What an Executive AI Mandate Should Say in a Regulated Company

A guide from Meresa reports that 91 per cent of mid-market firms now use generative AI, while only 25 per cent say it is fully integrated into core operations. That second number deserves more attention than the first. Using a tool to draft emails or summarize documents requires almost nobody's permission. Putting AI into a core process at a medical device manufacturer or a lender requires permission from several people, and each of them has good reasons to say no.

The AI Strategy Blueprint argues that C-level sponsorship decides whether AI adoption succeeds. It names what projects lose without it: budget approval, organizational priority and a cross-departmental mandate. I agree with that diagnosis. My concern is with sponsorship that consists of a kickoff announcement saying AI is a priority. In a regulated company, that kind of sponsorship runs out the first time a project needs a controlled document changed.

Why core processes resist new tools

A core process in a regulated company comes with obligations attached. It has a written procedure and staff trained against that procedure. Its records may fall under rules like FDA's 21 CFR Part 11 for electronic records and signatures. A change control process decides when any of it can be modified. Moving AI into that process means quality has to approve revised procedures, IT has to support the integration, compliance has to accept how decisions will be recorded, and the operating department has to retrain people. Each of those functions answers to a different leader and has its own backlog.

This offers one plausible reading of the 25 per cent figure. A team can show that an AI tool works on real data and still wait months, because no single function is responsible for getting it through the others. The work crosses departments, and nobody below the executive level has the authority to decide the order in which those departments act on it.

Core workflows almost always cross those lines. When Laminar replaced Ventura Foods' legacy RPG mainframe and manual approvals for new product development, the web workflow application had to serve facilities in the U.S., the EU and Mexico. It also had to include logic for choosing the manufacturing site. A process with that reach belongs to several groups at once. Adding AI to a process like that adds approvals to the path.

What the mandate should put in writing

I think the executive mandate for an AI workflow should be a short written document with the same standing as a project charter. The sponsor should sign it and circulate it to every function it touches. It should cover at least the following:

I consider decision rights the most important item. Cross-functional work tends to stall on questions nobody is authorized to answer. One example is whether a reviewer can approve AI-assisted output without re-checking every field. When the mandate says who answers that question and by what date, a department head has something concrete to plan around.

Where familiar change frameworks fall short

The source material also argues that established frameworks such as Kotter's 8-Step model, Prosci's ADKAR and McKinsey's 7S were not built for AI's impact on organizations. One reason matters for regulated work. Those frameworks describe change as a move from one stable state to another. An AI workflow keeps changing after launch, as the vendor updates the model and the data feeding it shifts. Each of those changes may need to go through change control again, so the mandate has to treat ongoing change as a standing responsibility.

The same reasoning applies to the AI center of excellence that the source recommends. In a mid-market company, that group may be three or four people who also have other jobs. A center of excellence without a written mandate can advise, but it cannot put a procedure revision on quality's calendar or move an integration up IT's queue. The mandate gives the group standing with the functions it depends on.

Next steps

If you sponsor or support an AI initiative, start with the workflow closest to production. List every controlled document, record and training requirement it touches. Identify the owner of each item, and ask whether that person has been told in writing that the work is a priority with a deadline. Then draft the mandate using the five elements above and have the sponsor sign it. Schedule the first post-launch review before the system goes live, so the review date is already on the calendar when the first model update arrives.