AI is already in your business.
It may not yet be formally deployed by the organization, but it is already in people’s hands, entering processes, supporting decisions and, increasingly, performing tasks through automations, often through personal tools or accounts used by well-intentioned employees trying to improve the performance of the processes under their control.
The challenge is now different.
How do we grow this usage without losing control and, above all, without creating problems today that will only become visible when adoption reaches scale?
At the beginning, almost everything looks simple. One model, a few users, limited consumption, a few prompts and an LLM provider that apparently solves almost everything.
As usage grows, automations begin to access internal information, people teach context to models, good conversations generate knowledge, prompts and workflows improve, and some areas begin to depend effectively on that infrastructure.
Everything looks manageable until conditions change.
The chosen provider can change prices, require more consumption per task and simply stop being the most efficient option. Another model may emerge that is faster, cheaper or better for what your company needs.
And then a question appears that almost no one asks at the beginning:
How much effort would it take to migrate everything built on model A to model B?
Prompts, contexts, automations, integrations, tests, learning and accumulated knowledge can turn an apparently simple decision into an expensive and risky project.
That is the portability problem. It seems distant when the company starts with a single model, but it can become critical once dependency has already been built.
Our work was to identify which apparently small precautions today can prevent expensive and difficult business problems in the near future.
The conclusion is not that business leaders should fear AI. Quite the opposite. They need to embrace AI, experiment, move forward and quickly capture what it already enables them to do better. But they must do so knowing that some traps are set precisely at the beginning of the journey, when everything still looks simple and inexpensive.
To develop this work, we combined what we have been tracking at Moat Radar with research, recent publications, podcasts, studies on corporate AI adoption and conversations with executives and professionals confronting these challenges in practice.
Together with portability, which we have just mentioned, we identified seven levers that deserve attention from the earliest stages of adoption: Security, Data and Context, Intelligent Allocation, Retained Learning, Portability, Value Management and People.
1. Security
How can AI be used without exposing the company?
The discussion goes far beyond whether the provider uses company data for training. As AI moves from simply answering questions to consulting systems, performing tasks and acting on behalf of people, the nature of the risk changes.
An automation that accesses ERP, CRM, email or other corporate systems operates with permissions that need to be controlled like those of a new digital identity.
In an article published on NIST’s cybersecurity blog, NCCoE experts warn that sharing human credentials with agents creates security and accountability problems. Agents need to be treated as identities of their own, with specific credentials and permissions that are short-lived and limited to what is necessary.
Passwords, permanent authentication tokens and overly broad access may look like quick solutions in the first experiment. When dozens of automations begin operating across company systems, they can become a new attack surface.
At the same time, AI also expands attackers’ capabilities. Mandiant, the Google Cloud unit specializing in threat intelligence and incident investigation, documents the growing use of AI by attackers in social engineering, malware development and other stages of attacks.
Mandiant itself notes, however, that a large share of intrusions still begins with familiar human and systemic weaknesses.
AI does not necessarily create the vulnerability. It can make it much easier to find and exploit.
Addressing this early means knowing which tools are approved, what information may circulate, who grants access, what permissions each automation has and how to immediately stop anything that should no longer be operating.
2. Data and Context
Which data and information need to be organized, and how far is it worth investing in this?
For some time, companies have heard that they should organize their data before moving forward with artificial intelligence. The recommendation has merit, but it can lead to the wrong conclusion: that the entire data architecture must be perfect before the first relevant use case.
It does not.
The question is which data and information that problem requires, whether they are reliable, current and accessible with the right permissions, and whether there is enough context for AI to interpret them correctly.
An excellent model working with incorrect, outdated or poorly contextualized information is still working from a bad foundation.
And context becomes almost as important as the data itself.
A piece of information can be correct in isolation and still produce a poor answer if the model does not understand the business rule, the exception, the history of the decision, the meaning of a particular indicator or how that organization operates.
The more AI participates in relevant processes, the more this context layer stops being ancillary and becomes part of the infrastructure required to produce good answers.
A recent McKinsey study on AI data readiness reaches precisely this conclusion. The required level of preparation should be defined by business needs and the risk involved, not by an abstract pursuit of perfect data across the entire company.
This turns data preparation into an economic decision.
For each initiative, there is a cost to locate, organize, update and make the necessary information available. That cost should be part of the solution’s business case.
But there is a second question, perhaps even more important: will what we are organizing now serve only this case, or can it be reused by others?
In another study, The missing data link: Five practical lessons to scale your data products, McKinsey addresses exactly this question. When several high-value use cases depend on the same information, a meaningful portion of the initial investment in preparation, quality and access can be reused in subsequent applications.
