Discover how CIOs can scale generative AI

First, CIOs must evaluate the current context of their GenAI transformation across two dimensions to derive the qualities and skillsets needed:

• Scale of transformation – Is this a complete, enterprise-wide transformation? Or is it focused on specific functions, capabilities or use cases within the organization?
• Level of project involvement – Will the CIO be actively involved in individual project development and execution? Or will the focus be on creating a GenAI platform to help other parts of the organization succeed?

Answering these questions will help determine what GenAI leadership archetype makes sense for your organization. The Planner represents a common starting point for CIOs early in the GenAI journey, focused on observing AI market trends (of which GenAI is one of the latest) and waiting for out-of-the-box solutions to mature. But CIOs can no longer afford to be passive — more ambitious organizations and leaders need another archetype.

Regardless of the specific role, CIOs have the unique opportunity to help the organization determine where to go wide and deep. With the CIOs often representing the most technical role within the C-suite, they can help determine what the spectrum of opportunities are (going wide) and what potential cases represent the best investments to find success (going deep).

The Co-Strategist:

The Co-Strategist CIO partners with business leaders on focused use cases to show proofs-of-concept and starts to develop institutional muscle to complete these projects. Employing this model allows the CIO to be intimately involved in select projects to help give white-glove service (such as by supporting request-for-proposal development and vendor selection and sitting on project steering committees). Many organizations would benefit from a Co-Strategist, particularly those that are stable and mature but are also looking to make a few targeted, substantial investments.

The Co-Strategist can often be a CIO who is relatively new to the industry or organization, representing a great opportunity to build relationships. CIOs at a recent EY event also shared that being a Co-Strategist helps from a resourcing perspective, as supporting existing business priorities can help secure investment. CIOs can also position themselves to develop or expand foundational elements for GenAI, including data platforms, governance structures and master data management.

The Orchestrator:

The Orchestrator relies upon leaders from the business and enterprise functions to individually develop and execute projects, freeing up CIOs to act as a force multiplier across the organization. They determine how to spend time and resources with a focus on accelerating GenAI over the entire enterprise, such as by building partnerships with vendors, developing new channels for data acquisition (both internal and external), and creating GenAI training materials.

The Orchestrator is suited for organizations that are relatively mature in digital and existing AI capabilities, with more apt processes. But at legacy companies, parts of the business will lack direction, confidence and/or urgency to help execute on the Orchestrator’s vision, resulting in a nightmare scenario where heavy investment yields no tangible outcomes.

The Innovator:

The Innovator spends much of their time co-leading and quickly driving GenAI projects and less on traditional IT projects (such as infrastructure and support). The Innovator should be experienced within their industry (to help understand where GenAI can create value chain impact and navigate industry-specific complexities) and well connected with their C-suite peers and business unit leaders (to help navigate internal processes). Therefore, strong IT organizations are needed keep the ship moving. 

In addition to requiring a strong IT organization, Innovators are typically leveraged in two circumstances: when the organization is under immense pressure to reinvent itself quickly or when financial health is very strong, allowing for intense forward-looking investments.

While many organizations and CIOs may look for the Innovator, they need leadership buy-in and a sufficient underlying data foundation. Trying to build this foundation while being involved in multiple projects (in addition to all other CIO responsibilities) is not feasible. Without these cultural and technical requirements, an Innovator’s ambitious agenda is likely to be derailed or slowed.

Early on, CIOs should define what their organizations intend to achieve through GenAI to help prioritize use cases for early experimentation and inform the different bodies of governance, operations and delivery required for AI and GenAI capabilities. However, in the race to stand GenAI up as soon as possible, CIOs may be forced to circumvent this more strategic thinking and feel tempted to rely on existing governance structures — or abandon strong hygiene altogether. 

A strong internal governance mechanism is particularly important given the nascency of GenAI adoption and the lack of systemic regulation. However, “strong” does not have to mean overly mature. Given skepticism in the market, heavily investing in tools and time to develop elaborate governance policies before proving value capture can be a mistake. CIOs must collaborate with other leaders and implement mechanisms to ensure data quality and bias control, transparency, privacy and accountability without making the GenAI journey slower and more expensive — raising the issue of which operating model for AI and GenAI is best suited for the task.

