Research · AI Strategy & Adoption

AI Operating Models

An AI operating model defines who decides, who builds, who pays and who is accountable for AI across the organization. Getting it wrong leads either to bottlenecks or to uncontrolled sprawl.

The Hub-and-Spoke Operating Blueprint

Most organizations end up somewhere between a single central AI team and a free-for-all. The Hub-and-Spoke Operating Blueprint is a CorpExcellence framework for making that middle ground explicit. A small central hub owns what must be consistent across the enterprise. Business units, the spokes, own delivery and results. Four pillars spell out who does what, and all of them rest on one shared inventory.

Decision rights

The hub sets AI policy and defines risk tiers. It also keeps the list of approved models and providers. Spokes approve their own use cases within those limits and escalate only what falls into a higher tier. Write this down as a short table that names the approver for each tier. If every request still goes to one committee, the model has become centralized by accident.

Shared platform

This is where the hub earns its place. An AI gateway, a model catalog, evaluation tooling and connector standards serve every team. Spokes ship faster because identity, logging, cost tracking and guardrails are already in place. A shared platform also stops each unit from signing its own model contract with different data terms.

Funding

A central budget pays for the platform and for early experiments. Once a use case reaches production, the owning unit pays its run costs through chargeback or showback. Showback is a gentler start for units new to AI. Units then weigh AI spending against their other priorities, and the hub can see spend by unit and by model.

Assurance

Review depth follows the risk tier. Low-risk internal tools pass a checklist. Customer-facing systems, and those that shape decisions about people, get independent testing and a formal second-line review before launch. Agents that can take actions need added controls on permissions and clear points where a person must approve.

The base: one inventory

Every AI use case and agent gets an entry with a named business owner, risk tier, data sources and status. Without it, none of the pillars can be checked or audited. Review it each quarter alongside spend, so retired agents and orphaned use cases are removed.

Where the industry is now

Public-sector guidance points the same way. OMB memorandum M-25-21 (April 2025) requires US federal agencies to name a Chief AI Officer and keep AI use case inventories. Larger agencies must also run an AI governance board that draws on IT, cybersecurity, data, legal and privacy functions. In companies, agentic AI is the main new pressure: agents need their own identities and permission limits, which pulls those decisions into the hub. ISO/IEC 42001 offers a certifiable management system structure for the same controls.

Common pitfalls

• A hub that only reviews and never builds shared tools.
• Spokes with no technical staff, which pushes all delivery back to the hub.
• Production run costs left in a central budget, which hides true unit spend.
• Treating the design as fixed instead of revisiting it each year.