Enterprise AI: What the Evidence Says About Getting It to Work

If you lead technology at a large organization, you already know what AI is. The harder question is how to adopt it without losing a year to pilots that go nowhere. Search for "enterprise ai" and nearly every result is a vendor explaining what the term means and why to buy. Definitions are easy to find. Evidence about what determines success is much harder to come by.

This article takes the independent route. It looks at what academic, government and standards-body research says about adoption, early results, organizational readiness, data quality, governance and the automation you already run. Each figure comes with its country, sector, year and sample, because a number from one US study should not be mistaken for a global rule.

It also says plainly where the evidence stops. Independent, vendor-neutral data on how often pilots fail, on how to measure return beyond cost savings, and on how buyers choose between platform types is thin. Where that is the case, we offer criteria and trade-offs to reason with, not a ranking dressed up as a finding.

What enterprise AI actually means (and what the definitions leave out)

Enterprise AI is not a single tool. It is AI wired into the document stores, workflows and records a large organization runs on, with the access controls and audit trails that implies. A chatbot a staff member opens in a browser tab is the consumer version used at work.

That also answers what an enterprise AI platform is. Gartner describes AI application development platforms as offering the technology and workflows to design, build, test and deploy AI applications, with access to foundation models and the ability to ground them and place guardrails around them ¹. A CIO.com commentary argues the near future will look less like one platform that does everything and more like a federation: agents at the base, curated data in the middle, orchestration on top ². Whichever framing you prefer, a platform is the tooling layer. It is not what makes a project succeed.

That is the gap in most definitions. They agree on scope and say very little about outcomes. The sections that follow cover the variables that appear to matter more than the label: how far adoption has spread, what the organization does around the technology, the quality of the data underneath it, and the governance wrapped around it. Adoption is already common among the largest firms, so the live question is no longer whether to start but how to get value once you have.

Where adoption stands, and why early results can disappoint

The most rigorous adoption numbers come from US government survey data, and they are dated. MIT Sloan's summary of a study linking a Census Bureau survey of 447,000 responses to 2017 business records reports that just 6% of US companies used AI in 2017, but more than 50% of companies with over 5,000 employees did, and more than 60% of those with over 10,000 ³. Use was concentrated in manufacturing and information technology. Treat this as a US snapshot from 2017, not a current global rate. A preprint on S&P 500 firms, which has not been peer-reviewed, reports that 21% of those firms scored a 4 or 5 on its own adoption rubric in 2025 ⁴, a different measure on a different population.

Adoption is not the same as payoff, and one study cuts against the hype. Using two Census Bureau surveys covering tens of thousands of US manufacturing firms in 2017 and 2021, researchers found that firms adopting AI for business functions saw productivity fall by 1.33 percentage points, even after controlling for size, age, capital stock and IT infrastructure. Over the longer run the picture reversed: across the four years between the two surveys, the manufacturing firms that adopted AI generally beat non-adopters on both productivity and market share ⁵. It is one study of one sector, so read it as a caution about time horizon, not a law. A pilot judged after a quarter may be judged at the bottom of the curve.

What separates firms that come out ahead? MIT's Center for Information Systems Research found that companies at the two earliest stages of AI maturity performed below their industry's financial average, while those at stages three and four were well above it, and that the biggest financial gain came from moving out of pilots into scaled ways of working ⁶. The result is an association, not proof of cause. Use it to support the point that scaling beyond pilots matters, not as a precise benchmark.

On benefits more broadly, Deloitte's enterprise AI report says 66% of organizations report productivity and efficiency gains, 53% better insight and decision-making, and 40% lower costs ⁷. These are self-reported. How to measure return beyond cost savings is not something this evidence settles; we return to that at the end.

The organization, not the model, decides the outcome

The strongest argument in the evidence is also the least glamorous one. Stanford's Digital Economy Lab studied 51 enterprise cases over five months and found transformations measured in weeks alongside others measured in years, with the same technology and the same use cases. Its conclusion was that the AI model was never what set the cases apart; the organization was, meaning its readiness, processes, leadership and willingness to change and to fail ⁸. The study describes its sample as enterprise cases, so it tells you what separated fast and slow deployments in those cases, not how often firms fail.