Three common structures exist:

• Centralized, in which greater control helps align strategy across the enterprise and drives data standardization. For organizations with high AI demands, a centralized model can leverage synergies and optimize resources. Early-stage AI initiatives, including GenAI at most organizations, often benefit from centralization to establish a solid foundation.
• Federated, which mitigates data privacy issues through use of distributed data sets with centralized process controls. Mature programs might prefer federated models to adhere to regulations.
• Decentralized, which empowers more of the enterprise to use AI with autonomy, fostering innovation and allowing development to be informed by the people who use the technology. While a totally decentralized model will introduce significant risk and lack of control, allowing some degree of decentralization can increase creativity, speed to deployment and adoption rate in some cases.

The latter two sometimes are complemented with a center of excellence (CoE) that provides some of the benefits common under a centralized approach: greater expertise, dedicated support and executive decision-making. In our survey, among the CIOs who were further along their journey and earned the highest returns on their GenAI investments, we found 42% leveraged a hybrid decentralized operating model with a CoE.

This model can be the key to unlocking success. One attendee at the EY CIO Catalyst Capstone event said that although the CEO and C-suite are responsible for defining a GenAI vision, identifying use cases and executing on them to unlock these ambitions have fallen largely further down the organization. Equipping these teams with tools and structures to execute allowed for improved velocity.

AI governance model selected by respondents

While common, decentralized models do have their faults. They can become constrained by a lack of standardization in policies, standards and data management practices that could lead to duplicative efforts and strategies developed in silos. But these issues can be effectively overcome by managing capabilities centralized through a CoE, which provides uniform and consistent strategy and governance across the enterprise, ensuring that certain policies and procedures, especially those related to data treatment, are standardized.

Meanwhile, operation and delivery teams can remain decentralized, allowing development to be informed by customers and team members who use the GenAI functionality, and enabling ground teams to optimize delivery based on their specific needs and insights. This hybrid approach leverages the strengths of decentralization while mitigating its weaknesses.

Based on the 2024 EY CIO Sentiment Survey, CIOs see less value in building GenAI capabilities in-house, with 86% of the 500 participating CIOs primarily leaning toward acquiring or partnering with GenAI platforms/vendors. As major internal obstacles, CIOs cite the availability of GenAI talent, nascent institutional understanding of GenAI and the risks inherent in developing in-house technology, but they do see the value of building select foundational capabilities to enable external solutions.

Skill sets sought by respondents

Based on our CIO Sentiment Survey, leaders of GenAI transformations have enhanced their in-house capabilities in the following areas relative to their peers: 

• 70% more likely to have implemented initiatives to improve the data foundation and enhance data quality, which are crucial for adopting GenAI at scale
• 60% more likely to seek skills in machine learning (ML), which is the third most sought-after skill set among leaders for GenAI
• 10% to 20% more likely to seek cloud/edge computing skills before embarking on their GenAI journeys to enable scalability and flexibility

While CIOs are making strategic investments to build their internal foundational capabilities, they are also hesitant and uncertain about how to successfully implement GenAI solutions. “There is a massive “knowing/doing” gap with GenAI,” one participant of the CIO Catalyst Capstone noted. A majority of executives say they are in favor of acquiring or partnering with GenAI-based software platforms/businesses as part of their investment strategies to enable more radical, structural change while trying to avoid a mindset that favors only incremental improvements within their existing operating model.

Acquiring or partnering also allows organizations to focus on their core competencies, allowing them to achieve their business goals faster and mitigate development risks and resource constraints. Based on our survey, CIOs say GenAI skills are not in demand during recruiting, indicating that they are relying more on ready-to-use platforms from external providers that have made the investments into research and development.

The commercialization of GenAI products and services continues to introduce and expand the threat and risk landscape. AI presents many transformative opportunities, along with numerous adverse impacts to organizational virtual infrastructure, sensitive data, processes, regulatory adherence and more.

