What Is an AI Operating Model? (Complete Enterprise Guide for Enterprise Leaders in 2026)

A guide for chief executives, chief operating officers, chief information officers, chief AI officers and transformation leaders. What an AI operating model is, how it differs from strategy and from your existing target operating model, the seven decisions it must allocate, and how to design, assess and cost one in 2026.

The short answer

An AI strategy answers what and why. An AI operating model answers who decides, at what cadence, on what evidence. Most enterprises have written the first and skipped the second. That gap, not model quality, is the dominant reason AI investment fails to reach the profit and loss statement.

The distinction matters because AI does not fail on capability any more. It fails on the unresolved question of who is allowed to say yes, and who is allowed to say stop.

Executive summary

What is an AI operating model?

Three things it is not:

1. Not an architecture diagram. Platforms, model gateways and data pipelines are inputs to the operating model. They are not the operating model. Two enterprises can run identical technology stacks and produce opposite outcomes because one has resolved ownership and the other has not.
2. Not a governance policy. A policy states what is permitted. An operating model states who enforces it, through what mechanism, at what frequency, and with what authority to intervene. Policy without enforcement authority is documentation.
3. Not a centre of excellence. A centre of excellence is one possible structural answer. Choosing it before resolving decision rights is choosing a shape before knowing what has to fit inside it.

Harvard Business Review put the underlying problem precisely in March 2026: the obstacle "is rarely model quality or data availability, but rather the 'last mile' of transformation where technical capability must meet organizational design."

The available evidence agrees. McKinsey found in March 2025 that out of 25 attributes tested, the redesign of workflows had the biggest effect on an organisation's ability to see EBIT impact from its use of generative AI, and that 21% of respondents reporting generative AI use said their organisations had fundamentally redesigned at least some workflows. Its November 2025 report sharpened the point: AI high performers were nearly three times as likely as others to say their organisations had fundamentally redesigned individual workflows.

Workflow redesign is an operating model act. It requires someone with the authority to change how work is done, and the accountability to make the change stick.

Why enterprises need an AI operating model

Short answer: because AI adoption is now universal, AI value is not, and the gap between the two is almost entirely structural. The organisations extracting profit from AI are not the ones with better models. They are the ones that resolved who decides.

The numbers make the point without embellishment.

Two further data points explain the mechanism.

First, ownership correlates with outcome. In March 2025 McKinsey found a chief executive's oversight of AI governance to be one element most correlated with higher self-reported bottom-line impact, and that 28% of respondents whose organisations use AI reported that their chief executive held it. Its March 2026 research on AI trust found organisations that assign clear responsible-AI ownership scored an average maturity of 2.6, against 1.8 for organisations without a clearly accountable function.

Second, confidence runs ahead of durability. Deloitte's June 2026 research found that 81% of executives surveyed say they can deploy and govern AI at scale today, while nearly 75% acknowledge their operating model will need to change in the next 12 to 18 months to sustain progress. Read together, those describe an enterprise confident in the controls it has and expecting them to be inadequate within a year and a half. Closing that distance is what an operating model review is for.

AI operating model vs AI strategy vs target operating model vs governance framework

Short answer: these are five different artefacts with five different owners and five different failure modes. Confusing them is a common structural error in enterprise AI, and most published guidance separates only two at a time. The table below separates all five.

How the AI operating model relates to your existing target operating model. This is the question most published guidance leaves unanswered, and the honest answer has a condition attached.

The AI operating model should be an overlay on the target operating model, not a replacement for it, until AI is material to more than roughly a quarter of the enterprise's core processes. Below that threshold, a separate AI operating model is the efficient choice: it can move at the pace AI demands without forcing a full enterprise redesign. Above it, maintaining two operating models creates competing authority, and the AI operating model should be absorbed into the target operating model.

Gartner takes the absorption position already, folding AI into the technology operating model as a class of actor rather than treating it as a separate model. IBM, Deloitte and Boston Consulting Group imply the opposite. Both are right at different points on the same curve. The practical test is whether an AI decision can be made without convening people who also govern the rest of the enterprise. When it cannot, the two models have already merged and the paperwork should catch up.

On governance specifically. Most sources treat governance as one component inside the operating model. A minority invert it, treating the operating model as the enforcement layer beneath a governance framework. The resolution is that a governance framework is a standard, and an operating model is the mechanism that meets the standard. A standard with no mechanism is aspiration. A mechanism with no standard is improvisation. An enterprise needs both, and they should never be written by the same person.

The MASSIVUE AI Operating Model Blueprint™

Short answer: the Blueprint is a design instrument built around a single premise: an operating model is only real to the extent that specific decisions have named holders, fixed cadences and evidence tests. It has three parts. Seven decisions that must be held. Four loops that exercise them. Five levels of maturity, each with an observable exit criterion.

What this builds on, and what is new. The proposition that an operating model is fundamentally an allocation of decision rights is not ours. It is established scholarship. Peter Weill and Jeanne Ross set it out for technology operating models in IT Governance: How Top Performers Manage IT Decision Rights for Superior Results in 2004, and MIT's Center for Information Systems Research still defines governance as "a company's allocation of decision rights and accountabilities." Paul Rogers and Marcia Blenko popularised single-point decision accountability in Harvard Business Review in 2006, and Bain's RAPID and the RACI matrix are the working tools most enterprises already use. More recently, MIT CISR has published an AI decision rights matrix for agentic AI, and Deloitte's Human Capital Trends 2026 devotes a section to designing for decision rights and governance in the AI era. Readers who want the foundations should go to those sources first.

