Generative AI Was Built to Be Unpredictable. Enterprises Cannot Be.

About fifteen years ago, I spent a lot of time around business-process transformation. Much of the work was about removing ambiguity. Define the process, encode the rules, decide how exceptions should be handled, automate the repeatable steps. The aspiration was simple: the same input should travel through the same controls and produce a dependable outcome.

Generative AI arrived with almost the opposite proposition. Give the system an intent, relevant context and room to reason. It can interpret messy language, combine evidence, draft a response, write code, explore options or plan a sequence of actions without being told every step in advance.

That difference explains much of the excitement of the past four years. We did not simply get better automation. We got software that can work inside ambiguity.

The same quality becomes awkward the moment AI moves from a personal productivity tool into a consequential enterprise workflow. A bank may want a model to understand a customer’s circumstances, but the final credit decision cannot be an act of creativity. A network agent can reason across alarms, topology and service history, yet a change to live network infrastructure needs policy, validation and a rollback path. A pharmaceutical team can use a model to explore scientific literature while still requiring regulated evidence to remain traceable and controlled.

A NOTE ON THE TITLE

“Unpredictable” is deliberately strong language. I do not mean random. Generative models are probabilistic. Outputs can vary, confidence is imperfect, and a fluent response is not a contractual guarantee. The enterprise is full of places where that variance has a cost.

The adoption numbers make more sense through this lens

The current data describe an industry that has moved quickly on access and experimentation, but much more cautiously on authority.

Stanford’s 2026 AI Index reports that 88% of surveyed organisations used AI in at least one business function in 2025, up from 78% the year before, while 79% regularly used generative AI in at least one function. [1] McKinsey’s newest global survey, published in August 2026 and covered in our mid-year read of the 2026 data, shows what happened next. The share of organisations reporting that AI is now scaling across the enterprise rose from 38% to 44% in a year. Over the same period, the share attributing any EBIT impact to AI stayed at 37%, essentially unchanged. [2] Deloitte found that only 21% have mature governance in place to manage the risks of agentic AI. [3]

The combination in the middle of that sequence is the part I find most revealing. Scaling moved. Measured value did not follow in the same year. These are self-reported surveys with different fielding windows, so I would treat the percentages as directional rather than as a single market measure. The direction is hard to miss. Capability and usage have moved faster than the operating model required to give AI real authority, and value appears to lag both.

There is a competing explanation I should put on the table rather than argue around. Flat EBIT impact might mean the value is real but badly measured. It might mean generative AI simply delivers less than we hoped, and that no amount of governance changes the arithmetic. McKinsey’s own reading emphasises organisational change rather than permission.

I do not think that reading conflicts with mine, because I mean something broad by permission. Permission is not a signature on a risk form. It is the whole set of conditions under which an organisation is willing to let a system carry part of a process: reliability evidence, controls, clear accountability, redesigned handoffs, retrained people and managers who accept a new division of labour. Organisational change is not an alternative explanation to permission. It is most of what permission is made of.

The measurement critique has more force, and I return to it at the end. If we are still counting seats and use cases, we should not be surprised that the value looks invisible.

I do not read any of this as evidence that generative AI has failed to deliver. I read it as the normal middle of a platform shift. We discovered the capability first. We are now engineering the conditions under which an enterprise can trust that capability with consequential work.

The Enterprise AI SHIFT Curve

A traditional hype cycle is useful for thinking about expectations. It does not quite explain what I see happening inside enterprises. The binding variable is permission: how much authority are we prepared to give a probabilistic system?

What the SHIFT Curve measures

That is the idea behind the Enterprise AI SHIFT Curve. The blue line represents what AI can do. Capability rose at extraordinary speed after 2022 and is still climbing. The purple line represents enterprise permission to act. It rises more slowly because authority brings questions of reliability, risk, control and accountability, and it never fully closes on capability. Some things a model can do are things an enterprise should still decline to let it do. The green line is realised enterprise value. It stays modest while permission lags, then rises as organisations become comfortable letting AI take on more of the workflow.

The Trust Gap is the space between what AI is capable of doing and what an enterprise is willing to permit it to do. I think that gap explains why an organisation can have hundreds of copilots and pilots yet only a handful of systems with meaningful authority. A good demonstration proves that a model can perform a task. It does not prove that the organisation should let it perform that task repeatedly, at scale, with access to production systems.

THE CENTRAL IDEA

Enterprise AI is the discipline of building deterministic systems around probabilistic intelligence.

The five stages

The five stages describe how that gap changes.

