What an AI Strategy & Roadmap Actually Is

An AI strategy is a written, board-approved view of which parts of the business AI will change, in what order, with what budget, against what success metrics, and with what governance. A roadmap is the time-phased plan that turns the strategy into shipped systems. Most companies have neither. They have a slide deck, a vendor list, and an enthusiastic Slack channel.

The artifact has to satisfy three audiences simultaneously: the board (capital allocation, risk, competitive positioning), the executive team (operational changes, hiring, vendor commitments), and the engineering team (architecture, sequencing, evaluation). Strategies that fail one of those three readers get reshaped within 90 days of approval.

• A diagnosis: where the company is on AI maturity today, scored across strategy, data, technology, governance, talent, and culture
• A use-case shortlist: the top 3-7 workflows AI will change, ranked by impact-per-week-of-build
• A sequencing plan: which workflows ship first, second, third, with phase gates and decision triggers
• A budget: 12-18 months of spend by category (models, infra, headcount, vendor, evaluation, governance)
• A governance baseline: which framework (NIST AI RMF, ISO 42001, EU AI Act readiness) the organization is aligned to
• A talent plan: which roles are hired, in what order, and which work is outsourced or paused
• A measurement plan: baseline metrics today, leading indicators monthly, lagging indicators quarterly
• A risk register: top 5-10 risks (regulatory, vendor lock-in, model deprecation, reputational, security) and the controls for each

Who Needs One and When

The roadmap engagement is most valuable in three settings: a CEO or founder approving the first significant AI investment, a CTO inheriting a chaotic AI portfolio of pilots that never shipped, and a board needing an external view before a major AI commitment or acquisition. The wrong time to commission a roadmap is during active fundraising, when the strategy is performance for investors rather than a real internal plan.

• Pre-investment CEO: $500K-$10M of AI spend on the table, no internal AI executive yet, needs board-defensible plan
• New CTO or CAIO: inherited 6-15 stalled AI pilots, needs to kill some, accelerate others, and tell a coherent story
• Mid-sized company first AI initiative: 100-2,000 employees, no AI work yet, board pushing leadership to ship something credible
• Pre-Series A or pre-Series B: investor diligence will ask for AI strategy as a defensibility question
• M&A target evaluation: independent AI strategy review of an acquisition candidate before signing
• Post-incident reset: an AI program had a quality, cost, or compliance incident; the board demanded a refreshed strategy
• Regulated industry entry: financial services, health, defense, legal, where AI strategy and AI governance ship as a single document

How to Identify the Right AI Use Cases

Most AI strategies start with the wrong unit of analysis. They list technologies (RAG, agents, fine-tuning, copilots) instead of workflows. The right unit is the workflow: a specific, repeatable sequence of work done by a specific role, with a measurable cost today and a measurable outcome you can score. AI candidates are the workflows with the highest ratio of repetitive cognitive work to skilled judgment.

Practical method: spend 1-2 weeks running structured interviews with 8-15 people across operations, customer support, finance, sales, legal, and engineering. Ask three questions per workflow: how often does it happen, what does it cost in time and money, and how much of it is pattern-matching versus expert judgment. The top of that list is the use-case shortlist.

• Inventory workflows by frequency (daily, weekly, monthly), cost per execution, and judgment density
• Score each workflow on AI feasibility: deterministic rules, probabilistic LLM, hybrid with humans in the loop
• Filter for data availability: workflows where the inputs and outputs are already captured in systems you control
• Rank by impact-per-week-of-build, not by impact alone. A 6-week build with 0.5x impact beats a 26-week build with 1x impact
• Identify the wedge: the smallest scope that produces a credible internal demo within 30-60 days
• Reject the obvious shiny use cases that have no data, no metric, or no owner who will use the output
• Pressure-test each candidate by asking the proposed user: "if this works perfectly tomorrow, what changes about your day?"

Sequencing: The First 90 Days, the First 12 Months

Sequencing matters more than the use-case list. The first 90 days have to produce something a non-technical stakeholder can see and use, because that is what funds and de-risks the harder work in months 6-18. Stanford's 2026 Enterprise AI Playbook, based on 51 successful deployments, found that organizations that hit "strategic integration" (AI tied directly to OKRs and incentives) all started with a narrow first ship before broadening.

• Days 0-30: AI maturity assessment, use-case shortlist, governance baseline, executive alignment
• Days 30-60: pilot the smallest wedge in shadow mode (AI suggests, human decides) on one workflow, one team
• Days 60-90: production launch of the wedge with monitoring, evaluation, and a written incident plan
• Months 3-6: extend the wedge to adjacent workflows or teams, add a second use case in parallel
• Months 6-12: production hardening, eval framework, governance procedures, second and third use cases shipped
• Months 12-18: portfolio mode, multiple use cases in production, centralized eval and observability, AI org structure formalized
• Decision gates between phases: kill, continue, accelerate. Written criteria, not vibes

Board-Ready Deliverables

The strategy lives or dies on what the board reads. A 60-page slide deck is not the right artifact; a 2-page executive summary backed by a 15-page strategy document and three supporting appendices is. The board should be able to make a capital allocation decision from the executive summary in 10 minutes, and an audit committee should be able to verify the governance baseline from the appendices in another 30.