The Blueprint builds on that established operating model and decision-rights research and extends it in three specific ways. First, it decomposes AI decision rights into seven named domains, which we have not found published elsewhere. Second, it attaches a cadence and a required evidence artefact to each domain, so that a decision right becomes auditable rather than declarative. Third, it supplies maturity levels with falsifiable exit criteria rather than descriptive stage names. That is the contribution. The underlying idea that authority, not structure, is the substance of an operating model belongs to the literature above.

The Blueprint is deliberately complementary to Protum™, MASSIVUE's AI operating model framework, which sets out the six organisational capabilities an AI-first enterprise needs: data culture, adaptive structures, augmented craft, responsible intelligence, flow-based interactions and impact prioritisation. Protum describes what capabilities the organisation must build. The Blueprint decides who holds authority over each of them. Capability without authority stalls. Authority without capability is theatre.

Part one: the seven decisions (D7)

Every AI operating model, whether designed or accidental, allocates these seven decisions. In most enterprises several of them are unheld, which means they are made by whoever happens to be in the room.

Four rules govern the D7:

1. A decision held by a committee is not held. Committees advise. Individuals decide. If the answer to "who holds D2" is a forum, D2 is unassigned.
2. The holder of D6 must not report to the holder of D2. If the only person who can stop a system is the person accountable for its success, the control does not exist.
3. No baseline before go-live means no claimable benefit. D7 is settled before deployment or it is never settled at all.
4. Every D4 grant expires on material change. A change of model, tool, data scope or prompt architecture re-opens the autonomy decision automatically.

On D4 specifically, Gartner's four-level ladder is a useful external anchor: observe, advise, act with approval, act autonomously. Its accompanying finding is the sharpest available diagnosis of why agent governance fails. Shiva Varma, Senior Director Analyst at Gartner, put it this way: "Enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that is the root cause of failure." A graduated D4 grant, set per system and per decision value, is the structural fix.

Part two: the four loops

Decisions decay unless they are exercised. The loops are the cadence architecture that keeps the D7 live.

The refresh loop is the one most enterprises omit, and the omission is expensive. Deloitte found a wide range in how often organisations reassess their technology operating models, with quarterly the most common cadence at 36%, while others review annually, semi-annually, continuously, ad hoc, or have no formal review process at all. An operating model with no scheduled re-versioning is a snapshot of assumptions that have already moved.

Part three: the five levels, with exit criteria

Maturity models usually name stages without saying how you know you have left one. Each level below has a test that can be passed or failed by looking at evidence.

For external calibration, MIT's Center for Information Systems Research surveyed 721 companies and placed 28% at Stage 1 Experiment and Prepare, 34% at Stage 2 Build Pilots and Capabilities, 31% at Stage 3 Develop AI Ways of Working, and 7% at Stage 4 Become AI Future Ready. Companies in the first two stages showed financial performance below their industry average; those in the later two performed well above it. The largest financial gain came from the move between stage two and stage three, which is the same transition as Blueprint Level 1 to Level 2: the point at which cadence and evidence replace intention. A smaller MIT CISR update in August 2025 found the distribution had already shifted towards the later stages, so treat the 2024 percentages as a baseline rather than a current reading.

Core components of an AI operating model

Short answer: five components carry the seven decisions between them, with each decision owned in exactly one place. A component is only complete when it names a decision holder, a cadence and an artefact. A component described without those three things is a topic, not a control.

Leadership and governance

Owns D1, D2, D7 and the refresh loop. The governing question is not "do we have an AI steering committee" but "who signs for this system, and whose budget line does its benefit land in."

Three design rules. Sponsorship sits with the chief executive or chief operating officer, because D1 and D7 are capital allocation decisions, not technology decisions. Boston Consulting Group's AI Radar 2026 found that 72% of chief executives say they are the main decision maker on AI in their organisation, twice the share of the previous year, and that "58% of leading organizations expect AI to drive changes in governance and decision rights as systems gain greater autonomy." BCG does not define what qualifies an organisation as leading, so read that second figure as directional.

Second, appoint a single accountable executive, then check what the title actually carries. IBM's 2026 chief executive study reports 76% of surveyed organisations now have a chief AI officer, up from 26% a year earlier. A rise that steep means many of those roles are dual-hatted and newly labelled. The useful question is not whether the title exists but which of the D7 it holds. A chief AI officer who holds none of them is a coordinator.

Third, separate assurance from delivery structurally rather than culturally. Good intentions do not survive a launch date.

AI capability building

Owns D5. Capability is the component most often bought as content and most often needed as a standard.

The distinction that matters: a course teaches a tool, a programme changes a workflow, and a capability build changes who is qualified to decide. Only the third satisfies D5. The operating model needs a defensible answer to "what must a person demonstrate before they may supervise an autonomous system," and that answer has to be certifiable, not assumed.

The World Economic Forum's Future of Jobs Report 2025 found employers expect 39% of workers' core skills to change by 2030, with AI and big data the fastest-growing skills. Microsoft's 2026 research reframes the constraint usefully: the gap is not what employees can do, but what their organisations are built to support. Only 26% of the AI users Microsoft surveyed said leadership was clearly and consistently aligned on AI.