• Spark. The magic moment when the capability becomes visible.
• Human-led Adoption. Copilots, pilots and use cases spread while people retain decision authority.
• Integration Friction. The collision point. Probabilistic intelligence meets enterprises designed around consistency, auditability and accountability.
• Foundation of Trust. Where the less visible engineering starts to matter: context, evaluations, model routing, permissions, policy, observability, deterministic controls and human approvals.
• Trusted Autonomy. The point at which permission expands because the surrounding system has earned it.

The probability dynamic underneath the curve matters just as much as the stages. The journey is not from probabilistic AI to deterministic AI. The model does not need to lose the quality that made it useful. The enterprise moves from relatively unbounded probability towards bounded and governed probability. More control around the system can support more freedom inside it.

The hard engineering starts at Integration Friction

Stage three is where many initiatives become uncomfortable. The model has already shown that it can do the work. The enterprise now starts asking questions that a prompt cannot answer. Which data is it allowed to use? Which model should handle which task? What happens when the model is uncertain? Which tools can it call? How much money can it commit? When does a human have to approve the action? How do we prove what happened afterwards?

The tempting response is to constrain the system until every possible action has been prescribed. That can make the workflow safer, but pushed too far it destroys the reason for using generative AI. If every path is hard-coded, we have rebuilt traditional software with a more expensive component in the middle.

The better architecture separates the parts of a workflow where probability adds value from the parts where deterministic control is non-negotiable. The model can interpret, reason and generate. The orchestration around it controls context, tool schemas, model selection, identity, permissions, policy and validation. The final action can then be checked against evidence, approval rules and audit requirements.

This is where I use the term harness engineering. The word harness is already in circulation for the scaffolding around a model. What I am adding is the claim that this scaffolding is an enterprise discipline in its own right rather than an implementation detail. The harness is the operating system around the model: grounding, retrieval, routing, tools, memory, identity, evaluation, guardrails, monitoring and escalation. The exact components will vary by workload. The principle does not. Reliability has to be assessed at system level, not inferred from the intelligence of the model alone.

Governance also has to move closer to execution. A policy document or review board remains necessary in many organisations, but agentic systems need controls in the runtime path. A high-risk action may require a deterministic validation. Another may require a second model to verify evidence. Some decisions need a human approval. Others can be automatically stopped when the required context is missing or the confidence threshold is not met.

There is a language point here that I think matters. When I refer to a reasoning trace in this context, I do not mean exposing a model’s private chain of thought. The enterprise needs an auditable execution trace: what context was used, which tools were called, what evidence supported the decision, which policies were checked, who approved an exception and what action was finally taken. That is what makes the system accountable.

Why forward-deployed engineering belongs in the trust layer

Much of this architecture can be productised, but the boundary between freedom and control is enterprise-specific. A credit process, a network change and a regulated pharmaceutical workflow do not carry the same consequences. Even two companies in the same industry will have different systems, policies, risk tolerances and operating practices.

This is why forward-deployed engineering fits naturally into the Foundation of Trust stage. The last mile is not simply connecting an API. It is working with the people who own the process to decide where AI can recommend, where it can decide, where it may act, what evidence is required and how exceptions should work. The engineering has to happen close enough to the real workflow that the controls reflect the business rather than a generic reference architecture.

There is a risk here too. Forward deployment can become expensive bespoke work if every customer starts from zero. A good model should leave behind reusable evaluations, connectors, policy patterns, harness components and customer capability. The enterprise should become more self-sufficient as the system matures, not more dependent on a small team that understands the magic.

More trust should create more freedom

The positive part of this story is easy to miss. We are building these controls so enterprises can safely give AI more responsibility. Better governance should not freeze an agent at the recommendation stage. It should make the next level of permission possible.

This is not only an argument from conviction. McKinsey’s March 2026 study of AI trust found that nearly two-thirds of respondents named security and risk concerns as the top barrier to fully scaling agentic AI, ahead of regulatory and technical constraints. The same study found that organisations investing most heavily in responsible AI were far more likely to report EBIT impact above 5%. [4] In that data, trust behaves like an enabler of value rather than a tax on it.

A useful progression is already visible. First the system assists. Then it recommends. With stronger evidence and policy it can make bounded decisions. Add the right permissions, validation and monitoring and it can act. Eventually it can operate parts of a process autonomously, with humans setting policy, supervising exceptions and remaining accountable for the system.

The appropriate level of autonomy depends on consequence. I am comfortable giving a drafting assistant considerable creative freedom. A customer refund needs tighter controls. A live network configuration needs a different standard again. Health, financial and legal decisions raise the bar further. Technical capability alone should never determine permission.

This is why Trusted Autonomy is a better destination than full autonomy. There will not be one moment when an enterprise suddenly hands itself over to agents. Permission will expand process by process, domain by domain and risk class by risk class. Some workflows will remain human-led for a long time. Some should remain deterministic. Others will become increasingly autonomous because the organisation can demonstrate that the system is behaving within clear boundaries.

