The 2027 enterprise AI readiness checklist: eight priorities, ranked

Most 2027 plans begin with a list of technologies. This one begins with a list of failure points.

Our 2026 recap set out the evidence. Individual productivity gains are close to universal, only a minority of organisations can show a financial return, and plans for autonomous agents are running well ahead of the governance meant to contain them. The question for 2027 is what to do about that gap.

What follows is a checklist you can score in an afternoon. The ranking is our judgement of where unready organisations stand to lose the most, so earlier priorities come first. One exception applies: the regulatory dates in priority 3 may force you to move faster than the rank suggests.

How to score

For each priority, count the "ready if" checks you can evidence, not just assert. Give yourself 0 if none, 1 if one or two, and 2 if all three. The maximum is 16.

• 0 to 6: exposed. Fix priorities 1 to 3 before expanding any agent work.
• 7 to 11: building. You have foundations. Work on your two lowest scores.
• 12 to 16: ready. Re-score each quarter, because the ground is moving.

1. Redesign work and measure value

Why it matters. In McKinsey's 2026 survey, 80% of respondents said AI had improved their own productivity, yet only 37% attributed any EBIT impact to it, essentially unchanged from 2025. Around 6% qualify as high performers. J.P. Morgan's asset management team, drawing on McKinsey's earlier work, notes that only about one firm in five has fundamentally redesigned even a single workflow, and that those which did were roughly three times as likely to see bottom-line impact.

Ready if

• Reporting separates individual productivity from P&L impact.
• At least one workflow has been redesigned end to end, with a baseline and a named business owner.
• Every initiative has a value hypothesis that finance has signed off.

Red flag. The headline metric is licences deployed or hours saved.

Owner and first 90 days. CIO with the CFO. Pick two workflows, baseline them, and report both measures monthly.

2. Governance and agent authority

Why it matters. Deloitte's 2026 enterprise survey found 74% of respondents expect to use agentic AI at least moderately within two years, while only 21% report a mature governance model for agents. Gartner's September survey of 297 security leaders found that 54% of organisations either have no defined approach to limiting what agents can access or rely on access designed for humans. Gartner also predicts that more than 40% of agentic projects will be cancelled by the end of 2027, citing cost, unclear value and weak risk controls.

Ready if

• Each agent has a written scope of what it may do without human sign-off.
• Agent actions are logged and attributable to a distinct agent identity.
• A named person can stop any agent, and the stop has been tested.

Red flag. Agents share service accounts or human credentials.

Owner and first 90 days. CRO with the CISO. Inventory every agent, assign an authority level to each, and run a stop drill. In our CLEAR framework, this is the accountability test.

3. Data sovereignty and residency

Why it matters. Three sets of dates arrive close together.

In the EU, the Digital Omnibus fixed new dates for the AI Act. Obligations for stand-alone high-risk systems apply from 2 December 2027, and for AI embedded in regulated products from 2 August 2028. Assessing the creditworthiness of individuals, or scoring their credit, is a named high-risk use. Fraud detection is carved out.

In India, the DPDP Rules notified in November 2025 bring most substantive obligations into force around mid-May 2027, including the cross-border transfer rule. The default is permissive. Personal data may leave India unless the government restricts a destination or sets conditions on access by foreign states and entities under their control, and no restricted list had been notified by mid-2026. Significant data fiduciaries can, however, be required to keep specified categories of data inside India.

For financial institutions, the binding constraints are mostly sectoral. RBI requires payment-system data to be stored only in India. Processing abroad is allowed, but the data must be deleted there and returned within one business day or 24 hours, whichever is earlier. RBI's IT outsourcing direction obliges regulated entities, credit information companies included, to govern the full data lifecycle in the cloud, including multi-location storage and processing. And RBI's draft model risk guidance of June 2026 extends to third-party and AI models. At the time of writing it remains in draft.

This is orientation, not legal advice. Take the specifics to counsel.

Ready if

• Every AI workload is mapped to the data class it touches, where that data sits, how long it is kept and which rule governs it.
• Model and tooling vendors disclose in contract where prompts, logs and embeddings are stored, with deletion terms.
• You have a tested route to run sensitive workloads inside an environment you control.

Red flag. "The cloud region is in India" is treated as the whole answer, while logs, caches and support access sit elsewhere.

Owner and first 90 days. CRO and CISO, with general counsel. Build a residency map for your five most important AI workloads and update vendor contract riders.

4. Token and unit economics

Why it matters. About one in five McKinsey respondents say operating costs, including tokens, have limited their use of AI, even though 60% expect to invest more. Gartner expects inference on a trillion-parameter model to cost providers more than 90% less by 2030 than in 2025, but warns that the saving will not be fully passed on to enterprises. Agentic workloads can consume 5 to 30 times the tokens of a chatbot exchange, and Gartner's view is that value will accrue to those who can orchestrate across a mix of models. In June, it predicted that AI coding costs would overtake the average developer's salary by 2028, as consumption-based pricing spreads and vendors give little visibility into how tokens are billed.