For the provider landscape, evaluation criteria and funding position, see our companion guide, Which Companies Offer AI Upskilling Programs in Singapore? Related reading: why generic AI training fails, department by department.

Data and technology

Owns D3, and enables D6. Two design rules separate a platform that supports the operating model from one that quietly undermines it.

First, data access is granted per system and per environment, never per team. A grant attached to a team outlives the system it was written for. Second, the platform must generate assurance evidence automatically. At Level 3 maturity the register of data grants, autonomy levels and stop authorities is a query, not a spreadsheet, and any design requiring a human to assemble evidence caps the enterprise at Level 2.

The constraint to design against is throughput. Agentic systems generate governance events at machine speed, so a control requiring human review of every event will either be bypassed or become the bottleneck it was meant to prevent.

Change management

Enables D2 and D5. The operating model changes who decides, which means it changes standing and routine for the people affected. That is a change management problem before it is a communications problem.

Accenture's January 2026 Pulse of Change research found 86% of C-suite leaders planned to increase AI investment in 2026, while only 32% reported having achieved sustained, enterprise-wide AI impact. Its March 2026 report, From early impact to enduring advantage, found only 21% redesigning end-to-end processes with AI at the core, and fewer than 10% redesigning roles or responsibilities. Investment is outrunning redesign by a wide margin. Our End-to-End Change Management in Singapore playbook covers the sequencing in detail.

Risk and responsible AI

Owns D4 and D6. Responsible AI stops being a values statement and becomes an operating control at exactly one point: when someone holds documented authority to suspend a live system, and has used it.

Three anchors are worth mapping to, and all three are voluntary standards rather than law in most jurisdictions. The NIST AI Risk Management Framework organises the work into four functions: govern, map, measure and manage. ISO/IEC 42001:2023 certifies an organisation's AI management system, not its individual models. The OECD AI Principles, updated in May 2024, provide the values layer most national frameworks derive from.

The economics deserve attention because they are rarely modelled. Assurance is not a fixed overhead. It scales with the number of systems under governance and with the speed at which each must be cleared, which means the cost of governing agentic AI can rise faster than the savings it produces. We are not aware of a published benchmark that quantifies this relationship. That absence is itself the point: governance efficiency is an operating model design variable, and most enterprises are not measuring it.

Further reading: Agentic AI Governance: Why Enterprises Are Decommissioning Their Agents.

Choosing your structure: five archetypes and how to decide

Short answer: there are five recognised structural archetypes. Choosing between them is not a philosophy question. It is a function of regulatory exposure, data sensitivity, delivery capacity and how many business units genuinely need to build rather than consume.

A decision rule, in order. Work through these four questions in sequence and stop at the first that applies.

1. Is a regulator entitled to inspect your AI decisions? If yes, D3, D4 and D6 must be centrally held regardless of everything else. That leaves centralised, hub and spoke, or a centre of excellence with genuine enforcement authority as your viable options, and rules out federated and embedded.
2. Do three or more business units genuinely need to build rather than consume? If no, choose centralised. Building a federation for two builders creates overhead with no offsetting speed.
3. Can the centre assure new systems faster than the units can ship them? If yes, hub and spoke. If no, either fund the centre until it can, or restrict the number of units permitted to build. Do not federate around an assurance bottleneck; it converts a queue into an unmonitored risk.
4. Do units face genuinely different regulators, currencies or customer regimes? If yes, federated. If no, federation is duplication.

On migration, which almost no published source addresses. Archetypes are stages, not identities. The common path is centralised, then hub and spoke, then federated, and it should be walked one step at a time. The trigger for the first move is that the central team's assurance queue exceeds two weeks. The trigger for the second is that two or more units have independently reached Blueprint Level 2. Skipping a step is the most reliable way to arrive at Level 0 with a larger budget.

Operating model implementation roadmap

Short answer: twelve months, four moves. The sequence is deliberate. Each move creates the evidence the next one needs, and none of them begins with a reorganisation.

Days 1 to 30: assign. Name a holder for each of the seven decisions and publish the list. Build one register of every AI system in use, including the ones procured outside technology. Expect the inventory to be larger than anyone predicts. Do not restructure anything. Exit: the D7 list is published and the register is complete. This is Blueprint Level 1.

Days 31 to 90: prove the brake. Choose one live system and exercise D6 end to end. Suspend it, document the decision, restore it. This single act reveals more about the operating model than any assessment, because it tests authority under real conditions. In parallel, agree a benefit baseline with finance for the next three use cases entering production. Exit: one documented, tested stop; three baselines agreed before go-live.

Days 91 to 180: run the loops. Start the value, delivery and assurance loops at their stated cadences. The value loop must stop something in its first two sittings. A portfolio review that has never killed anything is a status meeting. Exit: the loops are running to cadence, with at least one use case stopped and at least one benefit verified by finance. Sustaining that for two consecutive quarters is what clears Level 2.

Days 181 to 365: automate the evidence. Move the registers from documents into the platform. Set expiries on data grants and autonomy levels so they lapse rather than requiring renewal. Then run the first refresh loop and re-version the D7 allocation based on what the first three loops actually revealed. Exit: assurance evidence is queryable and a new use case has reached production without a bespoke governance exception. That clears Level 3, and the first evidence-driven re-versioning starts the path to Level 4.

