An AI roadmap should sequence decisions, not decorate a calendar.

Roadmap question: Which business outcomes and workflow decisions deserve investigation, who may fund each gate, and who can stop or retire a use?

Minimum starting point

Leadership can name business priorities and risk tolerance, while domain owners can describe real work, constraints, affected people, and what a useful result would change.

Current evidence

Strategic priorities, current initiatives and tool use, workflow owners, affected groups, policies, regulatory and contractual duties, risk decisions, budgets, dependencies, and previous experiments or incidents.

Near-term work

Create one AI use register, assign purpose and accountable owners, screen consequences, group related dependencies, rank questions by decision value and readiness, and fund only the next evidence-producing gate.

Accountable owner

An executive sponsor owns portfolio tradeoffs and risk escalation. Domain owners retain process and outcome authority. Legal, privacy, security, finance, workforce, and procurement owners decide within their mandates.

Gate evidence

Complete ownership and purpose records, explicit exclusions, ranked candidate questions, dependency map, stage and exposure state, budget authority, stop conditions, and a review cadence that actually occurs.

Common failure

A list of ideas without owners, one loud department setting the portfolio, hidden employee tool use, pilots continuing by inertia, compliance review after commitment, or every proposal labeled strategic.

Capability retained

The business gains a maintained portfolio register and decision forum that can approve, hold, merge, narrow, sequence, or retire AI work without depending on one vendor or enthusiast.

Roadmap question: Where can a bounded system improve a real decision or service, and what must change around people, handoffs, exceptions, and authority?

Minimum starting point

A workflow owner can observe the current path, identify users and affected people, define a baseline and exceptions, and keep a safe manual or deterministic fallback.

Current evidence

Triggers, users, cases, volumes, timings, decisions, queues, handoffs, rules, systems, failure paths, review effort, incidents, outcome evidence, seasonality, and local workarounds.

Near-term work

Observe representative work, separate deterministic steps from inference, define the smallest valuable decision, make review and exception capacity visible, and redesign the operating path before automating it.

Accountable owner

The domain owner defines process truth and acceptance. Frontline users test usability and failure. Accountable leaders own staffing, service, customer, employment, financial, safety, and professional decisions.

Gate evidence

A measured baseline, agreed task and outcome, exception taxonomy, human decision map, failure consequence, fallback, user-research findings, and a trial boundary that can be enforced.

Common failure

Automating undocumented variation, treating speed as value, moving work into an invisible review queue, removing useful judgment, optimizing a local step while worsening the whole service, or ignoring non-users who are affected.

Capability retained

Workflow ownership, measures, exception handling, review standards, correction paths, and decision records become explicit and reusable beyond the first AI use.

Roadmap question: Which sources can support the intended task, under what authority, and who keeps their meaning, quality, access, retention, and correction current?

Minimum starting point

The business can identify authoritative records and owners, preserve provenance, distinguish missing from negative information, and restrict data before sharing it with a team, product, or provider.

Current evidence

Source systems and documents, data owners, definitions, lineage, access and lawful-use rules, quality findings, labels, timestamps, retention and deletion, contracts, known gaps, and correction history.

Near-term work

Build a task-specific source register, fix critical ownership and access gaps, establish versioned definitions and provenance, create protected evaluation material, and expose uncertainty instead of forcing completeness.

Accountable owner

Data and source owners decide authority, permitted use, access, retention, correction, and withdrawal. Domain experts decide meaning. Privacy and legal owners decide their respective obligations.

Gate evidence

Source and field coverage, provenance, permission isolation, quality by relevant segment, missing and conflicting evidence, correction flow, freshness, evaluation-set protection, and provider data-handling terms.

Common failure

A platform project without a task, copied private data, spreadsheets treated as governed truth, inconsistent definitions, model output written back as source fact, vendor access without exit, or synthetic completeness hiding real gaps.

Capability retained

The business retains a governed source register, shared definitions, permission model, correction process, evaluation assets, and owners who can add, change, or withdraw data deliberately.

Roadmap question: What is the smallest technical foundation that can enforce the current boundary and later support reliable operation, observation, recovery, and replacement?