Ready if

• Cost per completed task is tracked for every production workflow.
• Routine, high-volume work is routed to smaller models, with frontier models reserved for harder cases.
• Each team or agent has a spend ceiling and an alert, reviewed monthly.

Red flag. AI spend appears only as one line on a cloud invoice.

Owner and first 90 days. CFO with the CTO. Instrument your three largest workflows, set ceilings, and put the numbers in the monthly review.

5. Agentic orchestration

Why it matters. McKinsey found that 40% of large organisations (over $1 billion in revenue) are scaling AI agents, up from 27%, while smaller organisations were flat at 22%. Gartner's September forecast has spending on AI agents and assistants rising from $29.2 billion in 2026 to $65.5 billion in 2027. Gartner's security guidance is to govern multi-agent systems by what agents are allowed to do rather than how capable the model is, and to use guardian agents to limit the damage when something goes wrong.

Ready if

• Every multi-agent flow has a named owner, a diagram and a fallback to a human or a simpler path.
• Permissions are set per agent by action, not by model capability.
• A checking layer watches high-risk actions and can pause them.

Red flag. Nobody can draw which agents call which tools.

Owner and first 90 days. CTO. Map every flow and pilot a guardian check on one high-risk workflow.

6. Agentic harness

Our view. This priority is our analysis, not a sourced finding. Gartner does not use the word "harness", but its advice to govern agents by action privileges and to add guardian agents describes the same job.

By harness we mean the runtime layer around a model that holds permissions, memory, tool access, logging and the stop control. Our argument is that in 2027 the harness, not the model, is where control and lock-in sit. We set out the case in the 2027 harness wars.

Ready if

• You can name your harnesses and who owns each one.
• Permissions, memory and logs live in a layer you can export and control, not only inside one vendor's product.
• You can swap the underlying model for a workflow without rebuilding its controls, and you have tested it.

Red flag. Your system-of-record vendor ships its own harness, and your agent controls exist only inside it.

Owner and first 90 days. CTO with the CISO. Document your harness inventory and run a model-swap test on one workflow.

7. Vendor concentration and portability

Why it matters. Gartner puts worldwide AI spending at $3.64 trillion in 2027 and says much of it arrives through features embedded by incumbent software vendors. It raised its 2026 figure by about $142.6 billion between January and September, a reminder that forecasts move. On Forbes's 2026 AI 50, funding runs from $60 billion for Anthropic to $91 million for Gamma, which Forbes describes as profitable since 2023. Size is a weak proxy for viability. J.P. Morgan estimates hyperscaler capex near $800 billion in 2026, with capex absorbing 90% to 100% of operating cash flow, so capacity and price depend on power and financing conditions.

Ready if

• Your 10 most AI-dependent workflows each list their vendor, model and exit path.
• Contracts cover data use, pricing triggers, notice of model changes and exit assistance.
• A continuity plan exists for a price rise, an outage or an acquisition, and has been walked through on paper.

Red flag. AI features were accepted as part of a software renewal bundle without separate review.

Owner and first 90 days. CIO with procurement. Audit the AI clauses in your top incumbent-vendor contracts. In CLEAR terms, this covers resilience and lineage.

For the contract clauses that keep a vendor's AI auditable and portable, see how to buy AI behaviour, not features.

8. People and operating model

Why it matters. J.P. Morgan's summary of third-party data describes employees running ahead of their employers on tool use, with firms still largely speeding up existing tasks instead of redesigning work. RBI's FREE-AI report recommends board-approved AI policies and AI literacy for boards and senior management, and the June draft on model risk proposes a board-approved framework.

Ready if

• A short list of sanctioned tools exists, with a usage policy and training.
• One named owner runs AI operations across data, risk and engineering, instead of three committees each holding a piece.
• The board has been briefed and has approved an AI policy.

Red flag. Unsanctioned tools are discovered during an incident or an audit instead of in an inventory.

Owner and first 90 days. CHRO with the CIO. Publish the sanctioned list, name the owner and hold a board briefing.

Your score

Fix in rank order unless a regulatory date forces a different sequence. Priority 3 is the likeliest to do so.

Treat the ranking as a working view, not a settled one. Gartner raised its 2026 spending forecast twice in nine months, the EU's high-risk dates have already moved once, and RBI's model risk guidance was still a draft at the time of writing. Re-score every quarter.

For a fuller self-assessment, take our AI readiness checklist. To turn your score into a plan your board can test, request a strategy conversation.

For the next step on agent authority and orchestration, see our 2027 Agent Stack series: the context layer and the control layer.

Related: DPDP 2027 and enterprise AI: where the ₹250 crore exposure actually sits