Two cautions on timing. In our experience the full sequence runs between six and eighteen months, and the variance is driven almost entirely by two factors: how many regulators are entitled to inspect the decisions, and whether an executive sponsor holds D1 personally. Neither is a resourcing question. Treat that range as practitioner guidance rather than a measured benchmark, because no credible published benchmark exists.

How to assess your current AI operating model

Short answer: score the seven decisions against three tests each. Twenty-one points. Anything below fourteen means the operating model is nominal, whatever the documentation says.

For each of the seven decisions, award one point for each test passed.

Test A: Named. Can you name the individual, not the forum, who holds this decision? Test B: Exercised. Has that person made a decision under it in the last ninety days, with a record? Test C: Evidenced. Does an artefact exist that a regulator, auditor or new executive could read without a briefing?

Two questions worth asking alongside the score, because they detect problems the score can miss. First: when a pilot is stopped, who is told and what happens to the budget? If the budget stays with the sponsoring team, D1 is not really held centrally. Second: how many AI systems are running that do not appear on any register? That number is the true measure of Level 0 residue, and it is rarely zero.

MASSIVUE's AI maturity assessment covers adjacent readiness dimensions and takes a few minutes.

What an AI operating model costs, and how many people it takes

Short answer: we could not find a credible public benchmark for AI operating model headcount ratios or governance cost as a share of AI spend, and readers should treat any specific figure quoted to them as a vendor estimate until a primary source is produced. What the published evidence does support is a reliable shape for the spend, and three cost drivers that determine the total.

This is worth stating plainly, because executives are asked the question in every budget conversation and the published guidance largely sidesteps it.

What the evidence supports. Boston Consulting Group's 10-20-70 observation is the most widely cited structural anchor: top-performing organisations dedicate roughly 10% of their efforts to algorithms, 20% to data and technology, and 70% to people, processes and cultural transformation. It describes how leading firms allocate effort, not where value demonstrably comes from, and it should be cited that way. The practical implication is that an AI budget weighted heavily towards platform and licences looks unlike the budgets of the firms BCG identifies as leading.

The three cost drivers.

1. Assurance throughput. The dominant variable. Cost scales with the number of systems requiring independent assurance and the speed at which assurance must be delivered, not with the number of models. This line grows non-linearly, because each additional system adds review load to a fixed assurance function.
2. Number of decision-rights boundaries. Each additional business unit holding its own D1 and D7 adds coordination cost. Federation is not free; it buys speed with overhead. The archetype decision above is therefore also a cost decision.
3. Evidence automation maturity. Level 2 organisations pay for assurance in people. Level 3 organisations pay for it in platform. The transition is the single largest available reduction in unit cost of governance, and it is the reason the Level 2 to Level 3 move deserves capital rather than headcount.

What to measure instead of a benchmark. Track cost per assured system, time from request to data grant, time from incident detection to containment, and governance cost as a percentage of realised benefit. These are internally comparable over time, which a borrowed industry ratio never is.

Common mistakes

Short answer: the same six failures recur across sectors. All six are diagnosable from symptoms, and none is fixed by better technology.

A seventh is worth naming separately because it is structural rather than operational: reorganising before assigning. Redrawing the org chart is visible, satisfying and usually premature. If decision rights are unresolved, the new structure inherits the old ambiguity and the enterprise has spent political capital to arrive where it started.

Related: Why Enterprise AI Pilots Stall Before Production and Why 75% of Enterprise AI Initiatives Fail.

AI operating model examples

Short answer: the four worked patterns below show how the same seven decisions are allocated differently depending on regulatory exposure and delivery capacity. Each is a composite of common enterprise configurations, presented to illustrate the allocation logic rather than to describe a specific organisation.

Pattern A: the regulated centraliser. A bank with a single primary regulator. D3, D4 and D6 sit centrally with a risk function reporting to the chief risk officer. D1 and D7 sit with the chief financial officer, advised by an investment committee rather than delegated to it. D2 sits with the business line. D5 is a central standard applied locally. Assurance is the constraint, so the design optimises for defensibility over speed. Typical maturity: Level 2 quickly, Level 3 slowly.

Pattern B: the platform hub. A manufacturer with several divisions on a shared platform. The hub holds D3, D4, D5 and D6; divisions hold D1, D2 and D7. Evidence generation is automated early because the hub cannot otherwise keep pace. This is the most common successful configuration at scale, and it fails in one specific way: when division delivery outruns hub assurance and the response is to relax D4 rather than fund the hub.

Pattern C: the federated group. A multinational with materially different regulators by geography. Each region holds D1, D2, D5 and D7. Only D4 and D6 are group-held, and even those are set as floors that regions may exceed. The characteristic weakness is D7: benefits are measured differently by region, so group value becomes unverifiable. The fix is a single benefit definition imposed centrally even where everything else is devolved.

Pattern D: the product-embedded model. A software company where AI is in the product. All seven decisions sit with product teams, against enterprise standards. This works only where capability is genuinely deep in every team, and it is more often an aspiration than a starting point.

Published examples worth reading. IBM used its Think 2026 conference in May 2026 to make the AI operating model its central theme, with chief executive Arvind Krishna stating that running AI in the enterprise requires a new operating model. The release is a useful read on how a vendor frames the components, though it never defines the term, and its one named customer result, an 83% cost saving at Nestlé, relates to a data engine proof of concept rather than to operating model design. McKinsey's September 2025 research on the agentic organisation contains a dense set of anonymised examples, including one global bank whose "agent factory" manages know-your-customer processes with ten agent squads. Deloitte's June 2026 research on rewiring the operating model carries useful survey data on funding models and refresh cadence. All three are listed in the sources below.

