the recommendation now spans the whole build-and-operate stack (platforms, developer tools, APIs, add-ons, process and starter templates), each with the reasoning.

v2.4Oct 2026

Reliability and performance improvements behind the scenes.

v2.2Oct 2026

Cleaner, shareable links — jump straight to any section of the tool.

v2.1Oct 2026

Cloud-synced progress — your assessment saves securely so you can pick it up on any device, plus reliability improvements.

v2.0Oct 2026

New "Why AI Stalls" page — the real-world patterns behind AI projects that stall (including the research showing most enterprise AI pilots deliver no measurable impact), and why the right place to start is your single binding constraint.

Earlier history — internal. Visible to you because you're signed in with the access code.

v1.9Oct 2026

Deeper initial assessment — the Quick pass gained three signals: leadership alignment on "why now" (Driver), whether AI can actually reach the systems where work happens (Foundation), and a governance/acceptable-use question so guardrails are scored from the first conversation. Answer wording is richer throughout. Quick now reads 12 signals across all four legs.
Sample Report page — a full example report (fictional Meridian Retail Group) you can show a prospect, with the lower half gated behind a fade and a call to action. Linked from the nav and from the teaser.
Cross-device save is live — the D1 database is bound; saving and reopening engagements across devices now works.

v1.8Oct 2026

Discovery header on two lines — Company, Contact and Email on the first row; Attendees and Date on the second. Company and Attendees are now wide enough to show the full value.
Answer cards, modernized — the question choices are now flat, clean selection cards (hairline border, no radio circle) with a crisp gold accent and check when chosen — the pattern current AI products use. Lighter and less busy than before.
Teaser now points the way — "Assessment complete" names which leg holds your binding constraint and gives a plain-language direction for where the work starts, while the named starting point, roadmap, governance mapping and engine/model pick stay reserved for the engagement.

v1.7Oct 2026

Answer options now match the refresh — the question choices were still reading as a flat radio list on the dark cards. They're now raised, tactile tiles (subtle gradient, depth, bigger crisper ring that glows on hover) with the same gold-check selected state as the rest of the controls.

v1.6Oct 2026

Modernized controls — retired the dated, flat inputs. Text fields and dropdowns are now defined and tactile with a single clean caret; answer options are proper selectable cards that lift on hover and show a gold check when chosen; regulatory chips are real toggles; buttons have press feedback. Consistent in light and dark; reduced-motion safe.
Solutions: prompting & orchestration — added "Prompting that compounds" (six field-tested practices) and "Orchestration — using one AI to feed another," including the Claude→Gemini pattern and reliable-handoff guidance.

v1.5Oct 2026

Branded PDF leave-behind — on the full report, "Download PDF leave-behind" generates a dark, on-brand one-pager with the Fulcrum mark, maturity band, the four legs, the recommended starting point, roadmap, success criteria and value×feasibility — the artifact to hand the client after the call. (Available on the unlocked report.)

v1.4Oct 2026

Animated score reveal — on Resolve, the readiness scores count up and the leg bars fill in sequence, then the binding constraint pulses.
Demo badge now reads "Preview — no saving"; widened the intro line so it no longer wraps early.

v1.3Oct 2026

Living diagnostic band — the synapse network now continuously forges new paths and fades old ones in a smooth loop, with pulses firing along the active connections.

v1.2Oct 2026

Compact sticky header — logo, wordmark, nav and theme toggle in one row; the dead space up top is gone.
Hero brought to life — denser spark field with a living node lattice, a pulsing energy glow, a scan beam, and subtle mouse parallax on the brain.
Modernized controls — inputs and dropdowns reworked with gradient borders, focus glow and crisp chevrons (no more dated boxes); a subtle circuit-grid motif in the flow.

v1.1Oct 2026

Cinematic hero — an AI-brain visual with live sparks, headline and calls to action opens the assessment.
Live synapse band above the mode selector — an animated neural motif echoing ahlchemy.org.
A more technical, AI-forward look — monospace data labels, tighter energy — and slimmer, less-blocky question controls.
Solutions: added a note that security, governance and prompting skill matter as much as model choice.

v1.0Oct 2026

New look, aligned to Ahlchemy. Clean, professional light theme matching ahlchemy.org, with a light / dark toggle (◐) — light by default. The gold Fulcrum mark and italic-emphasis headlines carry through both themes.
No change to the assessment flow — purely a visual refresh.

v0.9Oct 2026

Results gate. Public prospects now see a teaser — maturity level and confirmation that the binding constraint was found — with the named constraint, roadmap, governance mapping and engine/model recommendation reserved for the professional engagement.
Lead capture — a prospect can request the full assessment with name, company and email; it's saved and you follow up to deliver the deal.
Access code unlocks the full report in-place for you, verified server-side.

v0.8Sep 2026

Expanded SEO to cover every feature — maturity model, governance/compliance frameworks, vendor-neutral model picks, value×feasibility, demo mode — with richer social cards, keywords, and FAQ structured data.

v0.7Sep 2026

Raised the AI response limit so enrichment and recommendations no longer get cut off, plus a tolerant parser that recovers partial responses instead of showing raw text.
Clearer messages when the model returns nothing usable.

v0.6Sep 2026

Use-case value × feasibility read on the result — a 2×2 plot of the first move with a plain-language verdict (Deep mode).
This Change Log page.

v0.5Sep 2026

Quick / Deep / Demo modes. Quick for the initial discussion, Deep for the full evaluation, and a public "Check it out" preview with AI and saving switched off (shareable ?mode=demo).
Measurement / ROI signal on the Driver leg; culture / adoption signal on the Capability leg (Deep).