The same report puts a number on where the pain sits: 77% of the hardest challenges were invisible, intangible costs such as change management, data quality and process redesign ⁹. Budget conversations tend to center on licenses and compute. The study suggests the real effort is elsewhere.

So what organizational changes does adoption need? The evidence points to three. First, redesign the process around the AI instead of bolting AI onto the old one. Second, decide who owns outcomes and who reviews exceptions. Third, give the effort enough runway to get past the early dip described above.

The report also draws a useful contrast in operating model. Where AI handled 80% or more of the work autonomously and humans reviewed exceptions, median productivity gains were 71%, against 30% for approval models ⁹. Escalation-based designs only work if guardrails and review paths are sound, but the contrast suggests that universal human sign-off can cap the benefit before the model's quality becomes the limit.

Data quality: why more data is not the answer

A common instinct is to treat data as a volume problem: collect everything, then let the model sort it out. NIST's guidance for industrial AI says otherwise. Having more data does not automatically make a model better; what matters most is that the data accurately represents the environment and the problem you are trying to solve ¹⁰. NIST's own example is a factory that runs two shifts but has data from only one, so the model might not perform well during the second ¹¹.

The practical reading for an enterprise team is to ask representativeness questions before volume questions. Does the data cover the cases the system will actually face, including the awkward ones? Who decided what to leave out? Is the data current, and is anyone responsible for keeping it that way? NIST's examples are industrial, so the principle travels better than the specifics.

Other sources point the same way, with a more commercial edge. Gartner surveyed 1,203 data management leaders in July 2024 and found that 63% of organizations either do not have or are unsure they have the right data management practices for AI. In a February 2025 press release, Gartner also forecast that, through the end of 2026, organizations would abandon 60% of AI projects unsupported by AI-ready data ¹². That is an analyst forecast, and 2026 has not finished, so no outcome data exists yet. Read it as a warning that data readiness gets underestimated, not as a measured failure rate.

Where your data and models live: the deployment choices

Once the organizational and data questions are on the table, a decision-maker still has to choose where the system runs. The realistic options are vendor-hosted SaaS (a hosted copilot or agent product from a software vendor), a hyperscaler-native platform (for example the AI services offered by AWS, Microsoft Azure or Google Cloud), an in-house build, or a bespoke agent built by a consultancy or systems integrator. Each trades speed against control and effort. SaaS is typically fastest to start but leaves you configuring around someone else's data handling. An in-house build gives the most control and demands the most engineering and ongoing maintenance. Hyperscaler-native and consultancy routes sit between those poles.

What follows is reasoned judgment, not a ranking. Four criteria hold up. Data location: where do documents, embeddings and chat history physically sit, and who can reach them? Governance: can you audit what the system did and why? Integration: how cleanly does it connect to the systems you already run? Regulatory exposure: legal requirements such as nondiscrimination and data privacy and security controls can mandate documentation, disclosure and transparency, and they differ across applications and contexts ¹³. The same tool can be fine in one use case and problematic in another.

If speed to a first result is your main constraint, hosted options may win. If data control and auditability are the deciding factors, a deployment inside your own cloud account, whether built in-house, assembled on a hyperscaler's services or taken from a vendor such as The Agent Within, deserves a serious look. None of these is right for every enterprise, so weigh them as trade-offs against your own requirements.

Risk and governance: what the official frameworks say

Generic risk lists tend to say "bias, privacy, security" and stop. The official frameworks are more useful because they give a risk owner something to act on.

The NIST AI Risk Management Framework, released on January 26, 2023, is intended for voluntary use. Its aim is to make it easier to build trustworthiness considerations into how AI products, services and systems are designed, developed, used and evaluated ¹³. Voluntary matters: adopting it is a choice that signals maturity to customers and auditors, not a legal obligation in itself.