Industry variations

Short answer: the seven decisions are constant. What changes by industry is which of them is the binding constraint, and which external instrument sets the standard.

Banking and financial services

Binding constraint: D6, assurance. The sector's defining 2026 development is that United States banking regulators replaced their long-standing model risk guidance. Federal Reserve SR 26-2 and Office of the Comptroller of the Currency Bulletin 2026-13, both issued on 17 April 2026, replace the 2011 interagency model risk guidance. SR 26-2 supersedes SR 11-7 and SR 21-8; Bulletin 2026-13 rescinds OCC Bulletin 2011-12 and three other issuances. Critically, the revised guidance states verbatim that "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." That leaves a governance gap banks must fill themselves rather than by reference to supervisory guidance.

In the European Union, the European Banking Authority confirmed in November 2025 that AI used to evaluate creditworthiness or produce credit scores for natural persons is classified as high-risk under the AI Act. Digital operational resilience obligations under Regulation (EU) 2022/2554 have applied since January 2025 and govern how a bank manages AI vendor and model dependencies.

In Singapore, the Monetary Authority's FEAT principles have applied since 2018. MAS consulted on proposed Guidelines on Artificial Intelligence Risk Management from 13 November 2025, closing on 31 January 2026. As at publication, MAS has not issued the Guidelines in final form and no response to consultation has been published. MAS proposes "a transition period of 12 months after the Guidelines are issued." The finalised artefact to work from is the MAS AI Risk Management Toolkit, launched on 20 March 2026 with a consortium of 24 financial institutions, whose Operationalisation Handbook is dated January 2026.

Healthcare

Binding constraint: D4, autonomy. Clinical AI autonomy is bounded by device regulation, not by internal risk appetite.

The United States Food and Drug Administration's final guidance on Predetermined Change Control Plans, originally issued in December 2024 and reissued on 18 August 2025, lets manufacturers pre-authorise planned model updates, which materially changes how a health system can operate a learning model without a new submission each time. Its companion lifecycle management guidance was still a January 2025 draft marked "not for implementation" when this guide was verified. In the European Union, Rule 11 of the Medical Device Regulation classifies software intended to provide information used to take diagnostic or therapeutic decisions as at least Class IIa, rising to Class IIb or III where the potential harm is more serious. MDCG 2019-11 rev.1, updated in June 2025, is the operative guidance on how that classification is applied. The World Health Organization's guidance on large multi-modal models in health, announced in its news release of 18 January 2024, is the reference ethics instrument. Note that the WHO publication record currently displays a date of 25 March 2025 for the same document, a discrepancy we could not resolve.

In Singapore, the Ministry of Health and the Health Sciences Authority issued version 2.0 of the Artificial Intelligence in Healthcare Guidelines in March 2026. In its own words it "provides a consolidated set of recommendations and good practices" and "complements prevailing legislation that governs these stakeholder groups."

Manufacturing

Binding constraint: D3 and D4 together, at the boundary between information technology and operational technology. Where AI touches a safety function, autonomy is a product safety question rather than a governance preference.

Regulation (EU) 2023/1230 on machinery applies from 20 January 2027 and explicitly contemplates "systems with a fully or partially self-evolving behaviour using machine learning approaches" that ensure safety functions. It was one of the regulations amended by the European Union's July 2026 AI simplification package, so the machinery and AI regimes were deliberately re-synchronised. ISO 10218-1:2025 revised industrial robot safety requirements in February 2025. The IEC 62443 series governs industrial control system security and is the practical constraint on connecting AI systems to plant.

Under the AI Act, AI acting as a safety component of a regulated product is high-risk, and those obligations now apply from 2 August 2028.

Public sector

Binding constraint: D1 and D3, procurement and data. Government AI decisions are constrained at the point of purchase more than at the point of deployment.

In the United States, Office of Management and Budget memorandum M-25-22 of April 2025 governs federal AI acquisition, requiring cross-functional acquisition teams, protection against vendor lock-in and safeguarding of government data and intellectual property rights. The United Kingdom's AI Playbook for the UK Government, issued by the Government Digital Service on 10 February 2025 and last updated on 7 January 2026, is the most usable published public sector guidance available. In the European Union, public bodies deploying high-risk AI must complete a Fundamental Rights Impact Assessment under Article 27 of the AI Act, an obligation now biting from December 2027 following the deferral.

Singapore's GovTech AI Guardian platform provides testing and guardrail tooling for public sector generative AI. Singapore updated its National AI Strategy on 20 May 2026, and the National AI Impact Programme announced on 2 March 2026 aims to "support 10,000 enterprises over the next three years to advance their AI adoption journey" and to "support 100,000 workers to become AI Bilingual."

MASSIVUE works across ten industries, and the sector-specific constraint is the first thing an operating model design should establish.

Future trends

Short answer: four shifts will reshape AI operating model design between now and 2028. Each moves authority, which is why each is an operating model question rather than a technology one.

1. Decision rights migrate to machines, on purpose. IBM's 2026 chief executive study found leaders expect 48% of operational decisions where consistency and guardrails can be codified to be made by AI without human intervention by 2030, against 25% today. The design work is not whether to delegate but how to write a D4 grant that a machine can hold.

