An AI strategy is a short set of choices: where AI should create value, what the organisation will not do with it, how much risk it accepts, what it will build or buy, and how much it will spend. This template puts those choices on one page under nine headings, then expands them into a full strategy document the executive team can approve and revisit every year.
Key takeaways
- 01 A strategy makes choices, a roadmap puts them in order and a plan schedules the tasks. Keep three documents, not one.
- 02 Open with a diagnosis of the challenge, the first part of Richard Rumelt's kernel of good strategy, rather than with a list of goals.
- 03 Write risk appetite as rules staff can apply without asking, such as which data may go to which models and which actions need human approval.
- 04 Fund the foundations as well as the use cases. Data, platform, security and skills decide whether the second use case costs less than the first.
- 05 Rewrite the strategy once a year with the budget and review its measures every quarter.
What an AI strategy is and who owns it
An AI strategy is the set of decisions that tells the organisation where AI is expected to create value, where it is not wanted, and how much money and risk the organisation will commit to get there. It is short by design. A strategy that runs to sixty pages is usually a catalogue of initiatives rather than a set of choices.
The executive committee owns it. A chief AI officer, CIO or chief data officer drafts it; finance, risk, legal, HR and the business unit heads shape it; the board approves the risk appetite and the investment envelope. In many companies the drafting role now has an obvious holder: IBM’s 2026 CEO Study, published on 4 May 2026, found that 76% of the surveyed organisations have a chief AI officer, up from 26% the year before.
Strategy, roadmap and plan are three documents
People searching for an “AI strategy plan” usually need two of the documents below, written in order.
| Document | Question it answers | Horizon | Owner | How often it changes |
|---|---|---|---|---|
| AI strategy | Where will AI create value, within which limits, with how much money? | Three years | Executive committee | Yearly, or on a trigger |
| AI roadmap | In what order do the initiatives happen, and what depends on what? | 12 to 24 months, rolled forward each quarter | Head of AI, approved by the steering group | Quarterly |
| AI implementation plan | Who does which task, by when, with which budget? | One initiative or phase | Project manager | Weekly |
The roadmap template turns the strategy’s bets into a phased sequence, and the implementation plan template schedules each initiative once it is funded. Every investment inside the strategy still needs its own business case, and the implementation playbook shows how the documents connect through a programme’s gates.
What makes it a strategy
Writing in McKinsey Quarterly in June 2011, Richard Rumelt described the kernel of good strategy in three parts: a diagnosis of the challenge, a guiding policy for dealing with it, and coherent actions that support the policy. He named four hallmarks of bad strategy: failure to face the challenge, mistaking goals for strategy, bad strategic objectives, and fluff. A strategy that says “become AI-first” without naming the obstacle fails the first test, which is why the template below begins with a diagnosis.
The one-page AI strategy template
Nine blocks, each holding a decision. Write two or three lines per block and include at least one number or named limit in each.
| Block | What to decide | Test of a good entry |
|---|---|---|
| 1. Ambition | The diagnosis in one sentence, then what AI should achieve by a date | Names the business challenge, not the technology |
| 2. Value pools | Three to five domains where AI will be applied, each with the size of the prize | Every pool has a measured baseline and an owner |
| 3. Principles | Four to six rules that shape every AI decision | Each principle rules something out |
| 4. Guardrails and risk appetite | What is prohibited, what needs approval, and the tolerance for error by type of use | Written as rules a team can apply without escalating |
| 5. Capability bets | The data, skills, process and technology capabilities you will build | Each bet has an owner and a funding line |
| 6. Platform stance | Build, buy or both; cloud, on-premises or air-gapped; how models are sourced | States which data runs where |
| 7. Operating model | Who builds, approves and runs AI: central, federated or hub-and-spoke | Decision rights are named |
| 8. Investment envelope | Budget over the horizon, the split between foundations and use cases, release rules | Money is tied to gates, not announcements |
| 9. Measures | Value, adoption and risk measures with targets and review dates | At least one financial measure |
Notes on the harder blocks
Principles. Start from the OECD AI Principles, first adopted in 2019 and revised in May 2024. Their five values-based principles cover inclusive growth and well-being; human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability. Then make each principle specific to your business.
