A lot is happening in many organizations right now. Licenses are being bought, pilot projects launched, first use cases tried out. The technical rollout of AI is in full swing. But in my work I keep seeing that this alone is not enough.
I support organizations in their AI transformation. The longer I do this, the clearer it becomes to me that three things are needed at the same time. First, technology: the right tools and a clean rollout. Second, people who understand why things are changing and feel confident enough to try it out. And third, information security, which makes sure all of this doesn't come back to bite us. With ISO 27001, the EU AI Act and the Cyber Resilience Act, it has long stopped being a side note.
A multiplication, not a sum
I like to think of it as a formula: Technology × People × Security = Effectiveness. In a sum, a strong side could make up for a weak one. In a multiplication, it can't. If one factor is zero, the result is zero, no matter how good the other two are.
Three failure patterns from practice
When one of the three factors is missing, a typical pattern emerges. I come across all three regularly.
Shadow AI: technology and people without security. A head of HR, motivated and open to new things, does the workforce planning with her private AI model. The intention is good, the work gets done faster. But in the process, personnel data, the most sensitive data in the company, ends up in a tool nobody has any control over. Nobody prohibited it. But nobody offered a safe way to do it either.
License graveyard: technology and security without people. "Well, we have Copilot." I hear this sentence a lot. The tool has been rolled out, checked for data protection and properly approved. And yet the organization never really gets going. What's missing is support, concrete use cases and time to learn. The licenses keep running, the impact doesn't show up.
Paper tiger: people and security without technology. Actually, a lot is right here. There is a good security framework, and people want to get started. Only no usable tool is provided. The policy governs something that doesn't happen in everyday work at all. The motivation fizzles out, or it drifts off into shadow AI.
What this means for leadership
AI transformation can't be delegated to a single department. Especially in larger organizations, IT, HR and organizational development, and information security often sit in separate areas with their own budgets and priorities. Bringing these three to one table is the job of senior management.
Three questions help you take an honest look at where you stand:
- Which AI tool are your employees allowed to use today, and do they know it?
- How many of them actually use it, and what is holding the others back?
- Have the requirements of ISO 27001, the EU AI Act and the CRA been translated in a way that helps in everyday work rather than scaring people off?
Looking ahead
To be honest, I hardly know any organization where these three things already work together in a truly balanced way. That shows where we are right now, and it's the task for the coming months. In another post, I look at the role security can play in this when it is well calibrated.