v0.4Sep 2026

Governance & Responsible-AI leg — policy, risk classification, accountability, mapped to NIST AI RMF / EU AI Act / ISO 42001.
Strategy signals on the Driver leg (executive sponsor, funded budget); a 1–5 maturity band headline.
Full SEO for AhlchemyFulcrum.com (meta, Open Graph, JSON-LD, sitemap, robots, link-preview image); hash-based direct links.

v0.3Sep 2026

Solutions reference page (vendor-neutral) and an AI "Recommend engine & model" action.
Contact capture (name · company · email); D1 cross-device save & load.

v0.2Sep 2026

Business Context (industry, ownership, regulatory frameworks) and AI enrichment via a Cloudflare Worker + Anthropic API.
In-app assist-model selector (Haiku · Sonnet · Opus).

v0.1Sep 2026

Core assessment (Driver · Foundation · Capability) with live scoring, the binding-constraint recommendation and a phased roadmap.
Version chip, How to Use page, and the Ahlchemy Fulcrum logo, favicon and home-screen icons.

Study track · AI foundations

AI, models & tooling — a working guide

What the terms mean, how the major models differ, how you actually reach them, and how to pair a model and a toolset to a job. Written to make you fluent on a client call, not to pass an exam.

Specifics move monthly. Model names, context sizes and prices change constantly — learn the shapes and trade-offs here, and confirm the current numbers before you quote them.

1 · The landscape in plain words

AI: The umbrella: software that does things we'd call "intelligent." Everything below is a subset.
Machine learning (ML): Systems that learn patterns from data instead of being explicitly programmed. Powers forecasting, fraud detection, recommendations — often the right tool, and cheaper than GenAI.
Deep learning: ML using large neural networks. The engine under modern speech, vision and language.
Generative AI (GenAI): Models that produce new content — text, images, audio, code — rather than just classifying or scoring. This is what most people now mean by "AI."
Large language model (LLM): A GenAI model trained on huge text corpora to predict the next token. The thing behind ChatGPT, Claude, Gemini.
Multimodal model: An LLM that also takes or makes images, audio, or video — not just text.
Agent: An LLM given tools and a goal, allowed to take multiple steps (call an API, read a file, decide the next action) instead of answering in one shot.

Rule of thumb for clients: if the job is "predict/score from structured data," it's probably classic ML. If it's "understand or generate language/content," it's GenAI.

2 · How an LLM actually works (just enough)

Tokens: models read and write in tokens (word-pieces), not words. Cost and limits are counted in tokens (~750 words ≈ 1,000 tokens).
Context window: the total tokens it can "see" at once (prompt + conversation + documents + answer). Bigger windows fit more source material but cost more and can dilute focus.
Training vs inference: training is the one-time, expensive learning phase; inference is each live call you pay for. You rent inference.
Temperature: a creativity/randomness dial — low for precise/consistent, higher for varied/creative.
Knowledge cutoff: the model only "knows" up to its training date. For anything newer or private, you must supply the facts (that's what RAG and tools are for).
Why it hallucinates: it predicts plausible text, not verified truth. Confidence ≠ accuracy. Grounding and human review exist to catch this.

3 · The model families & how they differ

Family	Character & strengths	How you reach it	Reach for it when…
Anthropic — Claude	Strong reasoning, long-document work, careful instruction-following; safety-forward. Clear "no training on your API data" posture.	Direct API; AWS Bedrock; Google Vertex; Claude Team/Enterprise	Regulated or document-heavy work; teams on AWS/GCP.
OpenAI — GPT / ChatGPT	Broadest ecosystem and tooling; strong general + multimodal; fast feature cadence.	Direct API; Azure OpenAI; ChatGPT Enterprise	Widest integrations, off-the-shelf productivity, Azure shops.
Google — Gemini	Deep Google Cloud / Workspace integration; strong multimodal and long context.	Direct API; Google Vertex AI; Gemini for Workspace	Google-stack orgs; heavy multimodal or BigQuery data.
Meta — Llama (open weight)	Download-and-run models; full control and fine-tuning; no per-token fee.	Self-host; or hosted on Bedrock/Vertex/others	Data sovereignty, air-gapped, or cost-at-scale with ML talent.
Mistral (open + API)	Efficient open-weight and API models; EU-domiciled.	Direct API; self-host; cloud platforms	EU residency, cost/latency-sensitive, self-host.
xAI — Grok	Fast-moving; real-time signal via X; strong on some reasoning.	Direct API; X ecosystem	Real-time/social signal; speed over enterprise maturity.
Specialized models	Embeddings (for search/RAG), image (diffusion), speech-to-text & TTS, video, re-rankers — often from the same vendors or open models.	Same APIs / open weights	You need a specific modality, not a general chat model.

Vendor-neutral truth: on mainstream tasks the frontier models are close. The differentiator for a client is usually the access route and data posture, not a benchmark point.

4 · Tiers — and how to pick one

Small / fast tier: cheap, low-latency, great for high-volume, well-scoped tasks (classification, extraction, routing). Most production volume should live here.
Mid tier: the balanced default for assistants and drafting.
Frontier / reasoning tier: slowest and priciest; reserve for genuinely hard reasoning, planning, or ambiguous work. "Reasoning" models think longer before answering.
The pairing rule: match capability to the task, don't default to the biggest model. Pay frontier prices only where the task truly needs it; a swappable model "seam" lets you downshift later.
Also weigh: context window (how much source it must hold), multimodal needs, latency targets, and total cost at your real request volume.

5 · APIs & access routes

"The model" and "how you call it" are different decisions. Choose the route for compliance first, then the model for the task.

