What Is an AI Operating Model?

An AI operating model describes how an organisation arranges itself to deliver AI again and again rather than once. An AI strategy document states what the organisation wants from AI and why; the operating model states who does the work, who decides, who pays and who answers for the result. An enterprise AI operating model spans the whole organisation, including units that only buy AI inside software.

It has six components: decision rights, ownership, funding, talent, governance and delivery, each explained below. Some frameworks list data and the technology platform as components of their own; here they sit inside governance and delivery. A target operating model is the future-state version, written so the gap from today can be planned and funded.

People often use the term for an AI centre of excellence, but a CoE is one mechanism inside the operating model: usually the team that sets standards, curates the shared platform and runs intake, as the guide to launching an AI center of excellence explains. The operating model decides what that team may approve, what business units may do without it, and how both are paid for.

Decision rights. Write down who may approve a use case, accept a risk, choose a model or vendor, release a system and stop it. The right to stop is the one most often missing. In Gartner’s May to July 2026 survey of 2,002 CIOs and technology executives, organisations with rules for when a pilot should not reach production were 2.3 times more likely to be among its best performers, and those with rules for retiring low-value AI already in production 2.6 times more likely; only 31% and 17% of CIOs had such rules (Gartner, October 2026).

Ownership. Every AI system needs a business owner for its outcomes and a technical owner for its operation, both recorded in the AI inventory. In McKinsey’s 2026 AI Trust Maturity Survey of about 500 organisations, those with clear ownership of responsible AI, through AI-specific governance roles or internal audit and ethics teams, averaged 2.6 on its maturity scale, and those without a clearly accountable function averaged 1.8.

Funding. Decide how ideas get seed money, how proven pilots earn scale funding and who pays to run a system for years. Usage-based costs fit annual budgets badly: in the same Gartner survey, 51% of CIOs expected AI to raise the total cost of ownership of technology, and Gartner advises governing AI economics across the whole life cycle, not just the purchase.

Talent. Choose where AI engineers, data engineers, platform staff and product owners sit, who manages them and how they move between teams. Roles, pod designs and sizing are covered in the companion guide to AI team structure.

Governance. Set policy, risk tiers, approval gates and review forums in proportion to risk. The NIST AI RMF expects documented, clearly understood roles and lines of communication for managing AI risk (GOVERN 2.1) and executive responsibility for decisions about AI risk (GOVERN 2.3); a policy and committee charter template puts that on paper.

Delivery. Define one path for every use case, from intake and triage through business case, pilot, release and monitoring to retirement, with the same gates for built and bought AI. A shared intake form and scorecard usually comes first, because each later gate reads from that record.

Four archetypes cover most real designs; the table below compares them. Centralised: one team holds the budget, the builders and the approvals. Hub-and-spoke: a hub owns the platform, standards and risk review, while spokes in business units own their use cases and much of the build. Federated AI operating model: business units run their own AI budgets, teams and delivery under a thin central function that sets common rules and keeps the inventory. Embedded: product and process teams build and run AI as ordinary work, on a platform the technology function provides as a service.

Few organisations run one archetype for everything. McKinsey’s March 2025 State of AI survey found risk and compliance, and data governance, often fully centralised, while tech talent and the adoption of AI solutions were most often hybrid; organisations under $500 million in revenue were more likely to centralise those too. In Gartner’s June 2025 survey of 432 organisations, almost 60% of leaders at high-maturity organisations had centralised AI strategy, governance, data and infrastructure, and 91% had appointed a dedicated AI leader.

The practical reading is to centralise what must be consistent, such as model approval, data classification, logging and the platform itself, and to distribute what needs business context, such as process redesign, adoption and day-to-day ownership. An AI center of excellence operating model is simply the hub in that arrangement, not a fifth archetype.

Maturity. With a handful of pilots and scarce skills, one team sets standards and learns fastest; once several units fund their own use cases, that team becomes a queue. Place yourself on the levels of the AI maturity model, score the detail with the readiness and maturity self-check, and revisit the archetype as you move up.

Risk exposure. The more of your AI that is high-risk, regulated or customer-facing, the more control should stay central or be enforced by the platform. Under the EU AI Act, deployers of high-risk systems must assign human oversight to people with the necessary competence, training and authority, as well as the necessary support (Article 26(2)). After the Digital Omnibus on AI, that duty applies from 2 December 2027 for Annex III systems, so the operating model must say who names those people.

Scale. Count the units that want to build rather than buy. When the central team’s capacity, not funding or risk, is what delays approved use cases, delivery is ready to move outward.

Data and deployment. Federating delivery does not mean federating the control point: many teams can build on one platform whose routing rules decide which class of data may reach which model.

Agents change the operating model because they act rather than only answer. In the 2027 Gartner CEO Survey of 203 CEOs and senior executives, run in April and May 2026, 63% named radically redesigning the operating model as a top move for AI returns through 2027, and 52% named aggressively deploying AI agents as employees. McKinsey’s October 2026 analysis adds an orchestration chart to the org chart, mapping which people and agents combine around each outcome, with agent autonomy, access, oversight and escalation settled as part of the work design.

Treat each agent as a new kind of team member with four records attached. Ownership: a business owner accountable for what it does and a technical owner who maintains it. Permissions: its own identity, least-privilege access to tools and data, and a list of actions that always need a person’s approval, as set out in governing AI agents. Oversight: named reviewers and escalation thresholds, designed in as human-in-the-loop checkpoints. Performance and life cycle: evaluation before release, observability in production, change control and a retirement date.

The frameworks already point this way: the NIST AI RMF asks for defined roles and responsibilities for human-AI configurations and oversight of AI systems (GOVERN 3.2), and for safe decommissioning (GOVERN 1.7). In BCG’s September 2025 study of 1,250 executives, one of the five strategies of the 5% of companies it calls future-built is an AI-first operating model rooted in human-machine augmentation and collaboration: workflows redesigned around what people and agents each do best, rather than AI inserted into the existing steps.

Drawing boxes before settling decisions. A new org chart with the same unclear approval path produces the same delays.

Funding pilots but not operations. Without a budget line for running live systems, successful pilots are stranded when the project team disbands.

No way to stop. Without exit criteria at the pilot gate and in production, low-value systems keep consuming money and attention.

Centralising delivery along with standards. A central team that must build everything becomes the bottleneck the design was meant to remove.

Agents without owners. An agent left running after its sponsor moves on is an unowned system with live permissions; put ownership transfer in every release checklist.

Copying a diagram. Archetypes are starting points. Test the design on two or three real use cases before rolling it out.

How the four designs divide decisions, money, people and risk. Survey figures on this page were checked with each publisher on 4 November 2026.