AI isn't the next cloud. Don't let it outgrow IT

Every major technology I've worked with in 25 years of digital transformation has followed the same pattern.

It starts as a technology challenge or opportunity. IT evaluates it, secures it and runs the pilots. Then it becomes strategic. The questions shift from "which platform?" to "how do we compete?", and ownership spreads into marketing, operations and the executive team.

The web did it. Mobile did it. Cloud and analytics did it.

For the most part, that was fine. Once a website or CRM was built and secured, the business could run it day to day without putting the organisation at risk.

AI will try to follow the same path. Datacom's 2025 State of AI Index found 87% of New Zealand organisations use AI in some form, yet only 12% have deployed it across the whole business. For now, most AI sits with IT, partly because the risks are real and much of the public commentary is negative. Few executives want to own something still linked in the headlines to data leaks and job losses.

That will change. Once AI looks safe, proven and fashionable, every function will want a piece of it.

AI's use should spread across the business. Its foundations must not outgrow IT.

Here's why AI is different.

Why AI isn't the next cloud

It acts, not just informs. A website publishes. A CRM records. An AI agent with credentials can retrieve records, update systems, contact customers and instruct other agents. Deloitte's 2026 enterprise research found 69% of Australian organisations surveyed were using autonomous AI agents, but only 22% reported highly advanced agent governance.

It sees everything you've given it access to. Tools like Microsoft Copilot surface whatever a user can technically reach. Years of loose permissions and overshared folders become visible overnight. That is an identity and data problem, and it sits squarely with IT.

It's already inside the tools you've bought. Cloud arrived as a decision. AI arrives as a feature update. CRM, HR, finance and collaboration platforms are switching on AI capabilities whether or not anyone asked. No single department can see all of it.

It doesn't stay the same. Traditional systems behave predictably once configured. AI models change, outputs vary and performance can drift. AI needs continuous testing and monitoring, not a one-off implementation.

It changes the work, not just the tools. A new CRM changed how people logged a sale. AI changes which roles exist, which skills matter and how people feel about their jobs. Randstad found 32% of Australian workers fear AI could cost them their job.

Each of these is a reason AI can't be handed over the way a website or a marketing platform was.

Anyone can build with AI now. That's the risk.

AI is also becoming less technical. Staff can now describe an app, an automation or an agent in plain English and have it built in minutes. Low-code agent builders are appearing across the major platforms, and a capable marketer or finance analyst can create something that looks production-ready by lunchtime.

That's a real opportunity. It's also exactly where the risk lies.

I saw this during the dot-com boom. Marketing teams produced plenty of good initiatives, but they moved faster than their understanding of the technology. Websites were hacked because nobody owned patching or security. Thousands of domain names were registered to individual staff rather than the business, and walked out the door when those people left. E-commerce stores were half-built by marketing teams who didn't understand where the technology was at, then quietly abandoned or handed to IT to rescue.

AI-built apps and agents can repeat that pattern, with higher stakes. An app built through prompts may store customer data in the wrong place, connect to systems using someone's personal credentials or expose information publicly, and its creator may never know. And unlike a half-built website, an agent can act on its own.

When building becomes non-technical, governance becomes critical. The answer isn't to stop people building. It's to give them a safe place to do it: approved platforms, data rules built in, every app and agent registered to the organisation rather than an individual, a named business owner for each, and IT review before anything touches customers or core systems.

What happens when AI outgrows IT

If AI ownership fragments the way earlier technologies did, the consequences are larger.

• Ownership splinters. Departments buy overlapping tools and set conflicting rules.
• Controls fall behind use. Microsoft's 2024 Work Trend Index found 75% of knowledge workers already use AI at work, and 78% of them bring their own tools. IBM's 2025 Cost of a Data Breach report found 97% of organisations that suffered an AI-related breach lacked proper AI access controls, and 63% of breached organisations had no AI governance policy or were still developing one.
• Adoption stalls on people, not technology. Licences are bought, but habits don't change.
• IT becomes a utility. It keeps the platforms running while decisions about AI's direction are made elsewhere, then inherits the clean-up.

Shadow IT cost money. Shadow AI can cost data, customers and trust.

In my experience, this is the pattern that matters most. As a technology becomes strategic, IT's role quietly shifts from shaping it to being called in when something goes wrong: the breach, the outage, the failed integration, the system nobody can support. By then, the decisions that caused the problem were made months earlier, without IT in the room.