Direct provider API — fastest access to the newest models; you own logging, data handling and governance. Good for custom builds with a platform team. You authenticate with an API key, send tokens, get tokens back (often streamed), and pay per token.

Cloud platform (AWS Bedrock, Azure OpenAI/AI Foundry, Google Vertex) — the model runs under your cloud contract, region and IAM; supports BAAs, residency, DLP and swapping models behind one seam. The safe default for regulated/enterprise work.

Enterprise app (ChatGPT Enterprise, Claude Team/Enterprise, Gemini for Workspace, M365 Copilot) — fastest path to workforce productivity with admin controls and no build; least customizable.

Self-hosted open-weight — maximum control and data sovereignty; you run the infra, scaling and safety. For air-gapped or highly sensitive use with in-house ML capacity.

API literacy to carry: API key (secret, server-side only), tokens (what you're billed on), rate limits (requests/tokens per minute), streaming (tokens arrive live), context window (input cap), and data posture (is your data used for training? on enterprise routes, generally no — confirm per vendor).

6 · Pairing a model & tools to the job

Use case	What it really needs	Model tier	Supporting tools
Customer / internal support assistant	Grounding in your content; a human seam on risky replies	Mid; small for triage	RAG + vector store, guardrails/PII redaction, logging
Coding assistant	Strong code reasoning; repo context	Frontier/mid	IDE copilot, code search, test harness, human review
Document Q&A / knowledge	Retrieve the right passages, cite them	Mid	Embeddings + vector DB (RAG), re-ranker, citations
High-volume extraction / classification	Cheap, consistent, structured output	Small / fast	JSON/schema output, eval set, batch processing
Summarization	Enough context window; faithful to source	Small–mid	Chunking, grounding, a factuality check
Agents / multi-step workflows	Planning + reliable tool calls	Frontier/reasoning	Function calling, orchestration framework, tracing, limits
Image generation	A diffusion model, not an LLM	Specialized (image)	Prompt patterns, brand/style guardrails, review
Transcription / voice	Speech-to-text (and TTS to speak)	Specialized (speech)	Diarization, redaction, an LLM to summarize after
Semantic search	Meaning-based matching, not keywords	Embeddings model	Vector DB, hybrid (keyword+vector), re-ranking

The pattern: pick the capability the job needs, choose the smallest tier that clears the bar, and wrap it with the retrieval, structure and review it needs to be trustworthy.

7 · The supporting stack — the words around the model

Embeddings: Numeric representations of meaning. Turn text into vectors so you can find "similar" things — the basis of semantic search and RAG.
Vector database: Stores embeddings and finds the nearest matches fast (Pinecone, Weaviate, pgvector, and cloud-native options).
RAG (retrieval-augmented generation): Fetch the relevant passages from your data and hand them to the model so it answers from facts, with citations, instead of guessing. The workhorse pattern for enterprise Q&A.
Function calling / tools: Letting the model call defined functions or APIs (look up an order, run a query) and use the result. The bridge from "chat" to "does things."
MCP (Model Context Protocol): An open standard for connecting models to tools and data sources through a common interface — fewer one-off integrations.
Fine-tuning: Further-training a base model on your examples to specialize tone or format. Powerful but often unnecessary — try prompting + RAG first; fine-tune when you need consistent behavior at scale.
Evaluation (evals): A scored test set you run outputs against, so you can tell if a prompt or model change made things better — not just "feels better."
Guardrails & observability: Input/output filtering, PII redaction, and tracing/logging of every call — how you keep it safe and debuggable in production.

8 · Prompting & orchestration (the short version)

Prompting is the highest-leverage skill and it compounds with use. Set role, goal and audience; show examples; supply the context; ask for the exact format; constrain and verify; keep a shared prompt library. And the strongest results often come from a chain — one model (or model + tool) hands a clean, structured artifact to the next, e.g. a reasoning model writing a spec that an image model renders.

Full detail lives on the Solutions page ("Prompting that compounds" and "Orchestration — using one AI to feed another").

9 · Security, governance & cost — the non-negotiables

Data posture: know whether a route trains on your data (enterprise/cloud routes generally don't — confirm). Keep secrets and PII out of consumer tools.
Sanctioned path: give people an approved way to use AI, or they build a shadow one with your data.
Human in the loop on anything customer-facing or high-stakes — accountability doesn't transfer to a model.
Cost control: right-size the tier, cache repeated calls, cap context, and watch tokens at real volume — spend surprises come from frontier tiers on high-volume tasks.
Map to a framework: NIST AI RMF, the EU AI Act risk tiers, ISO 42001 (see the Research library).

10 · Glossary — quick recall

TokenThe unit models read/write and bill on (~¾ of a word).

Context windowMax tokens the model can consider at once.

ParameterA learned weight; rough proxy for model size/capacity.

InferenceRunning the model to get an answer — what you pay per call.

TemperatureRandomness dial: low = precise, high = creative.

HallucinationA confident, wrong, or made-up output.

GroundingTying answers to supplied facts/sources.

EmbeddingA vector capturing meaning for similarity search.

RAGRetrieve your data, then generate from it.

Fine-tuneSpecialize a base model on your examples.

MultimodalHandles images/audio/video, not just text.

AgentA model that plans and uses tools over multiple steps.

Function callingLetting the model invoke your APIs/tools.

MCPOpen standard to connect models to tools/data.

EvalA scored test to measure output quality.

GuardrailFilter/limit on inputs or outputs for safety.

QuantizationShrinking a model to run cheaper/faster, with some quality loss.

DistillationTraining a small model to mimic a big one.