In that case, the first project is not just consuming data. It is building a foundation that can reduce cost and accelerate the next ones.
This is where an important distinction begins to emerge between organizing data to solve a specific problem and building information assets that can serve multiple problems.
The risk lies at both extremes.
Then one side, waiting for the entire company to be perfectly organized before starting. Then the other, multiplying solutions that depend on scattered, outdated data or context that exists only in a few people’s heads.
You do not need to organize all data before starting. You need to know which information the problem requires, what it costs to make it ready and whether today’s effort can be reused tomorrow.
3. Intelligent Allocation
Are we using the right intelligence, in the right place and in the right amount?
Not every task requires the same intelligence.
Summarizing a document, classifying information, writing code, developing a strategy or analyzing a high-impact decision are different challenges and may justify different models and levels of capability.
Always using the most powerful model can waste resources. Using insufficient capability precisely where the cost of error is high can also be expensive.
The same concern applies during development, operation and evolution of solutions. Models, prices and techniques change quickly, and something that seems efficient today may no longer be the best alternative a few months later.
That is why tokens* matter, but they do not tell the whole story.
The FinOps Foundation recommends looking at the total cost of producing a given outcome. A seemingly cheaper model may require retries, more human intervention or additional processing and end up being the more expensive alternative.
More than constantly searching for a supposed best model, the company needs to accumulate experience about which combinations of capability, quality and cost make the most sense for the organization’s different uses.
That learning, as we will see, also needs to be preserved.
* Tokens are units models use to process information and generate responses, and they are one of the bases for charging for the use of many language models.
4. Retained Learning
Does what the company learns with AI continue to belong to the company?
A conversation with AI can accumulate a great deal of value.
Along the way, someone explains context, corrects interpretations, presents exceptions, rejects hypotheses, defines criteria and eventually reaches a better answer.
A conversation can carry hours of context and learning. When it ends, however, nothing guarantees that all of it will be available in the next interaction.
That knowledge may remain in a chat, a personal account, an abandoned automation or only in the head of the person who conducted the conversation.
The greater the usage, the greater the chance that thousands of interactions produce decisions, preferences, exceptions and knowledge every day that never become organizational assets.
And there is an additional layer.
The organization also learns how to use AI itself more effectively.
It begins to discover which models work better for certain challenges, which contexts produce better results, which approaches tend to fail and which practices improve quality or reduce cost.
That learning is also an asset.
If every new solution has to discover everything again, the company will repeat the same trial-and-error process in dozens of places.
That is why retained learning should include both what the company has learned about the business and what it has learned about using AI to solve its problems.
Whenever possible, a new solution should start from the relevant context, known rules, identified errors, quality criteria and the organization’s accumulated experience.
Here the connection with the other levers becomes clear. Data and Context ensures access to the necessary information. Intelligent Allocation helps determine which capability makes the most sense. Retained Learning prevents those discoveries from being lost.
Saving every conversation does not solve the problem either. A company does not need millions of pages of history that no one will ever find again.
It needs to identify what deserves to survive, preserve its origin and turn what really matters into useful memory, rules, documentation, procedures, evaluations or reusable knowledge.
The asset is not the chat or an automated task. The asset is what the organization can learn, preserve and reuse from them.
5. Portability
Are you locked into a model? How much effort would it take to change?
It is perfectly rational to start with a single provider.
The problem is not starting simple. It is failing to notice when that simplicity begins turning into dependency.
With each solution, the company accumulates prompts, contexts, memory, integrations, tests, automations and business logic.
Some of this may be easily portable. Some may depend deeply on a provider’s architecture or features.
We can call the future effort accumulated by these decisions portability debt.
It is almost invisible in the first project. It becomes visible when prices change, a better model appears, a feature disappears or a new technical or regulatory requirement emerges.
A survey by the IBM Institute for Business Value, conducted with Oxford Economics and one thousand executives responsible for AI, data or technology, found that 71% would consider it difficult to switch their primary AI provider or model today. The same study shows that 57% say replacing a core model would require significant decoupling or a complete rebuild of the system.
Not every application needs the same level of portability. But the more strategic, sensitive or critical a process is to the business, the greater the concern should be to preserve an alternative.
Freedom of choice also makes it possible to benefit from differences in quality, capability and cost among models as the market evolves.
The goal is not to hire multiple providers as a matter of principle.
It is to preserve the ability to choose.
You do not need to start with multiple models. You need to build the first one so that the second remains an option.
6. Value Management
Is AI delivering what it promised?
As we discussed in the previous article, “there is a meaningful gap between technological capability, adoption and economic results. The real challenge now is not simply having access to AI. It is figuring out how to turn that capability into real business value.”