With AI, IT has to be preventative, not reactive. A reactive IT team spends its time cleaning up. A proactive one designs the guardrails, platforms and partnerships that stop the problems happening, and earns its seat at the table because of it. The window to set that up is now, while AI is still seen as a technology issue.

How IT stays central as AI grows

Staying central doesn't mean holding on more tightly. Business units should lead their own use cases. It means getting ahead of the problems: building the foundations everyone else depends on, and making IT the partner the business wants to work with. In my experience, seven moves make the difference.

1. Set the guardrails before demand peaks. Data access, identity and permissions for AI agents, approved tools and privacy obligations are far easier to set now than to retrofit across a dozen departments later. New Zealand's Privacy Commissioner has confirmed the Privacy Act 2020 applies to AI tools, and Australia's OAIC advises organisations not to enter personal information into publicly available AI tools. Clean up permissions before rolling out Copilot-style tools. Every agent should have a named human owner, defined permissions and clear points where it must stop and escalate. Strong AI governance set early becomes the standard everyone works within later.

2. Make the approved path the easy path. If approved tools are slower or harder than free alternatives, shadow AI wins. Provide secure tools people actually like using, plain-English guidance on what can go into them, and a fast route for business-led pilots: a short assessment, a sandbox with safe data and clear criteria for moving to production. When the route through IT is quick, good ideas come to IT first rather than going around it.

3. Convene the strategic conversation. Set up a cross-functional AI group with the business, HR, risk, legal and finance, and have IT run it. It prevents duplicated spend and conflicting rules, and the team that convenes the forum usually shapes the agenda.

4. Lead the change with HR. This is where most technology rollouts fall short, and where AI will be decided. Randstad found only 48% of Australian workers say they've been trained on the AI tools reshaping their jobs, while employers believe 56% have been. That gap is where adoption stalls and anxiety grows.

Co-design the adoption plan with HR from day one. IT owns the platform, security and guardrails. HR owns capability, role change and communication. Together, they own the change. Prosci's ADKAR model is a useful frame: people need awareness of why AI is coming, the desire to take part, the knowledge to use it, the ability to apply it to their real work, and reinforcement so the habits stick. In practice, that means AI champions in each team, managers who can talk honestly about how roles will change, and measuring behaviour change rather than licence counts.

Few organisations are doing this yet. Gartner found only 4% of CIOs surveyed had explicit plans to redesign roles for a human-agent workforce, and those that did were 2.4 times more likely to be in its higher-performing AI group. Structured AI change management turns licences into everyday habits, and gives IT a trusted ally when the harder conversations about roles arrive.

5. Build learning and resistance into the plan. Most AI programmes budget for licences and treat training as a launch-day session. That isn't enough. AI skills build over months, through role-based learning on real tasks, refreshed as the tools change. Bring Learning and Development in from the start to design that pathway, rather than handing them a finished rollout to support.

Resistance needs planning too. Some people will worry about their jobs, some will doubt the tools and some will quietly keep working the old way. That resistance is information, not obstruction. Name it early, give managers the words to discuss it honestly, and involve sceptics in testing so their concerns shape the rollout. Ignored resistance doesn't disappear. It goes underground, often into unapproved tools.

6. Measure value in business terms. Boards are moving from asking about AI risk to asking about AI return. Track adoption, time saved, quality and risks avoided, and report them in business language alongside finance. Tie every use case to an AI strategy and roadmap so AI investment builds towards business goals rather than scattering across disconnected experiments. The team holding credible performance data becomes the one asked where to invest next.

7. Build capability inside IT, then lend it out. Invest in your own team's AI skills and offer them to the business as a service: solution architects, workflow specialists and agent builders. Practical Copilot training for your service desk and power users builds credibility quickly. When a department wants to move on AI, IT should be the obvious first call.

Know when the shift is coming

Watch for the signals that AI is becoming strategic: business units asking for AI budgets of their own, AI moving into core processes and customer channels, and board conversations turning from risk to opportunity. When they appear, IT's role should shift from running pilots to orchestrating at scale, with delivery spread across the business and IT holding the platform, standards and expertise together.

AI's use will outgrow any single department. That's success. Its foundations can't.

The IT leaders who stay central to AI won't be the ones who held it most tightly or fixed the most problems. They'll be the ones who got ahead of it, and who the rest of the organisation can't imagine doing AI without.