Respondents' top concern in adopting GenAI

Cyber and information security threat landscape

Emerging technologies, specifically GenAI, continue to shift the cyber and information security risk landscape by amplifying traditional attack vectors while introducing sophisticated methods of exploitation. As noted in the survey, 32% of CIOs noted concerns regarding cybersecurity (e.g., data poisoning, malware embedding) and information security (e.g., data exfiltration, data manipulation).

During the development and training of GenAI models, malicious actors may exploit various risks that impact data confidentiality, integrity, availability, authenticity and non-repudiation. Adversaries may execute various threat vectors, such as but not limited to:

Data and infrastructure platform readiness

In the CIO Sentiment Survey, 37% of CIOs selected data and infrastructure platform readiness as their top concern. Organizations that lack maturity within their platforms must spend more on top of the cost of implementing GenAI technologies. “Catching up” to the required standard also complicates how highly sought talent is recruited.

Organizations with underdeveloped data inventories and infrastructure platforms face increased expenditures related to AI implementation, encompassing data lifecycle management, tooling and talent acquisition. These initial costs can impede an organization’s AI journey, requiring leadership to reassess strategic initiatives and evaluate cost-to-benefit scenarios.

Compliance to regulatory requirements

Digital transformations continue to rapidly evolve all aspects of business, increasing the volume and complexity of compliance and regulatory requirements. Organizations are expected to face difficulties in meeting emerging AI regulatory requirements due to regulatory intensities and scope complexities. As noted in the survey, 21% of CIOs anticipate challenges in adhering to AI regulations, which increases organizational ethical and legal risks. The impacts of future AI regulations may include material financial penalties, operational disruptions, reputational damage and market access restrictions.

As the global AI regulatory and legislative landscape continues to rapidly advance, CIOs must carefully balance innovative measures with regulatory risks. Compliance with current and forthcoming regulations and legislation varies based on geographic locations, classifications of prohibited/general-purpose AI systems, and data sovereignty laws. For example, the EU AI Act is the first major regulatory framework that classifies AI practices and systems according to risk levels, with compliance requirements as early as February 2, 2025. While the US has yet to enact federal AI regulations and legislation, state jurisdictions such as California and Colorado are at the forefront of AI policymaking. Considering that policies continue to emerge, organizations based or operating within the US must ensure compliance with relevant jurisdictions through strategic planning and effective AI risk management processes.

As organizations begin to implement GenAI in ways that deliver value, they should constantly be assessing whether these may be on the horizon and establish effective governance to proactively meet regulatory concerns.

GenAI offers leaders the opportunity to not only enhance but fundamentally transform their business models and unlock unprecedented value. Our survey reveals that 47% to 69% of respondents have experienced or anticipate a return of 2x or more on their GenAI investments. But measuring the ROI for GenAI is a complex endeavor, compounded by the need to quantify intangible assets and forecast long-term benefits — especially in a decentralized model.

Maximizing enterprise ROI

Our survey indicates that leaders are 20% to 30% more likely to invest in GenAI to drive revenue or differentiate their strategy on core business, underscoring the technology’s role in carving out competitive advantages and fostering long-term growth. But CIOs should not ignore GenAI’s ability to be a catalyst for reducing costs, streamlining operations and automating routine tasks. These more immediate savings are not merely endpoints but the seed capital for reinvestment into the business — a dynamic model that can increase overall ROI. And as organizations scale their GenAI initiatives, the initial investments in infrastructure and training can yield exponential returns.

Measuring functional transformation value

The true impact of GenAI lies tangibly transforming business functions and realizing strategic value. For these initiatives, ROI should be considered at every stage of a GenAI product’s lifecycle: setting clear benchmarks before development, maintaining rigorous oversight during execution and employing robust metrics to ensure that real, functional improvements are delivered that align with business priorities.

Scott Galloway, Anandaraj Krishnan, Andy Youn, Michael Rath, Ashley Maybury, Peter Johnson and David Haddad also contributed to this article.