Internal · conference prep

Study guide — Everyone's a Genius Now

The whole talk, beat by beat, with the numbers to memorize, the lines to land, and the questions you'll get. Built to study cold on a plane.

The thesis — say this if you say nothing else

Generation became free. Judgment didn't. In an era where anyone can generate anything, trust is the only currency left — and trust isn't a model you buy, it's a system you operate.

The promise to the room: you'll leave able to tell the difference between AI that changes a decision and AI that's just theater — and you'll know the one move that every version of the future rewards: judgment.

Who's in the room: executives and operators who are equal parts excited and afraid. Half have an approved AI tool; nearly all are already using one anyway. Meet the fear honestly, then reframe it.

The arc — beat by beat

01Open — "Everyone's a genius now."Then the turn: "That's the problem." Set the hook; don't resolve it yet.

02The autonomous-support demoPlay the bot scene. Let the room laugh, then sit in the discomfort: "no humans, no accountability."

03"Am I obsolete? Is my whole family?"Name the real fear in the room out loud. You earn the rest of the talk here.

04Exhibit A — the kidsYour three prompt-masters: a game, a song, a film. "Prompt masters — but are they developers, songwriters, filmmakers?"

05The one ideaGeneration became free. Judgment didn't. This is the spine — call back to it all talk.

06Prompting vs. craftGeneration is now free; judgment — edge cases, security, architecture, timing, presence — is now scarce.

07Micro Development Life CyclePrompt → Generate → Evaluate → Refine, in ~30 seconds. Every stage got cheap except judgment.

08The gorgeous, useless dashboard41 seconds, invented metrics. "Polish used to be expensive. That's why you trusted it."

09Same prompt, different dataClean data → sound plan. Real, stale data → a dangerous one. The variable was never the model.

10The $14B bot11 min → 2 min, then rehiring humans. "The dashboards were green. The damage was in the tails."

11The 95%Most pilots deliver no P&L impact. The gap wasn't models — it was operations: integration, data, judgment.

12Show of handsWhich team are you — ChatGPT / Copilot / Gemini / Claude / Grok? Now keep it up only if your company approved it.

13Shadow AI~40% have an official subscription; ~90% use their own anyway — with your customer data.

14Speed · Cost · TrustPick two. In the AI era the leg that snaps is Trust — and it has a name: the human in the loop.

15The human in the loopNot a bottleneck — your business insurance. Old question: will it function? New question: will it still matter?

162030Closer than the first iPhone. Don't build for a forecast; build for the one thing every version rewards — judgment.

17Go fast hereFast where it's reversible; slow where it isn't. The 5% who won fixed one painful thing completely.

18The operating playbook — one move per seatCTO: data governance is the strategy. Compliance: a sanctioned sandbox. CFO: measure the tails. CX: internal enablement first.

19The receiptThis whole talk was built with the tools in the room. "None of it took skill you don't have. It took judgment about what was worth making."

20Close"Are my kids developers? No. Neither are half the vendors selling you AI." Everyone's a genius now — that's the problem.

21Q&A / contactOne instruction to leave with: Monday morning — ask what decision changes.

Numbers to memorize (with sources)

95%of enterprise GenAI pilots deliver no measurable P&L impactMIT NANDA, "The GenAI Divide: State of AI in Business" (2025) · 300 deployments, 150 leaders

5%created real value — on operations, not models (integration, data, judgment)Same study. This is your pivot from fear to hope.

11→2minutes: the $14B fintech's support time — before it reversed course and rehired humansSay "a ~$14B fintech," not the name. 2.3M chats; ~$40M projected.

40 / 90% with an official AI subscription vs. % using their own AI anywayThe shadow-AI gap — your governance hook.

63%of U.S. internet households now use AI tools (up from 51% a year earlier)Parks Associates, 2026

~30sone full Micro Development Life Cycle (Prompt → Generate → Evaluate → Refine)Contrast with 2–4 weeks of classic Agile.

Verify any figure before you quote it live — studies get revised. If challenged on a number, cite the source and move on; don't defend a decimal.

Signature lines — deliver verbatim

Generation became free. Judgment didn't.

The dashboards were green. The damage was in the tails.

Polish used to be expensive. That's why you trusted it.

The human in the loop isn't a bottleneck. It's your business insurance.

AI isn't a model you buy. It's a system you operate.

When something impressive appears, ask what decision changes. If nothing changes, it's theater.

Transitions that carry the room

Fear → reframe: "So — am I obsolete? Here's the honest answer, and it's better than you think."
Demo → principle: "That was funny because it's real. Here's why it happened — and it isn't the model's fault."
Problem → evidence: "If that feels like an edge case, it isn't. The data says the opposite."
Evidence → action: "So what do you actually do Monday? One move per seat."

Q&A prep — the questions you'll get

"Aren't you just anti-AI?"

The opposite — I built this entire talk with it. The point isn't less AI; it's AI with judgment around it. The 5% who win use it more, and more carefully.

"Won't the models just get good enough to remove the human?"

Capability keeps rising; accountability doesn't transfer to a model. Someone still has to own the decision when it's wrong — that's not a skill gap, it's a liability question.

"We banned AI, so we're fine."

Banning it doesn't stop adoption — it moves it into tools with no logging and no contract protecting your data. ~90% use their own AI anyway. A sanctioned path is safer than a ban.

"Where do we even start?"

Not with the exciting use case. Start at your weakest leg — usually driver clarity, the data foundation, or governance. Fix one painful thing completely, internally, before you point a model at a customer.

"Which model should we buy?"

Wrong first question. Pick the access route that satisfies your compliance first, then the model tier that fits the task. The model isn't the moat; your data and governance are.

"How do we measure AI ROI?"