Guardrails and risk appetite. The NIST AI Risk Management Framework expects organisational risk tolerances to be determined and documented (MAP 1.5) and treats governance as a function that runs through everything else. In practice, write appetite by type of use: zero tolerance for personal data in unapproved tools, a low appetite for errors in customer-facing output, a moderate one for internal drafts. Connect the guardrails to your AI governance policy and to how you will deal with unsanctioned AI use. In the EU, the AI Act sets the floor. As reworded by the Digital Omnibus on AI, Regulation (EU) 2026/1744, Article 4 asks providers and deployers to take measures to support the AI literacy of their staff, and the high-risk obligations for Annex III systems apply from 2 December 2027. The full list of EU AI Act dates after the Omnibus sits on a separate page.
Capability bets. McKinsey’s State of AI survey of 25 August 2026 found that nearly three-quarters of AI high performers had fundamentally redesigned workflows because of AI, compared with a quarter of other respondents. Process redesign therefore belongs in this block next to data and skills.
Platform stance. Say what runs where, and why. In the IBM study, 83% of respondents agreed that AI sovereignty is essential to business strategy, so data location, model sourcing and dependence on one vendor have become board questions rather than IT preferences. The guide to avoiding lock-in on an agent platform covers the build-and-buy trade-offs.
Operating model. Name who may build, who approves and who runs AI in production. The operating model explainer goes through the design options in depth, and a centre of excellence is one common way to staff a central hub.
Investment envelope. Fund foundations by name. Gartner surveyed 275 customer service leaders in July and August 2026 and reported on 4 November 2026 that only 4% had achieved the ROI they expected from AI; the AI-forward organisations invested nearly 1.8 times more in data and knowledge foundations than in the use cases themselves.
Measures. Use three layers: value, adoption and risk. The guide to choosing AI KPIs goes deeper on picking them. McKinsey’s 2026 survey also found high performers twice as likely as others to report defined processes for measuring the impact of their AI initiatives.
The AI strategy document: full outline
The one-pager becomes the executive summary. The full document carries the evidence and the rules behind each block.
| Section | Contents | Length | Lead author |
|---|---|---|---|
| 1. Executive summary | The one-page strategy | 1 page | Chief AI officer or CIO |
| 2. Diagnosis | Market position, current AI use, readiness and maturity, the main obstacle | 2–3 pages | Strategy team |
| 3. Ambition and value pools | Target outcomes by date; each pool sized with baseline and owner | 2–3 pages | Business unit heads |
| 4. Principles | The principles and what each one rules out | 1 page | Governance lead |
| 5. Risk appetite and guardrails | Appetite by use type, prohibited uses, approval thresholds, policy links | 2 pages | Chief risk officer |
| 6. Regulatory position | Laws and standards that apply, their dates and an owner for each | 1–2 pages | Legal and compliance |
| 7. Capability bets | Data, platform, skills and process redesign, with owners and funding | 2–3 pages | CIO, CDO and CHRO |
| 8. Platform and sourcing stance | Build or buy, deployment model, model sourcing, exit options | 1–2 pages | CIO or CTO |
| 9. Operating model and governance | Decision rights, committees, approval route for new use cases | 1–2 pages | Chief AI officer |
| 10. Investment envelope | Budget by year, foundations against use cases, release rules | 1 page | CFO |
| 11. Measures and review | Scorecard, targets, review rhythm, refresh triggers | 1 page | Strategy office |
| 12. Roadmap summary | The first year’s initiatives; the detail lives in the roadmap | 1 page | Head of AI |
| Appendices | Use-case long list, readiness results, assumptions, glossary | As needed | Programme office |
For the diagnosis, a readiness assessment gives a quick baseline and the maturity model shows which level is realistic next. The use case framework helps size the value pools.