Legal requirements can apply separately from the framework. The implication is that governance cannot be a one-size checklist. A hiring screen and an internal document search carry different legal exposure, and your controls should differ accordingly. Have counsel confirm which requirements apply to each use case.

For multinational enterprises, the OECD's due diligence guidance for responsible AI is intended to support enterprises in implementing the OECD guidelines for multinational enterprises and the AI Principles ¹⁴. The OECD material also flags dual-use potential: AI systems designed to be innocuous can be repurposed or exploited by malicious actors ¹⁴.

A workable starting point is to map each AI use case to the data it touches and the decisions it influences, decide what documentation and transparency each warrants, and treat the NIST framework as the common vocabulary for doing so.

Coexisting with RPA and the automation you already have

Most large organizations are not starting from a blank page. They already run robotic process automation for invoice entry, record updates and data checks, and a reasonable worry is that enterprise AI means ripping that out. The research suggests it does not.

Peer-reviewed work from IEEE describes adding AI to RPA as a way to take operations beyond what ordinary RPA can do. The combination, often called intelligent process automation, adds capabilities such as decision-making and learning from data, so the system can handle more complex and adaptive processes ¹⁵. A second IEEE paper makes the same point, noting that integrating AI significantly enhances RPA's capabilities ¹⁶. Both are descriptive reviews, not measured outcome studies, so they support the direction of travel, not any performance number.

RPA keeps its job. A US government submission to NIST noted that RPA can automate many common data entry activities, including invoice entry, personnel action entry and data verification, and described it as an on-ramp to wider automation ¹⁷. Stable, structured, high-volume work is still a good fit for deterministic rules, and rules-based workflows are easier to audit than a model's judgment.

The practical pattern is division of labor. Keep RPA on the predictable steps. Bring AI in where inputs are messy, unstructured or require interpretation: reading free-text requests, classifying exceptions, drafting responses, deciding which path a case should take. Treat the RPA bots as tools the AI can hand work to, with guardrails and logging on the handoff. LLM-based agents are sometimes proposed as the future of RPA, but a 2025 preprint itself notes a gap in comparative research between the two ¹⁸, so augmenting is the better-supported course than replacing.

flowchart LR
A[Incoming work item] --> B{Structured and predictable?}
B -->|yes| C[RPA bot handles it]
B -->|no| D[AI interprets the input]
D --> E[Guardrails and logging]
E --> F{Needs a rules-based action?}
F -->|yes| C
F -->|no| G[AI drafts or classifies]
C --> H[Completed and auditable]
G --> H

What to expect next, and what the evidence cannot yet tell us

The direction of travel is toward agentic AI, systems that take multi-step actions instead of answering a single prompt. In a global executive survey run by MIT Sloan Management Review, 76% of respondents said they see agentic AI as closer to a coworker than a tool ¹⁹. That framing has consequences: a coworker needs onboarding, supervision and accountability, which loops back to the operating-model point earlier.

One useful forecasting rule comes from MIT SMR columnists Thomas Davenport and Randy Bean: organizations change much more slowly than AI technology does, which makes forecasting enterprise adoption easier than predicting technology change ²⁰. Plan for your organization's pace of change, not the model release cycle.

Now the gaps. Three questions that matter to a buyer are not settled by independent evidence. First, how often enterprise pilots stall or fail: some industry articles cite very high figures, but there is no vendor-neutral, measured failure rate with a stated method, so we do not repeat one. Second, how to measure return beyond cost savings: surveys report what respondents say they gained, but no accepted measurement method emerged. A sensible internal approach is to define in advance which operational outcome you expect to move, over what horizon, and to account for the early dip described above. Third, how buyers choose between platform types: independent evidence on that decision is thin, which is why the deployment section offers criteria and trade-offs, not a verdict.

If you take one thing from the evidence, make it this: spend your first effort on readiness, data representativeness and operating model, give the work a horizon longer than a pilot, and be skeptical of any source, including this one, that claims more certainty than the studies support.