Measure the tails, not the average, and ask what decision changed. A dashboard that moves no decision has no ROI no matter how green it is.

Delivery & timing

Open cold — no "thanks for having me." Hit the title and the turn in the first 15 seconds.
Hold the pause after "That's the problem," after the bot scene, and after "95%." Silence sells the point.
Make the show-of-hands real — wait for the second ask ("company approved?") and let the hands drop. That's the whole governance slide, done by the room.
Land the receipt slowly — "the most moving thing here was made by an eight-year-old and an AI. Sit with that."
Close on the instruction, not on you: "Monday morning — ask what decision changes."

Internal · research library

Research library & where to start

The studies, frameworks, and real-world cases behind the diagnostic — with a starting path. Use these to back a claim, pick a framework, or arm a story on a client call.

Cite carefully. These are real, widely-reported sources, but figures and outcomes evolve — confirm the current number and status before you quote it publicly. Treat company examples as illustrations of a pattern, not gossip.

Where to start — a reading path

Frame the problem: read the MIT NANDA "GenAI Divide" summary — internalize that the gap is operations, not models.
Get the landscape: skim the latest Stanford HAI AI Index and McKinsey "State of AI" for adoption, spend, and value trends.
Get the guardrails: read NIST AI RMF (Govern/Map/Measure/Manage) and the EU AI Act risk tiers; know ISO/IEC 42001 exists as the management-system standard.
Collect the stories: keep two failures and two successes ready at all times (below) — specific, dated, and tied to a cause.
Translate to the client: for every source, be able to say the one decision it should change.

Foundational studies & frameworks

Tap any item to drill into the detail.

The GenAI Divide: State of AI in Business

MIT NANDA (Project NANDA) · 2025 · ~300 deployments, 150 leaders, 50+ interviews

The 95% stat — value comes from operations, not from a better model.

What it is

A 2025 study of real enterprise GenAI deployments (not lab benchmarks) measuring whether pilots reached production and moved the P&L.

Key findings

~95% of enterprise GenAI pilots produced no measurable P&L impact; only ~5% drove real value.
The gap was the "learning gap" — the winners' systems integrated into workflows, retained context and improved with use; most tools didn't.
Back-office / process automation quietly beat flashy customer-facing bets.
Buying/partnering often beat ground-up internal builds; the differentiator was operations (integration, data, workflow redesign, judgment), not model choice.

How to use it on a call

Open with it to move the conversation from "which model do we buy" to "which operations do we fix." It's the evidence behind the whole diagnostic.

The decision it should change

Stop evaluating models; invest in integration, data readiness and workflow redesign around one high-value process.

Where to find it

MIT NANDA / Project NANDA, "The GenAI Divide: State of AI in Business" (2025). Verify the exact sample and figure before quoting.

Stanford HAI — AI Index Report

Stanford Institute for Human-Centered AI · annual

The neutral, most-cited baseline on capability, cost, adoption and investment.

What it is

A large annual, vendor-neutral report tracking the state of AI across research, technical performance, economy, policy, education and responsible AI.

What you'll pull from it

Benchmark/capability trend lines (how fast models improved).
The steep fall in inference cost per task — useful to counter "AI is too expensive."
Adoption and investment figures by region and sector.
Responsible-AI and incident trends.

How to use it

When an exec distrusts vendor claims, cite the Index for a defensible, independent "state of the field" number.

The decision it should change

Calibrate budget and expectations to real trend lines instead of hype or fear.

Where

Stanford HAI, "AI Index Report" (latest annual edition).

McKinsey — The State of AI

McKinsey & Company · annual global survey

Where enterprises actually capture value, by function — and where they don't.

What it is

An annual global survey of organizations on AI adoption, value capture, and practices.

Key themes

GenAI drove a step-change in adoption, but few report enterprise-level EBIT impact yet.
Value concentrates in specific functions — marketing/sales, software engineering, customer service, supply chain.
"High performers" redesign workflows, assign clear ownership and invest in governance — they don't just bolt on a chatbot.

How to use it

Benchmark a client against peers by function and maturity; justify focusing the first use case where value actually lands.

The decision it should change

Pick the first use case in a function with proven value capture; commit to workflow redesign, not a tool drop-in.

Where

McKinsey Global Survey on AI (annual).

NIST AI Risk Management Framework (AI RMF 1.0)

U.S. NIST · Jan 2023 · + Generative AI Profile (2024)

The default, vendor-neutral governance spine for a U.S. enterprise.

What it is

A voluntary framework for identifying and managing AI risks across the lifecycle, widely adopted as the U.S. governance backbone.

The structure — four functions

Govern — the culture, policies, roles and accountability that cut across everything.
Map — context and risk identification for each use case.
Measure — analyze, assess and track the risks (metrics, testing).
Manage — prioritize, respond to and monitor the risks over time.

The GenAI Profile

A 2024 companion that names GenAI-specific risks (hallucination, data leakage, IP, prompt injection, CBRN/dangerous content) and suggested actions.

How to use it

Adopt the four functions as the client's governance operating model; structure every AI risk review around Govern/Map/Measure/Manage.

The decision it should change

Make this the backbone of the governance leg; map controls to it rather than inventing an ad-hoc process.

Where

NIST AI RMF 1.0 + the Generative AI Profile (NIST-AI-600-1).

EU AI Act

Regulation (EU) 2024/1689 · phased enforcement 2025–2027

Risk-tiered obligations for anyone touching EU customers or data.

What it is

The EU's horizontal, risk-based AI regulation — the first comprehensive AI law, with extraterritorial reach (it applies if your AI's output is used in the EU).