AI strategy example: one page for a fictional logistics group
Example Logistics Group is fictional: 6,500 employees, warehousing and road freight in five EU countries, thin margins and a service team that answers 1.2 million customer emails a year. All entries are illustrative.
| Block | Example Logistics Group entry |
|---|---|
| Ambition | Diagnosis: volumes are growing faster than we can hire planners and service staff, and our margins cannot fund the gap with headcount. By the end of 2028, AI drafts first replies to customer emails, checks freight documents before dispatch and supports every planner, with no customer data leaving our EU environment. |
| Value pools | Customer service (1.2 million emails a year); freight document checks (380,000 consignments); load planning (240 planners); accounts payable (410,000 invoices). Each pool owner sets a measured baseline by the end of Q1 2027. |
| Principles | A named person is accountable for every AI output a customer sees. Customer data stays in approved environments. We buy horizontal tools and build only where our process is our advantage. We tell customers which tasks use AI. |
| Guardrails and risk appetite | Zero tolerance for customer or employee data in unapproved AI tools. No automated decisions about employees. Human approval before an agent sends an external message or changes an order worth more than €10,000. Customer-facing error appetite: fewer than 1 in 1,000 sent replies corrected afterwards. |
| Capability bets | Clean shipment and customer master data by Q3 2027; AI literacy training for all office staff during 2027; redesigned email and document-check processes rather than automated old steps; an internal team of eight to build and run agents. |
| Platform stance | One governed platform for chat, agents and multi-agent work. Approved cloud models for public information, models in our own data centre for customer data. No team-level AI subscriptions after Q2 2027. |
| Operating model | Hub-and-spoke. A central AI team sets standards, runs the platform and approves new use cases; each business unit has a product owner who funds and runs its own use cases. |
| Investment envelope | €6 million over three years: 40% foundations (data, platform, security), 35% use cases, 15% people and change, 10% reserve released only at stage gates. |
| Measures | Value: handling cost per shipment and service cost per customer email. Adoption: share of office staff using approved AI tools each week. Risk: AI incidents, policy exceptions and corrected replies per 1,000. The executive committee reviews them every quarter. |
How to build the AI strategy in executive workshops
Run four working sessions of about three hours each, with preparation before the first. Each one ends with a written decision that goes straight into the one-pager.
| Session | Who attends | Inputs | Output |
|---|---|---|---|
| 0. Preparation | Strategy team and AI lead | 15 to 20 executive interviews, readiness results, an inventory of current AI use including unsanctioned tools, a long list of use cases | Draft diagnosis and a fact pack |
| 1. Diagnosis and ambition | Executive committee | The fact pack | The agreed challenge and ambition, with a target date |
| 2. Value pools and bets | Executive committee and business unit heads | Sized long list, maturity results | Three to five value pools with owners; draft capability bets |
| 3. Guardrails and platform stance | Executive committee, CISO, chief risk officer, legal, data protection officer | Regulatory map, current policies, platform options | Risk appetite by use type, prohibited uses, platform and sourcing stance |
| 4. Money, model and measures | Executive committee, CFO and CHRO | Operating model options, budget scenarios | Decision rights, investment envelope, scorecard, signed one-pager |
Three habits keep the sessions honest. Ask every block for a “we will not” line as well as a “we will” line. Keep the CFO and the chief risk officer in all four sessions, not only the ones about money and risk. Before sign-off, give the draft to two senior people who were not in the room and ask which decision they would challenge first. The CHRO belongs in the last session because, in the IBM study, 83% of surveyed CEOs said AI success depends more on people’s adoption than on technology.
How often to refresh the AI strategy
Rewrite it once a year in step with the budget cycle, and review the measures and bets every quarter. Refresh it outside that rhythm when a trigger occurs:
- A regulatory change that alters what you may do, or by when. The Digital Omnibus on AI, adopted on 8 July 2026, moved the main high-risk dates, so a strategy written before it may be planning to the wrong deadline.
- A platform or model shift large enough to change the platform stance or the cost assumptions.
- An acquisition, a divestment or entry into a new market.
- A serious AI incident or audit finding.
- Two consecutive quarters of missed value or adoption measures.
ISO/IEC 42001:2023, the AI management system standard, describes a management system that is established, implemented, maintained and continually improved. A strategy with a fixed review rhythm fits that pattern and leaves auditors a clear record of what was decided and when.
AI strategy mistakes to avoid
- Goals in place of a diagnosis. “20% more productivity by 2028” is a target. Rumelt’s warning about mistaking goals for strategy applies word for word.