The platform shift is moving from capability to permission

For the first phase of generative AI, the model deserved most of the attention because capability was changing at extraordinary speed. The next phase will be shaped just as much by the architecture and operating model around the model. That includes the unglamorous work of evaluation, identity, process redesign, exception handling, cost control, monitoring and adoption.

I think this also changes how we should measure enterprise AI maturity. Counting use cases or activated seats made sense during Human-led Adoption. They tell us less once an organisation enters Integration Friction. The harder measures are about authority and evidence: how much of the workflow can the system complete, how often does it need human intervention, what are the override and failure rates, how quickly can an exception be traced, and does the business result improve when permission expands?

This is also my answer to the measurement objection raised earlier. If an organisation cannot say what share of a workflow its systems complete unaided, or how often a human has to intervene, then a flat EBIT number is not strong evidence about the technology. It may be evidence about the instrumentation.

Generative AI became useful because we allowed software to interpret rather than merely execute. Enterprise adoption will not succeed by stripping that quality away. It will succeed when organisations put strong deterministic boundaries around the places where error matters while leaving enough probabilistic freedom for the intelligence to be useful.

The SHIFT curve is my way of describing where we are. Much of the market has passed the Spark. Human-led Adoption is broad. Integration Friction is now visible. Foundation of Trust is where engineering and operating-model work is accumulating. Trusted Autonomy will arrive unevenly, but that is where the economics of AI should start to look very different.

THE CLOSING THOUGHT

The platform shift becomes real when “Can the model do it?” is no longer the difficult question. The difficult question becomes “Can we let it do it?”, and the enterprise has enough evidence to answer yes.

In brief

What is the Trust Gap in enterprise AI?

The Trust Gap is the space between what AI is capable of doing and what an enterprise is willing to permit it to do. Capability has risen far faster than permission, because permission requires reliability evidence, controls, accountability, redesigned handoffs and people who accept a new division of labour. The gap explains why an organisation can run hundreds of pilots yet operate only a handful of systems with real authority.

What are the five stages of the Enterprise AI SHIFT Curve?

Spark, where models demonstrate extraordinary capability. Human-led Adoption, where copilots and pilots spread while humans retain decision authority. Integration Friction, where probabilistic intelligence collides with enterprise requirements for consistency, auditability and accountability. Foundation of Trust, where harnesses, evaluations, controls and forward-deployed engineering mature. Trusted Autonomy, where permission expands because the surrounding system has earned it.

How should enterprises measure AI maturity?

Counting use cases and activated seats measures access, not authority. The harder measures are the share of a workflow the system completes unaided, the human intervention rate, override and failure rates, the time taken to trace an exception end to end, and whether the business result improves as permission expands.

Sources and notes

The SHIFT Curve is an original interpretive framework developed for this essay. The figures below are used as directional evidence for the gap between broad AI usage, scaled authority, governance maturity and realised value. All four are self-reported surveys with different fielding windows, noted where relevant.

• Stanford Institute for Human-Centered Artificial Intelligence, 2026 AI Index Report, Economy chapter. Reports 88% organisational AI use in 2025, up from 78% the prior year, and 79% regular generative AI use in at least one business function. The corporate adoption section draws on McKinsey survey data, so this figure and reference [2] come from the same survey series a year apart. Source
• McKinsey & Company, The state of AI in 2026: On the road to ROI, 25 August 2026. Fielded 4 May to 8 June 2026 with 1,719 respondents across 97 countries. “44 percent now report that AI is scaling across their enterprise, up from 38 percent a year ago.” “Thirty-seven percent of respondents attribute at least some EBIT impact to AI use (about the same share as last year).” Accessed 28 August 2026; McKinsey reuses this URL for the current edition each year. Source
• Deloitte, The State of AI in the Enterprise 2026, published January 2026. Survey of 3,235 board, C-suite and senior leaders across 24 countries, fielded August to September 2025. The 21% figure is reported in Deloitte’s accompanying analysis, “Business and IT leaders report AI agents are scaling faster than their guardrails,” 24 April 2026: “Only 21% of enterprises responding to a recent multicountry Deloitte survey report having mature governance in place to manage the risks of agentic AI.” Source
• McKinsey & Company, State of AI trust in 2026: Shifting to the agentic era, 25 March 2026. Nearly two-thirds of respondents cite security and risk concerns as the top barrier to fully scaling agentic AI. Organisations investing $25 million or more in responsible AI report higher maturity and are far more likely to realise EBIT impact above 5%. Source Writing note: the essay deliberately separates reported evidence from interpretation. It uses first-person judgement where the argument is mine, and avoids treating survey percentages as a single universal measure of enterprise adoption.