Are Organizations Really Leveraging the Potential of AI?

Key Takeaways

• Broad Use but Limited Scale: Most organizations use AI in at least one function, but only 7 percent have fully deployed and integrated it across the enterprise.
• Early-Stage Adoption: Nearly two-thirds of companies remain in the experimentation or piloting phase, with many still on their first use case.
• Major Functional Gaps: Core functions like risk, sales, and marketing show minimal AI adoption, with large majorities not even experimenting.
• Risk in Both Action and Inaction: Moving too slow, too fast, or without addressing AI-driven process and control changes poses significant risks.
• Practitioners Must Engage: Risk, audit, and compliance professionals need to be proactive in understanding how AI is being used and how it will reshape processes and competitive positioning.

Deep Dive

In a recent article, Norman Marks asks a pointed question that’s becoming increasingly urgent across boardrooms, risk teams, and C-suites alike—are organizations truly leveraging the potential of AI, or are they still circling the runway while competitors take off? Drawing on new insights from Google AI and McKinsey’s latest 2025 survey, Marks explores whether companies are moving fast enough, cautiously enough, or strategically enough to turn AI from hype into real enterprise value, and what it means for practitioners who risk being left behind.

Examining the Growing Gap Between AI Ambition and Real-World Adoption

There’s a lot of hype about the potential of AI to drive efficiency. There’s also a lot of fear that it will lead to thousands of people losing their jobs. But what is the reality as we approach the end of 2025? It’s only over the last few years that we have seen AI become a real opportunity for organizations around the world. Google AI tells us:

"The true “agentic revolution” in a modern context is considered to have started in the early 2020s, particularly around late January 2025, when major tech companies like OpenAI and Google began integrating advanced, autonomous capabilities into their products.

Key drivers and milestones in the modern era include:

• Advancements in Machine Learning: The 2000s and 2010s saw major breakthroughs in neural networks and reinforcement learning, allowing AI to learn from data and adapt more effectively.
• Generative AI and LLMs: The emergence of powerful generative AI models and LLMs in the early 2020s (e.g., ChatGPT in late 2022) provided the advanced reasoning and natural language capabilities necessary for more sophisticated, autonomous agents.
• Commercial Adoption: In 2025, agentic AI became a top technology trend, with numerous enterprises launching platforms and integrating AI agents into their workflows. Products like OpenAI Operator showcased the shift from AI as a co-pilot (assistant) to a pilot (actor).

Today, agentic AI systems are being actively deployed in areas such as customer service, autonomous vehicles, cybersecurity, and financial trading, with a focus on executing complex, multi-step workflows with minimal human intervention."

McKinsey’s 2025 Findings on AI Use

I want to point you to a very interesting report from McKinsey: The state of AI in 2025: Agents, innovation, and transformation. It is based on a survey in June/July of this year. It got almost 2,000 responses from people in 105 nations. 38% work in companies with more than $1 billion in annual revenue. While I have read that 80% or more are starting to use AI, McKinsey dives deeper. It starts with:

Almost all survey respondents say their organizations are using AI, and many have begun to use AI agents. But most are still in the early stages of scaling AI and capturing enterprise-level value.

Their key findings are:

• Most Organizations are Still in the Experimentation or Piloting Phase: Nearly two-thirds of respondents say their organizations have not yet begun scaling AI across the enterprise.
• High Curiosity in AI Agents: Sixty-two percent of survey respondents say their organizations are at least experimenting with AI agents.
• Positive Leading Indicators on Impact of AI: Respondents report use-case-level cost and revenue benefits, and 64 percent say that AI is enabling their innovation. However, just 39 percent report EBIT impact at the enterprise level.
• High Performers Use AI to Drive Growth, Innovation, and Cost: Eighty percent of respondents say their companies set efficiency as an objective of their AI initiatives, but the companies seeing the most value from AI often set growth or innovation as additional objectives.
• Redesigning Workflows is a Key Success Factor: Half of those AI high performers intend to use AI to transform their businesses, and most are redesigning workflows.
• Differing Perspectives on Employment Impact: Respondents vary in their expectations of AI’s impact on the overall workforce size of their organizations in the coming year: 32 percent expect decreases, 43 percent no change, and 13 percent increases.

Adoption Still Lagging

It’s when you get into the details that the surprisingly slow level of adoption becomes clear. Even though 88% say they are regularly using AI in at least one business function, very few are using it broadly across the enterprise:

• 7% say “AI has been fully deployed and integrated across the organization”.
• 31% are “growing the deployment/adoption of AI across the organization”.
• 30% are “implementing AI for a first use case in the business”.
• 32% are experimenting with AI.

Is that too slow? Maybe? Each of us should look at our own organization and ask whether it is moving too slow, too fast, or just right.

How Functions Compare

McKinsey has a startling graphic on where major functions in the organization are on the AI journey. For example:

• The IT function is one of the most advanced with AI, but that doesn’t mean much at all! 77% are not even experimenting with AI, and very few of those (only 4%) plan to start in the next year.
• Sales and Marketing are in a similar position. 76% are doing nothing, with 5% planning on something in 2026.
• The risk function hardly registers on the AI scale. 90% are on the sidelines with a pathetic 3% thinking they might join the game next year.

McKinsey shares a breakdown of function by industry sector, which may be of interest. The Technology and Insurance sectors have functions with the most AI deployment (at least in the scaling phase) but even there no function is at more than 24%.

What This Means for Practitioners

So what should that mean for practitioners?

• There is a risk if organizations move too slowly to embrace new technology.
• There is a risk if they move too fast.
• There is a risk if they don’t understand and address the risks created in adopting the new technology.
• There’s also a risk if they fail to seize the opportunities.
• There is a risk that they will break processes as they re-engineer them as part of AI adoption. Critical controls might be removed or become ineffective.
• That is in addition to the opportunity that may be lost or at least significantly delayed if practitioners are not leveraging AI and other technologies effectively.

The Call to Action:

• We need to be at the table.
• We need to be asking about how AI is or will be used….and if not, why not?
• We need to ask how business processes will be changed and the effect on risks and controls.
• We need to ask whether they know what their competitors are doing. Will they be left behind?
• Are we doing that?
• Are we being proactive or passive?

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.