The risk tiers

Unacceptable — banned (e.g., social scoring, certain biometric practices).
High-risk — strict obligations (risk management, data governance, logging, human oversight, conformity assessment).
Limited — transparency duties (tell people they're dealing with AI; label AI content).
Minimal — most uses; no special obligations.
Plus obligations for general-purpose AI (GPAI) model providers.

A high-stakes advice bot was shipped without grounding in authoritative rules, without review, and without a clear owner accountable for wrong answers.

The sanctioned path was made easier than the shadow one, so people used it; governance was built in rather than bolted on.

Pattern: make the compliant path the path of least resistance.

Named here for your study. On stage, name the pattern and the lesson; anonymize the company unless you're certain of the current facts.

Internal · the full deliverable

Full reports — all four starting points

Every recommendation the engine can land, rendered in full on a representative company, so you know the entire deliverable cold — the "why here," the discipline, the roadmap, and the board-ready success criteria for each.

1 · Driver is the constraint

Recommended starting point for Beacon Industrial (example)

Context: Manufacturing · Private · ITAR / EAR

Manufacture Clarity

Don't build anything yet. Convert the mandate into a decision.

Level 3 · DevelopingOverall readiness 52/100

Driver

◀ Binding constraint

Foundation

Partial

Governance

Partial

Capability

Partial

Why here

The driver is a board mandate without a measurable outcome (driver clarity 34/100). Anything built now technically works and satisfies no one, because no one has agreed what "works" means. The first deliverable is agreement, not architecture.

The discipline — what not to do yet

Do not stand up a pilot, pick a model, or scope a build. Momentum here manufactures the wrong thing efficiently.

Phased roadmap

Phase 0

Frame

Interview each executive separately on what "success" means
Surface the gap between the stated and the real driver
Convert the edict into 1–2 candidate problems

Phase 1

Decide

Pressure-test each candidate for business value + AI fit
Agree one measurable outcome, or a deliberate board posture
Get written sign-off on the definition of done

Phase 2

Hand off

Re-run the assessment against the now-clear driver
Only then branch to Foundation or Pilot
Board-ready one-pager: here's our stance and why

Success criteria the board recognizes

A single sentence describing why someone benefits, with no technology named
An agreed, measurable outcome — or a defensible board posture
A named executive owner of the outcome

Recommended stack & models

Deliberately provisional — you lock this only after the driver is agreed. But for a private manufacturer under ITAR/EAR the shortlist is predictable, so pre-stage it:

Layer	Recommendation	Why here
Engine route	In-tenant / sovereign — Azure OpenAI in a controlled enclave, or AWS Bedrock (GovCloud where export scope demands it)	ITAR/EAR means technical data can't transit uncontrolled infrastructure. Rules out consumer tools and shared SaaS.
Primary model	Claude (Sonnet-class via Bedrock) or GPT-4o-class via Azure OpenAI	Both run inside your cloud boundary with no training on your data. Pick by which cloud already holds the controlled enclave.
Runner-up	Llama-class, self-hosted	Fallback for anything that must be fully air-gapped. Lower ceiling, but nothing leaves the wire.
Dev tools	GitHub Copilot (enterprise, telemetry off); a thin orchestration layer (LangChain / Semantic Kernel) only if an app follows	Keep the toolchain inside already-cleared vendors.
APIs / integrations	Bedrock / Azure OpenAI SDK behind an internal gateway; identity via existing SSO	One governed seam so the model stays swappable and every call is logged.
Add-ons	Private retrieval (vector store inside the enclave); DLP on the gateway	Ground answers on controlled documents without those documents leaving the boundary.

Deployment plan & timeline

Wks 1–3

Clarity (first)

Executive interviews; driver agreed & signed
No infrastructure spend yet

Wks 4–6

Pre-stage

Stand up the controlled enclave + gateway
Wire SSO, logging, DLP
Export-control sign-off on the architecture

Wks 7–10

Thin slice

One grounded use case on the agreed driver
Measure against the definition of done
Board readout: stance, cost, next bet

Patterns that fit

Retrieval over controlled documents — answer from your own specs/SOPs, cited, nothing leaves the enclave
Human-in-the-loop drafting — model drafts, a cleared engineer approves
Swappable-model seam — one gateway, model chosen per task, no lock-in

Starter templates to produce

Driver one-pager (problem · who benefits · measure · owner)
Definition-of-done sign-off sheet
Acceptable-use + export-control guardrail doc for AI tooling
Model-evaluation scorecard (accuracy · latency · cost · data-residency)

2 · Governance is the constraint

Recommended starting point for Meridian Retail Group (example)

Context: Retail & e-commerce · Private · PCI-DSS, CCPA / CPRA

Governance & Sanctioned Path

Guardrails before projects. Bring the shadow usage into the light.

Level 3 · DevelopingOverall readiness 54/100

Driver

Partial

Foundation

Partial

Governance

◀ Binding constraint

Capability

Partial

Why here

AI is already in the building through ungoverned consumer tools — customer and order data walking out the door (governance 30/100). This is the most urgent problem even though it isn't the one leadership asked about. You don't have an adoption problem yet; you have a governance problem, and the fix is a safe, approved way to use AI.

The discipline — what not to do yet

Do not lead with a flashy use case. A win on an ungoverned foundation is one data-leak incident — one PCI or CCPA exposure — away from ending the whole program.