- A shopping list of use cases. Forty unconnected pilots spread money thin. In its 4 November 2026 customer service release, Gartner predicted that by 2028 organisations building AI portfolios will achieve twice the business value of those pursuing standalone use cases.
- Guardrails that are only values. “We use AI responsibly” gives nobody a rule to follow. Write thresholds and approval routes.
- No platform stance. Without one, each team buys its own tools and unsanctioned AI fills the gaps.
- Funding use cases but not foundations. Later use cases only get cheaper if data, platform and skills were paid for.
- Measuring activity instead of results. A count of pilots launched hides the real question; McKinsey found only 37% of its 2026 respondents attribute any EBIT impact to AI.
- Treating it as an IT document. Adoption, process redesign and skills sit with business leaders and HR as much as with technology.
How VDF AI fits
A platform stance and a set of guardrails matter only if daily use follows them. VDF AI is one governed platform for AI agents, multi-agent orchestration through Networks, private retrieval over company documents in VDF AI Chat and governed coding in VDF Code, with role-based access control on every plan and audit logs of use. VDF AI Router routes requests between approved cloud models and registered on-premises model endpoints, and its air-gap mode uses local models only, so a rule such as “these teams use only approved models, and this deployment only local ones” can be set in the platform rather than merely written down.
Deployment is chosen separately from the product: VDF’s managed cloud, your own data centre, a private cloud or an air-gapped network. Revisiting that part of the stance later therefore need not mean replacing the tools people already use. None of this makes the strategic choices. Value pools, risk appetite, funding and the leadership behind adoption stay with the executive team.
Sources
These frameworks and surveys were checked at their publishers’ own pages on 4 November 2026.
Frequently asked questions
What should an AI strategy include?
An enterprise AI strategy should state the ambition, the value pools where AI will be applied, the principles, the guardrails and risk appetite, the capability bets, the platform stance, the operating model, the investment envelope and the measures of success. Each heading should hold a decision rather than a description. The one-page version makes the choices visible, and the full document adds the diagnosis, evidence and funding rules behind them.
What is the difference between an AI strategy, an AI roadmap and an AI implementation plan?
The strategy sets direction and limits: where AI creates value, what is off limits and how much will be invested. The roadmap orders the initiatives that follow from it, quarter by quarter, over the next 12 to 24 months. The implementation plan schedules tasks, owners and budget for one initiative or phase. Expect to change the strategy rarely, the roadmap every quarter and the plan every week.
What does a one-page AI strategy look like?
It is one table with nine rows: ambition, value pools, principles, guardrails and risk appetite, capability bets, platform stance, operating model, investment envelope and measures. The filled example on this page, for a fictional European logistics group, fits each row into a few lines that carry numbers, owners and limits. A row that cannot be written that briefly usually means the decision behind it has not been taken.
Which AI strategy framework should we use?
Pair a strategy framework for the choices with risk frameworks for the guardrails. Richard Rumelt's kernel of diagnosis, guiding policy and coherent actions keeps the document honest about the challenge it addresses. The NIST AI Risk Management Framework, ISO/IEC 42001 and the OECD AI Principles supply the vocabulary for risk tolerance, management systems and principles, and the nine blocks in this template map onto all of them.
How do you build an AI strategy with the executive team?
Prepare with executive interviews, a readiness check, an inventory of current AI use and a long list of use cases. Then run four working sessions: diagnosis and ambition, value pools and capability bets, guardrails and platform stance, and finally the operating model, investment envelope and measures. Every session ends with a written decision, and the finance and risk leaders attend all four.
How often should an AI strategy be updated?
Review the measures and bets each quarter and rewrite the strategy once a year alongside the budget. Refresh it sooner after a trigger: a regulatory change such as the EU's Digital Omnibus on AI, which moved the main high-risk deadlines, a major platform or model shift, an acquisition, a serious incident, or two quarters of missed measures.
Make the strategy's guardrails part of daily work
VDF AI applies role-based access on every plan, keeps audit logs of use and routes requests between approved cloud models and your own on-premises endpoints, so the limits you set are the limits people meet.