2. Governance economics become a reported metric. As agent estates grow, the cost of assuring them becomes material enough to appear in business cases rather than being absorbed as overhead. Expect governance cost per assured system to move from an internal operational measure to something finance functions track and boards ask about.

3. Regulatory timelines stop being predictable. The European Union deferred its high-risk obligations in July 2026 after they had been treated as fixed for two years. United States banking regulators removed generative and agentic AI from model risk scope in April 2026. Operating models designed against a specific compliance date are fragile. Design against a capability to produce evidence on demand instead.

4. The AI operating model is absorbed. As AI becomes material to core processes, maintaining a separate AI operating model creates competing authority. The endpoint for most enterprises is not a permanent AI operating model but a target operating model that has internalised the seven decisions. Enterprises that plan for absorption from the outset avoid a second restructuring.

Limitations of this guide

Short answer: three limits are worth stating so readers can weigh the guidance appropriately.

The Blueprint has not been externally validated. It is drawn from practice and from the published research cited throughout, not from a controlled study. The seven domains, the four cadences and the five exit criteria are design propositions. They have not been tested against a sample of enterprises with published results, and readers should treat them as a structured way to organise decisions rather than as an evidence-backed prescription.

Several practical thresholds are heuristics, not findings. The two-week assurance queue trigger, the two-or-more-units migration trigger, the six to eighteen month implementation range and the roughly one-quarter threshold for absorbing the AI operating model into the target operating model are practitioner judgements. No published benchmark supports them, and we have not found one. They are offered as starting points to argue with, not as measurements.

Every statistic here belongs to someone else. This guide synthesises research from McKinsey, Gartner, Deloitte, Boston Consulting Group, IBM, Microsoft, Accenture, MIT CISR and others, and it contains no first-party data. Where a figure is self-reported by survey respondents, we have said so. Where a base or denominator is undisclosed by the publisher, we have said that too. Readers making investment decisions should go to the primary sources listed at the end.

Key takeaways

Work with MASSIVUE

MASSIVUE is a Singapore-headquartered consulting and academy firm working across AI, sustainability and enterprise transformation. The reason we treat operating model design and capability building as one engagement rather than two is the same reason set out in this guide: authority without capability is theatre, and capability without authority stalls.

• AI Transformation covers operating model design, governance and deployment, built on the Protum™ AI operating model framework and its six capabilities.
• AI Workforce Transformation and the AI at Work programme address D5 directly: role-specific capability with a certification standard rather than generic awareness training.
• MASSIVUE Academy issues stackable micro-credentials and certifications that give the capability decision a verifiable standard to point at.
• Enterprise Transformation handles the case where the AI operating model has to be absorbed into the wider target operating model.
• SustainAgility™ applies the same authority-first logic to sustainability and environmental, social and governance transformation, where reporting obligations make evidence standards non-negotiable.

Start with the AI maturity assessment, or talk to our team about a D7 allocation review.

Frequently asked questions

What is an AI operating model?

An AI operating model is the system that allocates decision rights over AI in an enterprise: who decides what gets funded, who owns a live system, what data it may use, how much it may decide alone, who is qualified to supervise it, who can stop it, and who is accountable for the value. It is the mechanism that turns AI strategy into execution authority.

What is the difference between an AI operating model and an AI strategy?

Strategy answers where and why. The operating model answers who decides, at what cadence, on what evidence. A strategy allocates intent; an operating model allocates authority. Most enterprises have written the first and skipped the second.

Is an AI operating model the same as a target operating model?

No. A target operating model describes how the whole enterprise is organised to deliver. An AI operating model is narrower and faster-moving. Treat it as an overlay until AI is material to roughly a quarter of core processes, then absorb it into the target operating model rather than running two competing authorities.

How is an AI operating model different from an AI governance framework?

A governance framework is a standard: what is permitted, prohibited and required. An operating model is the mechanism that meets the standard: who enforces it, how, and how often. A standard with no mechanism is aspiration. The two should not be written by the same person.

What are the components of an AI operating model?

Five components carry seven decisions. The components are leadership and governance, capability building, data and technology, change management, and risk and responsible AI. A component is only complete when it names a decision holder, a cadence and an evidence artefact.

Who owns the AI operating model?

Sponsorship belongs to the chief executive or chief operating officer, because portfolio and value decisions are capital allocation decisions. Day-to-day stewardship usually sits with the chief operating officer or chief information officer. A chief AI officer may hold several of the seven decisions, but the title alone confers nothing.

Do we need a Chief AI Officer?

Only if the role holds specific decisions. IBM's 2026 study reports 76% of surveyed organisations now have one, up from 26% a year earlier, which suggests many are relabelled or dual-hatted roles. Ask which of the seven decisions the role holds. If the answer is none, it is a coordination role, and the authority problem is unresolved.

Centralised, federated or hub and spoke: which should we choose?

Work through four questions in order. If a regulator can inspect your AI decisions, data, autonomy and assurance must be centrally held. If fewer than three business units genuinely need to build, centralise. If the centre can assure faster than units can ship, use hub and spoke. Federate only where units face genuinely different regulators, currencies or customer regimes.

How long does it take to build an AI operating model?

In practice, between six and eighteen months for the full sequence, though no measured public benchmark exists. The variance is driven mainly by how many regulators can inspect the decisions and whether an executive sponsor personally holds the portfolio decision. A workable first version, with decisions assigned and a stop authority tested, is achievable in ninety days.

