AI adoption across organization sizes and industries

Adoption figures get read as maturity figures, and they are not. 88 percent of organizations use AI in at least one business function, roughly one third say they are scaling across the enterprise, and 39 percent report earnings impact. Base your roadmap on the first number and you are planning for a stage you have not reached.

That is why the breakdown by size and industry is more useful than the average. An eighty-person manufacturer and a multinational bank with a regulator in every country hit completely different blockers, and those blockers determine which architecture is feasible. The average describes neither.

Adoption is broad, scale is narrow. The 2025 McKinsey State of AI survey (1,993 respondents across 105 countries, weighted by national GDP) finds 88 percent using AI regularly in at least one function, while roughly one third say they are scaling and 39 percent report EBIT impact. The Stanford AI Index 2025 shows the same movement from a different sample: organizational AI use went from 55 percent in 2023 to 78 percent in 2024, and generative AI in at least one function from 33 to 71 percent. Adoption accelerated, maturity did not.

The gap between pilot and production is the clearest pattern. Research from MIT NANDA, reported in the financial press on the basis of 150 interviews, 350 employees, and 300 public deployments, found that roughly 5 percent of generative AI pilots produced rapid revenue acceleration. An NBER working paper covering nearly 6,000 executives in the United States, United Kingdom, Germany, and Australia finds 69 percent actively using AI while nine in ten report no measurable employment or productivity effect over three years. Deloitte, surveying 1,854 executives across Europe and the Middle East, lands on a two to four year payback period for a typical use case, with only 6 percent inside a year.

Size shifts the bottleneck rather than removing it. A 2025 OECD discussion paper for the G7 establishes that SME adoption trails large firms and trails earlier digital technology, with connectivity, access to data and compute, skills, and financing as the determining conditions. In the McKinsey figures, close to half of firms above five billion dollars in revenue say they are scaling, against 29 percent below one hundred million. Large organizations have the budget and the platform team, and get legacy systems, silos, and attribution problems in return.

Industries do not move in step. Deloitte studied 87 banks and 49 insurers across Europe and the Middle East and found roughly two thirds using AI or machine learning, mostly for fraud detection and customer experience, with explainability, regulation, security, fairness, and internal skills as the brakes. In manufacturing, a vendor survey of 369 firms reports more than 77 percent with some form of AI, with lack of expertise and system integration as the leading blockers. In government, the OECD Digital Government Outlook 2026 notes that strategy is further along than data governance, procurement, and trust frameworks. In the technology sector the evidence is internally contradictory: vendor research from GitHub and Accenture reports substantial productivity gains with Copilot, while a longitudinal case study at a Norwegian public agency found no significant difference in commit activity between users and non-users.

Agents are still in the experimentation stage. McKinsey finds 62 percent experimenting with agents, 23 percent scaling one somewhere, and no business function where agents exceed 10 percent. What separates organizations that get results is not model choice: high performers are close to three times as likely to be redesigning workflows and more often have an executive who actively owns adoption.

The architecture beneath these figures is the same stack in every segment, only the depth differs: a cloud foundation, a governed data platform, a retrieval layer, a model and agent platform, a gateway that enforces traffic, cost, and policy, observability and evaluation, identity and security, and cost control.

Microsoft Foundry makes that split explicit. A Foundry resource is the governance boundary with its own networking, identity, and policy settings, projects provide isolation during development, and connected Azure services supply storage, search, and secrets. For production RAG, Azure AI Search names the bottlenecks that matter in practice: query understanding, access to multiple sources, token limits, response time, security, and governance. Those are precisely the parts a pilot skips and scaling makes mandatory.

