TL;DR: A mid-market AI strategy usually clears the first hurdle and stalls at the second. While 94% of mid-market companies already use generative AI, and 83% are past early testing, only 2% have scaled it successfully. Many stall without an AI policy, a defined AI operating model, and a control framework to move safely from pilot to production.
Key terms
- AI implementation: Moving an AI tool or model from a pilot or trial into a system employees rely on for real decisions and workflows.
- Responsible AI policy: A written internal document that sets rules for what data can reach an AI tool, which use cases need approval, and who's accountable when something goes wrong.
- AI governance: The clear roles and oversight that make an AI policy enforceable rather than aspirational.
- AI control framework: Specific security checks, logs, and monitoring you can show during a client audit or a regulatory review.
- AI operating model: How teams structure everyday workflows and responsibilities around AI, rather than simply having a policy about it.
A mid-market AI strategy rarely hits a wall at adoption. Kaufman Rossin’s 2026 survey, The State of Artificial Intelligence in the Mid-Market, polled 100 senior decision-makers across many industries. Each works at an American company with $5 million to under $1 billion in annual revenue. It found that 94% already use generative AI, and 83% have moved past early dabbling into deliberate trials or AI embedded in core processes.
Yet only 2% have operationalized AI at scale. The report names three obstacles behind that shortfall: a skills shortage, unresolved cybersecurity concerns, and legacy systems that weren’t built to connect to AI tools. It also flags ROI measurement as a challenge for nearly every company.
Interest hasn’t cooled, though, and most still plan to invest more in AI, which they see as essential to future competitiveness. Governance rarely makes these lists, yet in our experience, it’s the issue companies leave unresolved the longest.
Enterprises hit the same wall, just later and with more staff to throw at it. At a mid-market company, AI oversight often falls to a single IT leader who already owns infrastructure, security, and vendor contracts. Meanwhile, the board tends to assume that using AI means someone has the risk covered.
Closing that gap takes three pieces built for a company this size:
- an AI policy that sets the rules
- an AI operating model that names who applies them
- a control framework that proves they’re followed
What AI implementation challenges are mid-market companies running into?
That same survey names three recurring blockers:
- Skills shortage: qualified AI talent is hard to find, so AI work lands on people who are already busy running the business. Governance and risk often end up with no clear owner.
- Unresolved cybersecurity concerns: when departments and individual employees pick AI tools on their own, IT rarely checks what data those tools can reach before people start using them.
- Legacy systems integration: connecting a modern AI tool to a decade-old enterprise resource planning (ERP) or customer relationship management (CRM) system takes custom engineering work, from mapping data fields to building connectors.
Scaling AI usually starts with tackling one of those three barriers. Data access, the core of the cybersecurity barrier, is a good example. Map what each AI tool can reach before a company-wide rollout, and your team avoids the security incidents that tend to surface months later.
| Dimension | Pilot stage | Scaled stage |
| Data access | Whoever is testing the tool grants it access case by case | A documented policy lists which data classes the tool can reach |
| Approval process | No formal sign-off. The team that started the pilot keeps running it | A named approver signs off before a new use case goes live |
| Monitoring | Nobody is specifically watching for drift or misuse | An assigned owner reviews logs and flags issues on a set schedule |
Why mid-market AI strategies stall between pilot and scale
Deloitte's 2026 State of AI report is based on a survey of 3,235 business and IT leaders across 24 countries. Only 25% of them say their companies have moved 40% or more of their AI pilots into production. Another 54% expect to reach that level within three to six months. Still, getting individual pilots into production is a long way from running AI across the whole company, which only 2% of mid-market firms in the Kaufman Rossin survey have done. In practice, a pilot works well enough to keep running but never earns enough trust to become part of everyday operations. Nobody signs off on the trial becoming permanent, so nobody owns what happens if it fails. Change management stalls for the same reason, since no one is assigned to train the team whose work the pilot changes.
Nobody signs off on the trial becoming permanent, so nobody owns what happens if it fails. Failure to adopt AI usually starts before anyone picks a tool: governance gets pushed until after the rollout works, even though governance decides whether the rollout should happen at all.
The same Deloitte report shows how far governance trails ambition. Close to three-quarters of companies plan to deploy agentic AI, meaning AI agents that complete multistep tasks on their own, within two years. Yet only 21% report a mature model for governing those agents.
What happens when a mid-market company has no AI policy?
ISACA's 2026 AI Pulse Poll, which surveyed more than 3,400 digital trust professionals worldwide, found that only 38% of organizations have a formal, comprehensive AI policy. Confidence in oversight is just as thin: only 11% of practitioners strongly agree their organization gives AI ethics sufficient attention, and fewer than two in five are confident their board understands AI risk. Those numbers suggest that many organizations have no written answer to which data their AI tools may touch.