What does an AI operating model cost?

We could not find a credible public benchmark for headcount ratios or governance cost as a share of AI spend, so any specific figure quoted should be treated as a vendor estimate until a primary source is produced. Boston Consulting Group's guidance that roughly 70% of effort should go to people and process, 20% to data and technology and 10% to algorithms is the most useful structural anchor, and it describes recommended effort rather than measured value. Track cost per assured system internally rather than borrowing an industry ratio.

How do you measure whether an AI operating model is working?

Four metrics that are hard to fake: time from request to data grant, time from incident detection to containment, number of use cases stopped per quarter, and benefits verified by finance rather than by the delivery team. A portfolio review that has never stopped anything is a status meeting.

Why do most AI operating models fail?

Six recurring causes: no kill authority in the portfolio decision, ownership never transferred at go-live, data access resolved only for pilot data, autonomy treated as binary rather than graduated, access confused with qualification, and benefits baselined after deployment. A seventh is reorganising before assigning decision rights.

What is the first thing to do if we have no AI operating model?

Name a holder for each of the seven decisions and publish the list. Then build a single register of every AI system in use, including tools procured outside the technology function. Neither step requires a reorganisation, and the register is almost always larger than expected.

How does an AI operating model handle AI agents?

Through a graduated autonomy decision. Gartner's four levels are a useful anchor: observe, advise, act with approval, act autonomously. Set the level per system against the value of the decision at risk, and expire the grant automatically on any material change to model, tools, data scope or prompt architecture.

What is shadow AI and where does it fit?

Shadow AI is any system in use that appears on no register. It is the clearest measure of residual Level 0 maturity, and it is rarely zero. It belongs to the ownership decision: the fix is a complete inventory and a rule that unregistered systems are suspended rather than tolerated.

How do agentic AI systems change operating model requirements?

They change the throughput requirement. Agents generate governance events at machine speed, so controls requiring human review of each event either get bypassed or become the bottleneck. This is why evidence automation is the defining Level 2 to Level 3 transition. Gartner predicts over 40% of agentic AI projects will be cancelled by the end of 2027, citing unclear business value and inadequate risk controls among the causes.

Does the EU AI Act apply to our AI operating model?

It depends on jurisdiction and risk classification, and the timeline moved in 2026. Prohibitions have applied since February 2025, and general-purpose AI obligations, governance rules and penalties since August 2025. High-risk obligations for stand-alone systems were deferred to 2 December 2027, and for AI embedded in regulated products to 2 August 2028, by the simplification regulation that entered into force on 27 July 2026. That same regulation also softened the AI literacy obligation, from a duty to ensure a sufficient level of AI literacy to a duty to support its development, with an express statement that no specific level need be guaranteed for any individual. Verify current status before relying on any date.

Which standards should our AI operating model map to?

The three most widely used are the NIST AI Risk Management Framework, which organises work into govern, map, measure and manage; ISO/IEC 42001:2023, which certifies an organisation's AI management system rather than individual models; and the OECD AI Principles, updated in May 2024. All three are voluntary in most jurisdictions but are commonly referenced by regulators.

How does an AI operating model differ in banking?

Assurance is the binding constraint. Note that United States model risk guidance changed in April 2026, when Federal Reserve SR 26-2 and OCC Bulletin 2026-13 replaced the 2011 interagency guidance and expressly placed generative and agentic AI outside their scope. Banks must therefore design that governance themselves rather than inheriting it from supervisory guidance.

How does an AI operating model differ in healthcare?

Autonomy is the binding constraint, and it is set by device regulation rather than internal risk appetite. Predetermined Change Control Plans in the United States, and Rule 11 of the EU Medical Device Regulation as applied through MDCG 2019-11 rev.1, determine how much a clinical model may change and decide without a new authorisation.

What role does upskilling play in an AI operating model?

It satisfies the capability decision. The operating model needs a certifiable answer to what a person must demonstrate before they may supervise an autonomous system. Generic awareness training does not provide one. Role-specific capability with a verifiable credential does.

Can a mid-sized enterprise build an AI operating model?

Yes, and it is usually simpler. Fewer business units means centralised is normally the right archetype, and one person can legitimately hold several of the seven decisions provided assurance stays separate from delivery. The rule that survives at every size is that the person who can stop a system must not report to the person accountable for its success.

How often should we review the AI operating model?

Semi-annually as a minimum, quarterly where AI is material to core processes, with an event-driven trigger for material regulatory or technology change. Deloitte found quarterly to be the most common cadence for reassessing technology operating models at 36%, in an environment where nearly 75% acknowledge their operating model will need to change within 12 to 18 months.

What is the single biggest mistake enterprises make?

Reorganising before assigning. Redrawing the structure is visible and satisfying, but if decision rights are unresolved the new structure inherits the old ambiguity, and the enterprise has spent political capital to arrive back where it started.