Minimum starting point

A technical owner can map identities, systems, environments, interfaces, dependencies, threat paths, operational support, and the difference between an experiment and a production service.

Current evidence

Architecture and data-flow records, identities and roles, interfaces, environments, deployment and change paths, secrets, supplier components, telemetry, capacity, recovery evidence, support constraints, and exit requirements.

Near-term work

Reuse sound existing capabilities, isolate experiments, enforce least privilege and action limits, version interfaces and artifacts, capture approved telemetry, test failure and recovery, and avoid building a general AI platform before repeated need exists.

Accountable owner

Engineering owns system integrity and operability. Security owns risk treatment within its mandate. Service owners approve release and recovery priorities. Business owners retain consequential action authority.

Gate evidence

Threat model, permission tests, dependency and component records, environment separation, reproducible release, observability, load and failure results, rollback, continuity, incident route, cost visibility, and tested provider removal.

Common failure

Prototype code becoming production, shared credentials, unrestricted tools, weak tenant or record isolation, hidden provider changes, no telemetry, unbounded usage cost, fragile integrations, or infrastructure complexity exceeding team capacity.

Capability retained

The business gains proportionate identity, integration, release, telemetry, incident, recovery, cost, supplier, and exit patterns that later systems can reuse without forcing one model or platform.

Roadmap question: What evidence is required at each exposure level, how will failures be found, and who decides whether a version may continue, change, expand, or stop?

Minimum starting point

The task and consequences are defined, representative cases can be protected, users and affected perspectives can be included, and the business can observe real operation within approved limits.

Current evidence

Acceptance and refusal criteria, baselines, protected cases, segments, failure taxonomy, user and reviewer research, security and privacy assessment, accessibility needs, incident history, cost model, and change triggers.

Near-term work

Evaluate components and the whole system, begin in the least exposed lane, test misuse and failure, compare against the current process, bind evidence to versions, monitor live context, and revalidate material change.

Accountable owner

Evaluation owners preserve method independence. Domain owners judge task meaning. Qualified assurance owners assess within their competence. Release and risk owners accept, limit, suspend, or reject use.

Gate evidence

Results by task, segment, consequence, and version; baseline comparison; human workload; overrides and abstentions; security, privacy, and accessibility findings; incidents; reliability; operating cost; and realized outcomes over suitable time.

Common failure

A single aggregate score, testing on tuning material, provider benchmarks treated as local proof, review fatigue, silent drift, unmeasured downstream effects, inaccessible controls, or monitoring without response authority.

Capability retained

Evaluation cases, release gates, monitoring, incident handling, correction, revalidation, and retirement become part of normal service ownership rather than a one-time pilot ceremony.

Roadmap question: Which capabilities must remain inside the business, which may be sourced, what does the full operating choice cost, and how will knowledge survive staff or provider change?

Minimum starting point

Leaders can name accountable internal roles, current capacity, skill gaps, procurement authority, support expectations, financial constraints, and the minimum knowledge needed to operate and challenge the system.

Current evidence

Role and capacity map, key-person dependencies, training needs, vendor options and terms, data and model rights, support and response boundaries, implementation and run costs, usage drivers, transition plan, and exit obligations.

Near-term work

Assign internal owners before buying, compare build, product, service, and hybrid responsibilities, price the full lifecycle, contract for evidence and portability, transfer knowledge during delivery, and rehearse continuity and exit.

Accountable owner

Business owners decide operating model and outcomes. Finance owns budget treatment. Procurement and legal own commercial terms. Internal technical and domain owners accept knowledge transfer and ongoing responsibility.

Gate evidence

Responsibility matrix, capacity and succession plan, evaluated skill gaps, total cost scenarios and usage sensitivity, supplier evidence, contract rights, service and incident boundaries, transfer artifacts, portability test, and funded operating owner.

Common failure

Buying before ownership exists, one employee or contractor becoming the system, license price hiding review and integration cost, provider claims replacing local evaluation, vague support, missing rights, or an exit plan that has never been tested.

Capability retained

The business retains named owners, shared vocabulary, operating documentation, evaluation capability, financial visibility, supplier challenge, succession, and a credible path to replace or retire the system.