Without a written policy, a mid-market company faces the same risks as a large enterprise but has fewer people in a position to catch problems early. In our experience, the reason is ownership. Without anyone assigned to AI governance, drafting a policy stays on a to-do list nobody is measured against. A typical case starts with a team's growing reliance on a free public chatbot. One day, an employee pastes a client's financial data into it, and nobody notices for months. The problem finally surfaces when that client sends a security questionnaire. Svitla's AI readiness audit finds where data already flows into AI tools before a client or regulator asks.
What a responsible AI policy should cover
A responsible AI policy is shorter than most companies assume. Broad principles such as fairness and transparency set the tone, but teams follow rules written for their specific context. Getting there usually takes one focused conversation across legal, IT, and business units. In practice, the policy needs to answer four questions:
- Which types of data, such as customer personally identifiable information (PII), financial records, or source code can reach an AI tool at all
- Which use cases need a named approver before launch
- Who's accountable when an AI-assisted decision turns out to be wrong
- How often is the policy reviewed since AI tools change faster than most internal documents get updated
AI policy development often fails when the policy is written as a standalone compliance document, disconnected from how teams work. A policy that blocks a sales team from using any AI tool gets ignored within a quarter. A policy that names three approved tools, defines what they can be used for, and lets teams approve new use cases in less than a day tends to survive real deadlines.
Building an AI operating model that survives contact with real workflows
A policy sets the rules, but someone still has to apply them every day. An AI operating model defines who that is. Without one, mid-market companies often let whichever team adopted AI first make the calls for everyone else. McKinsey's research on the three horizons of AI transformation shows how much the depth of change matters.
Among leaders at companies that redesigned roles, workflows, and operating models around AI, 48% reported capturing meaningful enterprise value. That share drops to 24% where companies automate existing workflows and to 13% where employees only get general-purpose AI tools.
The first step toward that redesign is smaller than it sounds at mid-market scale. It usually comes down to three decisions: who approves a new AI use case, which team monitors it once it’s live, and who can override an AI-assisted output. Each approval also names the KPI the project has to move, such as cycle time or operational costs, so there’s a baseline when scaling comes up.
Svitla's AI leadership strategy work starts with those decisions, then builds toward the deeper workflow changes McKinsey’s research ties to higher value.
What an agentic AI control framework adds that a policy document can't
A policy sets the rules, and an operating model names who applies them. An AI control framework produces the evidence that those rules are followed, such as audit logs and approval records. That evidence matters the moment a client, auditor, or regulator asks to see it.
The NIST AI Risk Management Framework, published by the US National Institute of Standards and Technology (NIST), is a voluntary framework built around four functions: govern, map, measure, and manage. It also describes the characteristics of trustworthy AI, from reliability and safety to transparency, privacy, and fairness, with harmful bias managed.
NIST positions it for organizations of any size and sector, which makes it a practical starting point for a company without a dedicated compliance team.
At mid-market scale, AI compliance usually means picking one recognized framework or standard and mapping existing controls to it. Two common choices are the NIST framework and ISO/IEC 42001, the AI management system standard from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
Keeping up with AI regulations is another reason to anchor on one framework, since the rules keep shifting across jurisdictions. In December 2025, President Trump signed Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence. It directs federal agencies to challenge state AI laws they consider onerous, though it doesn’t place direct obligations on companies.
Colorado, meanwhile, repealed its 2024 AI law, Senate Bill 24-205, before it took effect. Its replacement, Senate Bill 26-189, is a narrower automated decision-making law that takes effect on January 1, 2027. In the EU, a 2026 amendment delayed high-risk rules under the Artificial Intelligence Act, for uses such as hiring and credit scoring, to December 2, 2027.
A company already mapped to one framework can absorb those changes without starting over.
Under review, a control framework holds up when each control has a named owner, audit logs, and documented approval records. A set monitoring schedule keeps those records current between audits.
Bake governance into your AI strategy as a first step
A mid-market AI strategy with named governance owners won't scale automatically, but it removes a reason pilots often stay stuck. That means assigning owners for the AI policy, the AI operating model, and the AI control framework as part of the deployment plan. Waiting until a problem forces the question usually costs more.
None of this requires an enterprise budget. A named policy owner, a lightweight approval process, and one control framework mapped to existing tools cost far less than finding out during a client audit or a regulatory review that nobody can say where the data went. That groundwork also protects the proprietary data behind a company's competitive advantage. A Svitla AI readiness audit shows where your data already flows into AI tools, so you can close the riskiest openings before anyone else finds them.