This remains, perhaps, leadership’s main responsibility.
Every relevant initiative should begin like any business investment: a clear problem, an owner, a baseline, a business case, KPIs, planned investment and an expected outcome.
After implementation, the other half of the equation needs to exist.
Did the process become faster? Better? Cheaper? Did revenue, quality or capacity increase? Did adoption happen? What did it cost to build? What does it cost to run? What was the projected return and what was actually delivered?
This is where there should be the CEO’s AI control panel.
Not a dashboard of licenses or user counts, but a view of the initiative portfolio, its owners, costs, promised outcomes, realized outcomes and the next decision: scale, correct or stop.
With agents, another dimension appears.
An agent can make additional attempts, use more reasoning capacity, call other tools or resort to more expensive models to try to improve an answer. Each of these decisions can increase the cost of the task.
Operational autonomy also creates economic autonomy.
The report The executive decisions shaping the value of the digital workforce, published by Deloitte in 2026, recommends that organizations track cost per task, consumption and limits capable of preventing spending from growing silently alongside agent autonomy.
The 2026 Tech Leader Study, conducted by the IBM Institute for Business Value with Oxford Economics and 2,000 senior executives responsible for IT, technology or AI decisions across 33 geographies and 19 industries, found that 85% of respondents still lack complete, real-time visibility into AI spending.
A recent case helps show how quickly this problem can emerge.
In May 2026, Andrew Macdonald, Uber’s president and COO, acknowledged that the company still had difficulty establishing a clear relationship between increased use of tools such as Claude Code and the delivery of more useful features to consumers. The discussion gained weight because the company had consumed its annual budget for AI coding tools in four months.
In August, Uber Engineering itself showed how the response evolved. Between February and August, weekly users of agentic tools grew sevenfold and requests increased 9.4 times, while total AI spending stabilized from April onward. Holding the model constant to isolate the effect of optimizations, cost per thousand requests fell nearly 34% from the peak and cost per session fell 52%.
The point is not to judge Uber. It is to learn from a company that moved early, encountered a cost-control problem and began treating it as an engineering problem.
Encouraging adoption without seeing and managing cost can make usage grow faster than the ability to control it.
7. People
Is the company turning individual learning into organizational culture?
There are three different challenges here: preparing people to work with AI, spreading knowledge and preparing people for a new organization.
The first is preparing people to work with AI.
Not merely teaching a tool.
Models and interfaces will change. What needs to remain is the ability to frame problems, provide context, question answers, validate results, understand limitations, protect information and know when human judgment needs to prevail.
It is a matter of AI literacy.
Professor Carlos Bifi structures this discussion in the LIA model, AI Literacy, around five dimensions: Instrumental, Critical, Ethical-Legal, Creative and Social. The central idea is especially relevant for companies: developing people who can work with AI with autonomy and judgment is not the same as training them on the product chosen this year.
The five dimensions address different and complementary capabilities: the Instrumental, related to the use of tools; the Critical, to the ability to evaluate and question results; the Ethical-Legal, to safe and responsible use; the Creative, to the ability to rethink tasks and ways of working; and the Social, to AI’s impacts on collaboration, culture and people.
The model also proposes progression through four proficiency levels: Basic, Intermediate, Advanced e Specialized. The progression helps show that AI literacy does not end with knowing how to use a tool. It evolves together with the ability to understand, evaluate and use the technology with increasing autonomy and responsibility.
The second challenge is spreading knowledge.
When one person discovers a better way to work with AI, does the entire company learn or only that person?
Every day someone finds a better prompt, a more efficient way to build context, a validation technique, a more suitable model, a different division of the task or simply discovers something that does not work.
If that remains only with that person, individual capability has grown, but the organization has not necessarily evolved.
The Work Trend Index 2026, from Microsoft, surveyed 20,000 AI users across ten markets and identified the Frontier Professionals, the group of the most advanced users in the study. They report much more frequently sharing tips, new agents, lessons and mistakes (61% versus 36%) and discussing quality standards for AI-assisted work (54% versus 29%).
That is how individual learning begins to turn into collective capability.
This even affects onboarding. New employees should not need to repeat years of trial and error to discover what the company has already learned. They should find practices, examples, criteria, tools and accumulated knowledge that allow them to quickly understand:
“This is how we use AI here.”
There is also a delicate incentive issue.
If someone discovers that they can do in two hours what used to take eight, has the organization created the conditions for that discovery to be shared?
Or does the employee conclude that revealing the gain may simply make their own job less necessary?