• Small business: buy before you build. AI already embedded in existing SaaS lowers the build burden, and the OECD names skills and financing as hard preconditions. Pick a narrow, measurable workflow instead of a platform program.
• Mid-market: the bottleneck is rarely the model but fragmented data and the absence of a platform team. Invest in reusable architecture and a shared data platform before starting the second project.
• Large enterprise: the bottleneck moves to legacy systems, silos, and attributing return. Redesign the workflow before rolling out the tooling, because a copilot on top of a broken process only accelerates the broken process.
• Multinational enterprise: a federated model with central guardrails. Data residency, multiple regulators, and identity boundaries drive the design more than model choice does.
• In every segment: build the evaluation layer before you scale. Without an evaluation set, telemetry, and production monitoring, scaling is guessing with a larger budget.

Regulation here is not a brake on scaling but a precondition for it. The NIST Generative AI Profile is a voluntary companion to AI RMF 1.0 that helps identify and manage risks across design, development, use, and evaluation, and it works well as a checklist before a pilot enters production.

The EU AI Act arrives in phases. The regulation entered into force on 1 August 2024, AI literacy and prohibited practices apply from 2 February 2025, rules for general-purpose AI models from 2 August 2025, most transparency and enforcement obligations from 2 August 2026, high-risk systems under Annex III from 2 December 2027, and those under Annex I from 2 August 2028. Anyone building now is building into those dates.

In regulated industries, explainability is the brake, not compute. Deloitte finds explainability, regulation, security, and fairness as the leading obstacles for banks and insurers, well ahead of technology. Governance therefore has to produce operational evidence rather than a policy document: an inventory of AI systems, risk classification, data controls, audit logs, evaluation results, monitoring, and an incident process. Microsoft Purview supplies that layer for the Microsoft stack, with discovery and protection of sensitive data inside AI interactions.

Expect two to four years to satisfactory return on a typical use case, with roughly 6 percent paying back inside a year. That is slower than most business cases assume, and the distance between that assumption and reality is a common reason programs get cancelled early.

The most useful measure is cost per successful outcome, not cost per token or per licence. That measure penalizes a cheap model that often has to retry and rewards a more expensive model that gets it right first time, whereas cost per token signals exactly the opposite. Include retrieval cost, evaluation cost, and human review, because otherwise they disappear from the business case.

Return is also hard to isolate. AI projects almost always coincide with data quality work, process redesign, and reorganization, which makes attribution a structural problem in large organizations rather than a measurement error. So decide up front which metric should move and what the baseline is.

The evidence implies a sequence that nearly every organization walks through: awareness, individual experimentation, controlled experimentation with success criteria, departmental adoption, AI in production, shared platforms, and finally an operating model where AI sits inside the process rather than beside it.

What blocks each transition differs per step, and that is the useful part. At experimentation, success criteria and telemetry are missing, so nobody can say whether it worked. At production, evaluation, cost control, and a clear operational owner are missing. At the operating model stage, executive ownership is missing, and that is where most organizations stall.

So do not measure active users, measure depth of use inside the workflow. Active users measure curiosity; the share of a process that actually runs through the new route measures adoption.

• Buy versus build: AI embedded in existing SaaS goes live quickly but adapts only shallowly, custom build fits the process but requires a platform team.
• Speed versus governance up front: momentum against durability, and in regulated industries the regulator partly decides that trade-off for you.
• Central control versus federation: a central platform team protects quality but becomes the bottleneck, federation scales but lets guardrails drift apart.
• Broad copilot rollout versus a targeted workflow: broad rollout shows usage quickly and value slowly, targeted work shows results later but harder.
• Fast model versus strong model: cheap per call can be more expensive per successful outcome once retries and review are counted.

• Reading adoption figures as maturity figures and basing the roadmap on the 88 percent rather than on your own stage.
• Buying licences before data, permissions, and process are ready, so the rollout stalls on authorization.
• Building a generic chatbot that sits outside the workflow where the work actually happens.
• Piloting on cleaned test data, so real data quality only surfaces at go-live.
• Underestimating integration and skipping evaluation, then scaling without knowing whether quality holds.
• Reporting success in active users instead of outcome per process.