How to build an AI strategy

An AI strategy is the set of choices through which an organisation creates value with AI. It settles where to focus, what to build and what to buy, and which foundations to fund first. The AI glossary gives the term a short definition.

Where does building an AI strategy start?

Building an AI strategy starts with an assessment of where you are now, based on signs you can observe. Check whether there are written guidelines for using AI, whether people use tools on company or personal accounts, whether someone is named as responsible and whether anyone tracks a metric. A general impression of where you stand is not enough: research shows that people’s perception of their own behaviour is systematically inaccurate.

The starting point is rarely zero. Employees adopt AI on their own initiative, whatever the organisation has decided. An organisation that thinks it has not started yet is probably at the ungoverned level already, without knowing it. The Sofokus AI Maturity Model describes the signs at four levels: the ungoverned level, the individual level, the process level and the organisation level.

Who writes the AI strategy?

The executive team is responsible for drawing up the AI strategy, but the decisions involve the whole governance chain from owners to the board. The AI guide for business leaders describes that chain with the AI CODES model. The AI CODES model adds specialists and customers to the chain. Neither group belongs to the traditional governance chain, yet both affect whether AI transformation succeeds.

You can put the first version together by having each role work through the themes in its own field and then drawing the results together.

How do you choose a target level?

You choose the target level on the basis of your strategy, your industry and your business goals. For most organisations the highest maturity level is more of a direction than a destination, and choosing it commits you to continuous upkeep: overseeing agents, following metrics and updating processes. A lower target level does not mean you have fallen behind. The Sofokus AI Maturity Model uses the international leading edge as its reference point.

Where should AI be focused?

Focus AI where it removes a fundamental constraint on the business. If AI only speeds up tasks while the processes stay the same, the system around it does not change. Prioritising is the core of the strategy: not every use case that is technically possible is worth building.

In an example from the AI guide, Reckitt looked into uses for AI in areas such as customer service. Most of the options it examined were expected to bring returns and save time, yet the company’s leadership turned them down. The options were isolated from one another and did not create a strategic advantage. While setting the focus you also decide what to build in-house and what to buy ready-made. An organisation can make that buy-or-build decision at any maturity level.

What does AI cost, and how should you budget for it?

People’s work is usually the largest cost in AI. BCG’s 10-20-70 rule of thumb splits an AI budget into a tenth for algorithms, a fifth for technology and data and the rest for processes and people.

Agent costs follow the same pattern: according to McKinsey, 20 to 25 per cent goes on tokens, the units of text a language model processes, and the rest on human oversight.

The recurring costs of generative AI solutions easily exceed the initial investment, so budget for them from the start. Judge the investment by what a finished piece of work costs. If you measure the number of agents or tokens instead, it is easy to optimise the wrong things. Record in the strategy who decides on the AI budget.

What should you measure to know an AI strategy is working?

Measure an AI strategy with before-and-after measurements for each process. Employees’ own estimates of time saved are not a sound basis for a business case. In a METR study, experienced software developers estimated that AI had sped up their work by about 20 per cent, while the researchers’ measurements showed it had slowed down by 19 per cent. In a Danish register study, employees estimated they saved about three per cent of their working time, yet no effect on hours worked or earnings was found.

Alongside the metrics, the strategy sets out where the time freed up by AI should go. Freed-up time does not turn into business results on its own, which makes directing it a leadership question.

What should the strategy say about data security and regulation?

Decide in the strategy what data may be fed into AI and in which runtime environment. Given the risks, the AI guide for business leaders advises against employees using a public AI model on their personal accounts. Marketing data, for example, can be handled through a business subscription to an AI service, and customer data in the organisation’s own environment. Most organisations use more than one runtime environment side by side.

The EU AI Act also belongs in the strategy. It was amended in 2026 by the AI Omnibus update (Regulation (EU) 2026/1744), and a lot of out-of-date information about the Act is still circulating online.

Get in touch

Tell us about your project, and let’s talk more. We’ll go through your organisation’s situation and goals and assess together where the project should start.

Book a remote meeting with Matias Book a remote meeting with Otto