Phased roadmap

Phase 0

Contain

Inventory what tools are already in use, by whom, with what data
Set a clear acceptable-use policy people can actually follow
Close the worst data-exposure paths first

Phase 1

Sanction

Stand up one approved, governed path to models
Route access through identity — logging, controls, DLP
Make the sanctioned path easier than the shadow one

Phase 2

Enable

Train teams on the approved path and critical evaluation
Publish patterns for safe, common use cases
Now a real pilot can ride on solid rails

Success criteria the board recognizes

Sanctioned AI access path live and adopted
Shadow-tool usage measurably down
Acceptable-use policy signed and understood

Governance mapping

Controls mapped to NIST AI RMF (Govern / Map / Measure / Manage), the EU AI Act risk tiers, and ISO 42001 — with PCI-DSS and CCPA/CPRA obligations called out where customer data meets model access.

Recommended stack & models

The deliverable here is the sanctioned path itself — the stack is the guardrail, not a feature. Make the approved route easier than the shadow one:

Layer	Recommendation	Why here
Engine route	Identity-brokered gateway in front of enterprise model APIs (no-train tier)	Everyone reaches models through one logged, controlled door — not consumer apps that pocket customer data.
Primary model	Claude (enterprise) or GPT-4o (enterprise, no-train)	Contractual no-training + data-residency terms are the whole point under PCI/CCPA.
Runner-up	Azure OpenAI in-tenant	When a use case touches cardholder or regulated PII and must stay inside your cloud.
Dev tools	Copilot (enterprise, no-retain); approved prompt library published internally	Give people a blessed, convenient option so they stop pasting into random tools.
APIs / integrations	SSO/SCIM for access; gateway SDK; SIEM feed for every call	Access tied to identity means instant revoke and a real audit trail.
Add-ons	PII/PAN redaction at the gateway; DLP; policy-as-code guardrails	Strip cardholder data before it reaches a model; prove it to an auditor.

Deployment plan & timeline

Wks 1–3

Contain

Inventory shadow tools, users, data touched
Publish an acceptable-use policy people can follow
Close the worst exposure paths

Wks 4–8

Sanction

Stand up the brokered gateway + SSO
Redaction, DLP, SIEM logging live
Make the sanctioned path the easy path

Wks 9–12

Enable

Train teams; publish safe patterns
Retire the worst shadow usage
One real pilot rides the new rails

Patterns that fit

Sanctioned-path broker — one identity-aware door to every model
Redact-before-prompt — PAN/PII stripped at the gateway, logged for audit
Policy-as-code — allow/deny rules enforced, not just written down

Starter templates to produce

Acceptable-use policy (plain-language, signable)
Data-classification map (what may touch which model route)
Shadow-tool inventory + migration tracker
AI-incident runbook (data-exposure response)
Control-to-framework matrix (NIST AI RMF · EU AI Act · ISO 42001 · PCI/CCPA)

3 · Foundation is the constraint

Recommended starting point for Cascade Health Partners (example)

Context: Healthcare · Non-profit · HIPAA

Foundation First

The unglamorous plumbing comes before the exciting use case.

Level 3 · DevelopingOverall readiness 56/100

Driver

Ready

Foundation

◀ Binding constraint

Governance

Partial

Capability

Partial

Why here

The driver is real, but the foundation can't support it yet (foundation readiness 38/100). The honest conversation: you want the use case, but your data/platform layer isn't ready, so the first project is the boring enabler that makes the exciting one possible. This is exactly why they hire an outside voice who can say it.

The discipline — what not to do yet

Do not promise the headline use case on this quarter's timeline. Building it on a broken foundation produces a demo that never survives production.

Phased roadmap

Phase 0

Assess

Map the data the real use case actually needs
Find the true gaps: access, quality, governance
Size the enabler honestly for the board

Phase 1

Build the base

Make the needed data accessible and governed
Shore up identity/security for AI access
Put a clean seam where models will plug in

Phase 2

Prove it's ready

A thin end-to-end slice on the new foundation
Confirm the exciting use case is now feasible
Sequence the real pilot next

Success criteria the board recognizes

Target data accessible, governed, and usable
A working thin slice through the new foundation
Board understands why the boring step was first

Recommended stack & models

Under HIPAA the foundation is the project — the model is the easy part. Everything below assumes a signed BAA and de-identification before model access:

Layer	Recommendation	Why here
Engine route	HIPAA-eligible, BAA-covered — Azure OpenAI or AWS Bedrock under a Business Associate Agreement	No PHI may touch a model without a BAA. This is non-negotiable and it rules out consumer tools.
Primary model	Claude via Bedrock (BAA) or GPT-4o via Azure OpenAI (BAA)	Both operate inside the covered boundary with no training on your data.
Data platform	Governed lakehouse + a de-identification pipeline (Safe Harbor / Expert Determination)	The binding gap: data isn't accessible, clean, or de-identified yet. Fix this before any use case.
Dev tools	Access-controlled notebooks; data-contract tests; lineage tracking	Prove where every field came from and who can see it.
APIs / integrations	FHIR/HL7 connectors; identity via SSO; gateway with full audit	Meet the data where it lives in health systems, governed end to end.
Add-ons	De-id service; consent/authorization tracking; minimum-necessary filters	Enforce HIPAA's minimum-necessary rule in the pipeline, not by policy alone.

Deployment plan & timeline

Wks 1–4

Assess

Map data the real use case needs
Find gaps: access, quality, de-id, BAA coverage
Size the enabler honestly for the board

Wks 5–12

Build the base

Make needed data accessible & governed
Stand up de-id pipeline + lineage
Clean seam where models plug in (BAA route)

Wks 13–16

Prove ready

Thin end-to-end slice on de-identified data
Confirm the headline use case is now feasible
Sequence the real pilot next

Patterns that fit

De-identified retrieval — ground on PHI-free records, re-link only under authorization
Data-contract — every input field has an owner, a definition, and a test
Thin vertical slice — one clean path end to end before breadth

Starter templates to produce

Data-needs map (use case → fields → source → gap)
BAA & vendor-eligibility checklist
De-identification spec (Safe Harbor fields / Expert Determination)
Minimum-necessary access matrix
Thin-slice feasibility brief for the board

4 · Team is ready — go

Recommended starting point for Northstar Software (example)

Context: Technology / SaaS · VC-backed · SOC 2

Narrow Pilot

One small, high-value, low-risk win that builds the internal muscle.

