Example Manufacturing Co.

Your structured data is in reasonable shape for a company your size: core business apps are in place with some integrations, so the information a service desk assistant or quoting aid would need does exist and can be found. The problems sit one layer down. Nobody owns data quality, so the errors that live in your ERP and CRM today — stale customers, duplicate parts, inconsistent pricing records — will be repeated by any AI that reads them, delivered fluently and with confidence. AI doesn't clean data; it amplifies whatever it finds.

The sharper issue is your unstructured content. You told us permissions on SharePoint and file shares are known to be too broad and haven't been cleaned up. Today that's a dormant problem, because finding an overshared file requires someone to go looking. An AI assistant removes that friction entirely: it reads everything a user can technically access and volunteers it in answers. The pricing sheet buried three folders deep, the HR spreadsheet with a company-wide link, the board deck in a legacy site — all of it becomes one question away. This is the single most important thing to fix before any assistant is connected to company content, and it's why cleanup is in the first 30 days of your roadmap.

Programmatic access is middling: a few one-off APIs and connectors exist, but there's no managed integration layer. That's acceptable for the first pilot — the service desk assistant can start against your ticketing system and knowledge base alone — but each use case after that will re-raise the question, so an integration inventory belongs on the 6-12 month horizon, not in the first 90 days.

This dimension splits cleanly in two. Your identity foundation — SSO, role-based access, periodic access reviews — is genuinely strong for a company your size, and it matters more than most teams realize: every AI control you'll deploy, from an approved assistant to DLP policies, hangs off identity. You've already done the hard, slow part.

The exposed flank is data protection in the age of casual AI use. Employees are pasting work data into public AI tools, there's no approved alternative to pull them toward, and your classification program is a policy on paper with labels applied by hand in a few places. That combination means your most sensitive data — the customer and pricing information you specifically told us you worry about — has no technical barrier between it and a personal ChatGPT account. The fix is a one-two punch, and the order is critical: first give people an approved, enterprise-grade assistant so the productivity demand has somewhere safe to go, then restrict unapproved tools through your web filter. Blocking first just moves usage to personal phones where you have no visibility at all.

Vendor risk needs one targeted upgrade rather than an overhaul: your reviews don't yet ask whether a product's AI features retain or train on your data. Every SaaS renewal that crosses your desk this year will have new AI features in it, so this single added question does a surprising amount of work under your SOX and state-privacy obligations.

Infrastructure is the dimension where you have the least to build. A hybrid Microsoft 365 and Azure estate puts every major AI capability you'll need this year — an enterprise assistant, Azure-hosted models for the service desk pilot, usage dashboards — one configuration decision away rather than one procurement cycle away. Your score here is held back not by missing capability but by missing decisions: enterprise AI is still 'in evaluation,' and in the vacuum, consumer tools have colonized the gap.

The finance Copilot trial is a real asset that isn't being treated as one. Ten seats have been generating usage patterns, prompts, wins, and duds for months. Before you expand or cancel it, mine it: which tasks stuck, which licenses went dormant, what finance users actually asked for. That evidence should drive your assistant rollout sizing, and it's exactly the kind of data-backed decision your CFO will notice.

The one genuinely new muscle you need is cost management for usage-based AI. Your dashboards exist, but nothing is budgeted or alerted for token-metered spend, which behaves nothing like per-seat licensing — it can double in a good month because adoption is going well. Set Azure budgets and alerts before the pilot starts burning tokens, not after the first surprising invoice.

Your team has informally experimented — most people have tried AI tools on their own — but nothing has been formalized: no credentials, no owner for AI automation skills, no budget, and training approved case by case. That gap has a direct cost on your roadmap: the service desk pilot needs someone who can build and tune it, and today that person doesn't exist on the team. You'd either delay the pilot or outsource its core skill, and renting the one capability you'll need permanently is the expensive choice.

The fix is cheap relative to everything else in this report. A certification sprint — one fundamentals credential for the whole IT team, one deeper engineering path for a single builder — costs exam vouchers and protected study hours, fits inside a sliver of your stated budget, and pays off twice: the team gets a shared vocabulary for every AI decision this year, and you get your pilot builder. It also signals to the team that AI is something they're being invested in, not something happening to them, which matters for the adoption battles ahead.

You're ahead of most organizations on the question that matters — what is AI for? — because you have a specific, measurable target: cut service desk and documentation time. Your painful-processes list (password resets and access requests, SOPs and knowledge base articles, customer quotes) reads like a ranked backlog of AI candidates, and the first two are squarely in the sweet spot of what's proven today. What's missing is everything around the goal: no prioritized list with business owners, no pilot underway, and value judged by anecdote.

The measurement gap is the one that will hurt. You told us a win looks like a plan you can take to the CFO — but a plan without a baseline produces a pilot whose results are arguable. 'The team feels faster' does not survive a budget review; 'first response on our top ten ticket types is down 40% against a 90-day baseline' does. Pull the baseline before the pilot touches a single ticket. It's two weeks of work, it costs nothing, and it converts your pilot from an experiment into evidence.

Sequence the backlog deliberately: service desk first because it's measurable and internal, documentation second because it compounds (every SOP the assistant helps write improves the assistant's own source material), and customer quotes third because it touches pricing data — exactly the data you're cleaning up in the first 60 days — and deserves the guardrails being in place first.

Governance is your lowest score and the root cause of most of the risk elsewhere in this report. Nobody owns AI decisions, so nobody can say yes safely — and when nobody can say yes, employees stop asking and adopt tools themselves, which is precisely the shadow-AI pattern in your Security score. The draft acceptable-use policy sitting unpublished is the purest example of cheap value waiting: it's mostly written, it costs nothing to finish, and it's the prerequisite for every other control you'll deploy this quarter.

Your regulatory surface makes the inventory gap concrete rather than theoretical. Under SOX, financial data flowing through an unvetted AI tool is an auditor's finding waiting to be written; under state privacy laws, you can't honor deletion or disclosure obligations for data you don't know left the building. An inventory — which tools, which data, which owner — is the two-week artifact that turns 'we think we know what's in use' into an answer you can give an auditor with a straight face.

Keep the machinery light. A company your size doesn't need an AI governance office; it needs one accountable council — IT, security, legal, finance, one business leader — meeting for thirty minutes every two weeks with a one-page intake form. The point is not process for its own sake; it's that a functioning council converts AI from a series of surprises into a queue of decisions.