Sources

• McKinsey, The state of AI in 2025: Agents, innovation, and transformation, 5 November 2025. mckinsey.com
• McKinsey, The state of AI: How organizations are rewiring to capture value, 12 March 2025. mckinsey.com
• McKinsey, The Agentic Organization, 26 September 2025. mckinsey.com
• McKinsey, The State of Organizations 2026: Three tectonic forces that are reshaping organizations, 19 February 2026. mckinsey.com
• McKinsey, State of AI trust in 2026: Shifting to the agentic era, 25 March 2026. mckinsey.com
• Deloitte, The State of AI in the Enterprise: The Untapped Edge, 21 January 2026. deloitte.com
• Deloitte Insights, Rewiring the enterprise operating model for AI scale, 29 June 2026. deloitte.com
• Boston Consulting Group, The Widening AI Value Gap: Build for the Future 2025, September 2025. bcg.com
• Boston Consulting Group, AI Radar 2026: As AI Investments Surge, CEOs Take the Lead, 15 January 2026. bcg.com
• Boston Consulting Group, From Potential to Profit: Closing the AI Impact Gap, 14 January 2025. bcg.com
• Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027, 25 June 2025. gartner.com
• Gartner, Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure, 26 May 2026. gartner.com
• Gartner, How CIOs Move From IT Control to Technology Operating Model Orchestration, 15 June 2026. gartner.com
• IBM Institute for Business Value, CEO Study 2026, 4 May 2026. newsroom.ibm.com
• IBM, Think 2026: IBM delivers the blueprint for the AI operating model, 5 May 2026. newsroom.ibm.com
• Microsoft, 2026 Work Trend Index Annual Report, 5 May 2026. microsoft.com
• Accenture, Pulse of Change, 15 January 2026. accenture.com
• Accenture, Sharma and Ramani, From early impact to enduring advantage: The intelligent superhighway you need to unlock value from AI, 27 March 2026. accenture.com
• Peter Weill and Jeanne W. Ross, IT Governance: How Top Performers Manage IT Decision Rights for Superior Results, Harvard Business School Press, 2004.
• Paul Rogers and Marcia W. Blenko, Who Has the D? How Clear Decision Roles Enhance Organizational Performance, Harvard Business Review, January 2006. hbr.org
• MIT CISR, Classic Topics: Decision Rights. cisr.mit.edu
• MIT CISR, Sebastian, Haskamp and vom Brocke, Decision Rights, Autonomy, and Value: Agentic AI in the Enterprise. cisr.mit.edu
• Deloitte, AI and the future of human decision-making, Human Capital Trends 2026, 3 March 2026. deloitte.com
• Harvard Business Review, Lakhani, Spataro and Stave, The "Last Mile" Problem Slowing AI Transformation, 9 March 2026. hbr.org
• MIT CISR, Weill, Woerner and Sebastian, Building Enterprise AI Maturity, December 2024. cisr.mit.edu
• MIT CISR, Woerner, Sebastian, Weill and Kaganer, Grow Enterprise AI Maturity for Bottom-Line Impact, 21 August 2025. cisr.mit.edu
• RAND Corporation, The Root Causes of Failure for Artificial Intelligence Projects, 13 August 2024. rand.org
• World Economic Forum, Future of Jobs Report 2025, 7 January 2025. weforum.org
• NIST, AI Risk Management Framework (AI RMF 1.0), 26 January 2023. nist.gov
• ISO/IEC 42001:2023, Artificial intelligence management system, 18 December 2023. iso.org
• OECD, Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449), updated May 2024. oecd.ai
• European Union, Regulation (EU) 2024/1689 (AI Act) and Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 27 July 2026. eur-lex.europa.eu
• European Banking Authority, AI Act: implications for the EU banking and payments sector, 21 November 2025. eba.europa.eu
• Federal Reserve, SR 26-2 Revised Guidance on Model Risk Management, and OCC Bulletin 2026-13, 17 April 2026. federalreserve.gov, occ.gov
• US FDA, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions, final, reissued 18 August 2025. fda.gov
• MDCG 2019-11 rev.1, Qualification and Classification of Software under MDR and IVDR, June 2025. health.ec.europa.eu
• World Health Organization, Ethics and governance of AI for health: Guidance on large multi-modal models, 18 January 2024. who.int
• Regulation (EU) 2023/1230 on machinery, applicable 20 January 2027. eur-lex.europa.eu
• ISO 10218-1:2025, Robotics safety requirements, 5 February 2025. iso.org
• IMDA, Model AI Governance Framework for Agentic AI, Version 1.0, 22 January 2026. imda.gov.sg
• Monetary Authority of Singapore, FEAT Principles, 2018; Consultation Paper on Guidelines on Artificial Intelligence Risk Management, 13 November 2025; AI Risk Management Toolkit, 20 March 2026. mas.gov.sg
• Ministry of Health Singapore and Health Sciences Authority, Artificial Intelligence in Healthcare Guidelines (AIHGle) 2.0, March 2026. hcsa.gov.sg
• MDDI Singapore, Update to the National AI Strategy, 20 May 2026; National AI Impact Programme, 2 March 2026. mddi.gov.sg
• UK Government Digital Service, AI Playbook for the UK Government, 10 February 2025, updated 7 January 2026. gov.uk
• US Office of Management and Budget, M-25-22 Driving Efficient Acquisition of Artificial Intelligence in Government, 3 April 2025. whitehouse.gov

All statistics in this guide were verified against the primary publisher's own page or document in August 2026. Regulatory status is stated as at August 2026. The status of the Monetary Authority of Singapore's proposed AI risk management guidelines was re-confirmed on the date of publication: still at consultation stage, with no response to consultation published. One item remains unresolved and is flagged in the text: the date shown on the World Health Organization's publication record for its large multi-modal models guidance. AI regulation is moving quickly. Verify current status before relying on any date in this guide.