Level 4 · ScalingOverall readiness 69/100

Driver

Ready

Foundation

Ready

Governance

Ready

Capability

◀ Weakest leg

Why here

Clear driver, ready foundation, capable team — the healthy case. Start with a deliberately small pilot: chosen so a win is legible to the board and a loss is survivable. The point isn't the pilot's output; it's the internal capability and confidence it builds.

The discipline — what not to do yet

Do not scope big to look impressive. A large first bet that fails poisons the program; a small one that wins earns the right to the next.

Phased roadmap

Phase 0

Scope tight

Pick one narrow use case with clear value
Define the measure of success up front
Constrain blast radius — low risk if it fails

Phase 1

Ship

Build the thin vertical slice end to end
Keep the model behind a swappable seam
Instrument it — measure against the target

Phase 2

Transfer

Hand ownership to the internal champion
Capture the pattern for the next use case
Board readout: value proven, muscle built

Success criteria the board recognizes

One measurable win the board recognizes
The pattern is repeatable by internal owners
A ranked backlog of the next 2–3 use cases

Capability flag

Capability is the weakest leg here (65/100). Run the pilot as a guided one with capability-building baked in, or the win won't be sustained after the engagement ends.

Recommended stack & models

The healthy case — ready to build. Go API-first and keep the model behind a swappable seam so you can chase the price/performance curve:

Layer	Recommendation	Why here
Engine route	API-first — Anthropic / OpenAI direct (enterprise, no-train) or via Bedrock	SOC 2 is satisfiable with enterprise terms; direct APIs give you the newest models fastest.
Primary model	Claude Sonnet-class for the pilot's core reasoning	Strong quality-to-cost for production workloads; easy to swap up to a frontier tier for hard calls.
Runner-up	GPT-4o-class or Gemini-class behind the same seam	Keep two routes wired so a price or quality shift is a config change, not a rebuild.
Dev tools	Copilot / Cursor for the team; an eval harness from day one	Capability is the weak leg — tooling that teaches while it ships is the point.
APIs / integrations	Provider SDKs; LangGraph / lightweight orchestration; feature-flagged model router	One seam, instrumented, so ownership transfers cleanly to the internal champion.
Add-ons	Observability + eval (Langfuse / Braintrust); guardrails; prompt-version control	Measure quality against the target and keep it from regressing after you leave.

Deployment plan & timeline

Wks 1–2

Scope tight

One narrow, high-value, low-risk use case
Success measure defined up front
Build the eval set before the feature

Wks 3–6

Ship

Thin vertical slice end to end
Model behind a swappable seam
Instrument + run evals in CI

Wks 7–8

Transfer

Hand ownership to the internal champion
Capture the pattern for the next use case
Board readout: value proven, muscle built

Patterns that fit

Narrow vertical slice — one use case, end to end, legible win
Swappable-model seam — router + feature flags, no lock-in
Eval-in-CI — a scored test set gates every change
Internal champion — build capability into the delivery, not after it

Starter templates to produce

Pilot one-pager (use case · measure · blast radius · owner)
Eval set + rubric (golden cases, pass thresholds)
Model-router config (primary / runner-up / fallback)
Capability-transfer plan (who owns what, by when)
Next-3 backlog, ranked by value × readiness

Know where your AI journey actually begins.

The AI Readiness Assessment

How to Use Fulcrum

What it's for

Run it live, in four legs

How it decides

The buttons

Why most AI projects stall

The autonomous-support rollback

The gorgeous, useless dashboard

Same prompt, different data

The shadow workforce

None of these were model problems.

A sample report

Why here

The discipline — what not to do yet

Phased roadmap

Success criteria the board recognizes

Governance mapping

Use-case fit — value × feasibility

Recommended engine & model

This is the top of a full report

Engine & Model Solutions

The model is only half the decision

Prompting that compounds

Orchestration — using one AI to feed another

Choose in this order

Access routes (the "engine")

OpenAI — GPT / ChatGPT

Pros

Cons

Anthropic — Claude

Pros

Cons

Google — Gemini / Vertex AI

Pros

Cons

xAI — Grok

Pros

Cons

Meta — Llama (open weight)

Pros

Cons

Mistral

Pros

Cons

Change Log

Leads & saved assessments

Study tracks

AI, models & tooling — a working guide

1 · The landscape in plain words

2 · How an LLM actually works (just enough)

3 · The model families & how they differ

4 · Tiers — and how to pick one

5 · APIs & access routes

6 · Pairing a model & tools to the job

7 · The supporting stack — the words around the model

8 · Prompting & orchestration (the short version)

9 · Security, governance & cost — the non-negotiables

10 · Glossary — quick recall

Study guide — Everyone's a Genius Now

The thesis — say this if you say nothing else

The arc — beat by beat

Numbers to memorize (with sources)

Signature lines — deliver verbatim

Transitions that carry the room

Q&A prep — the questions you'll get

Delivery & timing

Research library & where to start

Where to start — a reading path

Foundational studies & frameworks

The GenAI Divide: State of AI in Business

What it is

Key findings

How to use it on a call

The decision it should change

Where to find it

Stanford HAI — AI Index Report

What it is

What you'll pull from it