If the company does not solve this equation, it can produce a perverse result: people using AI intensively, capturing real gains and keeping part of that learning hidden from the organization itself.
This is where the boundary with Retained Learning needs to remain clear.
Retained Learning preserves knowledge. People ensures that this knowledge circulates, is absorbed and becomes part of the culture.
The third challenge is preparing people for a new organization.
In a text published in August 2026, Bill Gates warns about the impact this transformation may have on work. His concern is not only with the productivity the technology may unlock, but also with the speed at which certain roles may disappear or be profoundly changed and society’s ability to create alternatives for the people affected.
For companies, this discussion starts earlier.
As AI takes on tasks, expands individual capability and changes how processes are executed, it also changes the organization itself. Some roles will be redesigned, others may disappear, new capabilities will become more important and people may take on responsibilities very different from today’s.
That is why the question should not be only how much productivity will be captured.
What organization are we building with AI? Which roles will need to change? What new capabilities will be required? And are we preparing people to occupy this new space?
So, what do I do now?
It is not enough to prepare people to use AI better. Knowledge needs to circulate, become embedded in culture, and the organization and its professionals need to be prepared for the transformation already under way.
This work is an attempt to organize, in a structured way, perceptions, lessons and problems that are beginning to appear among companies and professionals that have already started their artificial intelligence journey.
The seven levers are not intended to form a definitive implementation manual. We are all still learning. Models change, technologies evolve, new forms of use emerge and problems that seem small today can take on another dimension as adoption grows.
This work also seeks to do something simple: learn from those who went first.
AI adoption is still recent, but there are already successful decisions, difficulties, waste, dependencies and documented mistakes. We do not need to repeat all of them to learn.
We are navigating largely uncharted waters. As we anticipated in the previous article, there may still be no precise map showing exactly where each company should go. But there is already enough experience to recognize some routes that appear safer, decisions worth making early and paths that can create risks, costs or dependencies that are difficult to correct later.
That is the main objective of this work: anticipate.
Anticipate questions that may not yet be asked. Identify precautions that cost little when addressed early but can become expensive once the operation reaches scale. And help build a journey in which adoption speed and management discipline advance together.
The seven levers should not be treated in isolation either. Data and Context influences the quality of solutions. Intelligent Allocation seeks to match the necessary capability with cost and the expected outcome. Retained Learning ensures that what the organization discovers does not disappear. Portability preserves freedom of choice and expands cost alternatives. Security defines the boundaries within which all of this can operate. Value Management checks whether the effort is producing results. And People determines whether what some people have learned can become organizational capability and culture.
To turn these ideas into a first practical action, we built an initial version of the 7 Levers Questions presented in this article.
It is not intended to be a maturity certification, nor does it aim to assess every control an organization may need in the future. It is a first version of the questions that should be raised in the early stages of AI adoption to verify whether some basic safeguards are already in place.
The questions are designed to be simple and practical. In many cases, a negative answer does not require a major technology project. It requires recognizing a gap, defining a rule, assigning responsibility or creating a control before usage grows. It is the familiar see and act.
As adoption advances, additional levels of maturity will naturally emerge. New questions will need to be added, some controls will become more sophisticated and we will probably discover risks that we cannot yet see today.
This first version of the 7 Levers Questions therefore represents the current stage of our learning. It was built from the literature, market observation, conversations with those already implementing AI and practical experience accumulated along this journey. It should continue to evolve as we learn.
More important than simply moving fast is anticipating the decisions that will allow AI usage to become real organizational capability. Capturing what works, preserving learning, spreading best practices and embedding them in culture is what separates a company that merely uses AI from an organization that learns with it.
The advantage will not belong only to whoever adopts AI first, but to whoever can turn what they learn with it into knowledge, culture and competitive advantage. That is how AI stops being just a tool and starts contributing to the construction of your MOAT.*
* In strategy, a moat is a durable competitive advantage that protects a company from competition and helps preserve its ability to generate value over time. The term, popularized by Warren Buffett, comes from the moat that protects a castle.
I want to record my thanks for the many contributions I have received over the past few weeks on this journey of writing about what I have been calling the AI revolution.
Many of the ideas, questions, provocations and examples that helped shape this article came from conversations with executives, professionals and readers facing these challenges in practice.
And I want to keep this process open.
I will be deeply grateful for any comments, experiences, difficulties, lessons, as well as opposing views, that readers wish to share with me below or directly through my LinkedIn account. The more we can test these ideas against the reality of those implementing AI, the more useful and precise this work can become.
Below you can leave criticism, suggestions, reflections, challenges, good practices or any comment you would like to share. Your message will be sent directly to the author and will not be published. Your name, email and message content will remain private.