• Executive summary (2 pages): the bet, the budget, the timeline, the top 3 risks, the next 90-day deliverable
• AI maturity assessment (4-6 pages): scored across strategy, data, technology, governance, talent, culture
• Use-case shortlist (3-5 pages): 3-7 prioritized workflows, business case for each, ROI projection, dependencies
• Roadmap (2-3 pages): phased plan with decision gates, owners, and budgets
• Governance baseline (3-5 pages): NIST AI RMF and ISO 42001 alignment, EU AI Act exposure, controls and owners
• Risk register (1-2 pages): top 5-10 risks, owners, mitigations, residual risk rating
• Talent and org plan (2-3 pages): hires and in what order, internal training, vendor relationships, external advisors
• Shadow AI inventory (1-2 pages): unauthorized AI tools already in use across the business, with a containment plan
• Board-facing financial model: 18-month spend by category, payback period per use case, sensitivity analysis

ROI Thresholds That Hold Up to a CFO

Most AI ROI projections inflate by ignoring integration cost, ongoing tuning, and the human-in-the-loop work that never goes away. A CFO-credible ROI model assumes 3-6 month payback for productized workflows (copilots, internal search, support deflection) and 9-18 months for novel agentic systems. Anything claiming 30-day payback on a build-from-scratch agent is selling, not modelling.

• Include integration cost: typically 1.5-3x the headline build cost, especially for systems that touch CRM, ERP, or core financials
• Include ongoing model and infrastructure cost: tokens, compute, vector storage, observability, eval tooling
• Include human-in-the-loop labor at realistic rates, including the review and override loop that never disappears
• Include eval and governance overhead: at scale, 10-20% of AI engineering capacity goes to evaluation and monitoring
• Discount accuracy claims from vendor demos by 20-40% to account for production drift and edge cases
• Use payback period and IRR for go/no-go decisions, not lifetime value or addressable market
• Model three scenarios (base, downside, upside) with explicit probabilities, not single-point forecasts
• Build in a kill threshold: if the use case has not paid back by month X, sunset it. CFOs respect the kill clause more than the upside case

Build vs Buy vs Hybrid

The build-versus-buy decision drives more of the long-term cost than any model selection. The right default in 2026 is hybrid: buy the foundation models and infrastructure, build the orchestration, evaluation, and proprietary data integration. Building what is now a commodity (basic RAG, vector search, embeddings, generic chat UI) is the most expensive mistake in the strategy phase.

• Buy when: the workflow is generic, the vendor has 100x your eval coverage, vendor lock-in is acceptable, and the workflow is not a differentiator
• Build when: the workflow is your differentiator, the data is proprietary and sensitive, integration depth is high, or you need full control over the eval rubric
• Hybrid (most common): buy the LLM, observability, vector DB, eval tooling; build the orchestration, prompt library, evaluator rubrics, and data integration
• Avoid building commodities: vector search, embedding stores, basic RAG, chat UI, document parsing all have credible commercial offerings under $50K/year
• Avoid buying differentiators: if the workflow is the core IP of your business, do not outsource its quality bar to a vendor that serves 500 other customers
• Build evaluation and governance in-house, always. Eval is the spine of your AI program and cannot be outsourced credibly
• Vendor selection process: 4-6 week RFP, paid pilots with 2-3 finalists, written scorecards against your eval rubric, exit clauses on every contract

Why AI Strategies Stall

The patterns are repeatable across mid-size and enterprise companies. Most failed strategies are diagnosable in the first 90 days. The signals show up earlier than the body language admits.

• No named executive owner: AI is everyone's responsibility, which means nobody's, and decisions stall in committee
• Pilot purgatory: 8-15 pilots, none in production, no shared eval framework, no kill discipline
• Vendor-led strategy: the strategy is whatever the loudest vendor demoed last, not what the business actually needs
• No data foundation: AI use cases assume data quality and access the company does not have, work stalls in procurement and IT
• No evaluation: AI ships without a way to measure if it is right, then breaks quietly, then loses internal trust
• No governance baseline: legal blocks production launch in week 11 because there is no NIST or ISO alignment and no risk register
• Underfunded ops: build budget approved, run budget forgotten, the system ships and then degrades because nobody owns it post-launch
• Talent mismatch: hired ML researchers when the work needed AI engineers, or hired AI engineers when the work needed data engineers

How Mahmoud Runs an AI Strategy & Roadmap Engagement

My strategy engagements are scoped to 6-12 weeks with a fixed deliverable: a board-presentable strategy document, a roadmap, a governance baseline, and a 90-day execution plan. Most engagements start with a 1-week diagnostic (interviews, system review, shadow AI inventory) followed by 4-8 weeks of analysis and stakeholder iteration. The work is done with the executive team, not for them, because strategies that arrive as outside documents get rejected within a quarter.

I do not implement during the strategy engagement; that conflicts with the work of choosing what to build. Implementation, if I do it at all, is a separate consultant engagement after the strategy is approved. Many clients keep me on as a monthly independent advisor through the execution phase.

• Week 1: structured interviews (8-15 people across functions), system and data review, shadow AI inventory
• Weeks 2-4: use-case shortlist, sequencing options, build-vs-buy analysis, governance baseline
• Weeks 4-6: financial model, risk register, talent and org plan, written draft of the strategy document
• Weeks 6-10: executive alignment, board pre-read, refinement, final document
• Deliverable: 2-page executive summary, 15-25 page strategy document, 5-10 supporting appendices, financial model in spreadsheet form
• Optional handoff: monthly advisor retainer through the 6-12 month execution phase
• No implementation: clean separation between choosing what to build and building it

FAQ