The Four Pillars of AI Success: Governance, People, Data, and Process

July 20, 2026

Most AI strategies do not fail because the technology underperforms. They fail because organizations treat AI as a single initiative instead of four separate disciplines that have to mature together. Governance without workforce readiness produces a policy nobody follows. Data readiness without process redesign produces a clean pipeline feeding a workflow that was never rebuilt to use it.


Governance, people, data, and process are not sequential steps. They are four load-bearing walls, and in regulated industries, a crack in any one of them shows up as risk somewhere else. Here is where each pillar actually breaks down today, and what the data says about the gap between where most organizations sit and where they need to be. 


Governance: policies don't create governance. Enforcement does. 

Most organizations think they have AI governance because someone in legal drafted a policy and got it signed off. They don't. IBM and the Ponemon Institute surveyed 600 organizations for the 2025 Cost of a Data Breach Report and found that 63 percent of breached organizations either have no AI governance policy or are still developing one. Of the ones that do have a policy, only 34 percent audit for unsanctioned AI. That gap shows up highest in the org chart: McKinsey's 2025 State of AI survey found only 28 percent of organizations have their CEO directly overseeing AI governance, and just 17 percent say their board does. Deloitte's 2026 State of AI in the Enterprise found 74 percent of companies expect to use agentic AI within two years, but only 21 percent have a governance model mature enough to manage it. 


Governance is not a document. It is three things working together: 


  • Visibility into what AI is actually running in your environment 
  • Accountability, meaning a specific person or committee owns the outcome 
  • Enforcement, meaning there are consequences when policy is not followed 

Miss any one of those and you have paperwork, not a program. 


People: AI literacy isn't training. It's an operating model. 


Deloitte names the AI skills gap as the single biggest barrier to integration right now, ahead of budget and technology maturity. McKinsey's 2026 AI Trust Maturity Survey found that nearly 60 percent of organizations cite knowledge and training gaps as the primary barrier to responsible AI, up from about 50 percent the year before. The gap is widening while spend on closing it goes up, and the reason is the unit of measurement. A workshop teaches someone to use a tool. It does not teach a claims adjuster when to trust a model's output, or an underwriter how to explain an AI-assisted decision to a regulator. 


Capability, not completions, is what closes the gap: 


  • Frontline roles need to know when AI output is reliable enough to act on 
  • Underwriting and clinical roles need to explain AI-assisted decisions in plain language 
  • Compliance roles need new technical skills like model auditing and bias testing 

None of that happens in a single session, and none of it happens outside the flow of actual work. 


Data: AI is only as trustworthy as the data behind it. 


PwC's 2026 AI Performance Study surveyed 1,217 executives and found that nearly three quarters of AI's economic value is captured by just one fifth of organizations. The differentiator is not a better model. Those top organizations are 1.7 times more likely to have a Responsible AI framework, 1.5 times more likely to have a cross-functional governance board, and their employees trust AI outputs at twice the rate of everyone else. Trust comes from knowing where data originated, who touched it, and what controls sat around it the whole way through, not from a more sophisticated model. McKinsey's research on AI data readiness argues most organizations manage data like a storage problem when they should manage it like a supply chain, since a single document can expand into text, tables, metadata, and quality scores that AI systems reuse and recombine downstream. 


The data causing the most exposure is usually getting the least attention. Before your next AI initiative launches, ask: 


  • Where does data quality break down, and who owns fixing it 
  • Is lineage visible for your highest-risk AI use cases, or assumed 
  • What unstructured assets, like clinical notes and policy documents, carry no governance at all 


Process: Agentic AI changes how work gets done. 


Deloitte's finding that 74 percent of companies expect to use agentic AI within two years, against only 21 percent with mature governance for it, is a workflow problem as much as a governance one. Every process most organizations run today was built for AI that waits to be asked. Agentic AI does not wait. It initiates and chains actions across systems on its own, and workflows built around human-reviewed steps have no place for that kind of actor. The World Economic Forum's January 2026 AI at Work report makes the point directly: one healthcare organization took a lab-order process from thirty minutes to a few seconds by rebuilding the workflow first and deploying AI second, reclaiming roughly 30,000 hours a year. 


KPMG's Q4 2025 AI Pulse Survey found that 60 percent of organizations restrict agent access to sensitive data without human oversight, meaning 40 percent do not. Four controls close most of that gap: 


  • Clear rules for when an agent's action requires human review first 
  • Explicit policies for what data and systems an agent can touch 
  • A traceable audit record built for an examiner, not internal debugging 
  • A defined escalation path when an agent's behavior deviates from expectations 


Bringing the four pillars together 


These four pillars do not advance on separate timelines. A governance policy without a workforce that understands it is theater. A clean data foundation feeding a workflow nobody redesigned is wasted effort. The organizations pulling ahead are treating all four as one system, built and audited together, not four separate initiatives competing for the same budget. 


Kona Kai works with healthcare, insurance, and banking leaders to close these gaps before an exam, an audit, or an incident force the conversation. Get in touch to talk through where your organization actually stands across all four. 


Sources: IBM / Ponemon Institute, Cost of a Data Breach Report 2025; McKinsey, State of AI: How Organizations Are Rewiring to Capture Value, March 2025; McKinsey, State of AI Trust in 2026; McKinsey, AI Data Readiness: The Key to Scaling Impact, June 2026; Deloitte, State of AI in the Enterprise 2026; PwC, 2026 AI Performance Study, April 2026; World Economic Forum, AI at Work: From Productivity Hacks to Organizational Transformation, January 2026; KPMG Q4 2025 AI Pulse Survey. 

INSIGHTS

The AI Skills Gap Isn't Going to Close on Its Own

By Paul Benvenuto • August 19, 2026
AI is changing workforce training from a one-time project into a continuous business capability. For decades, enterprise technology transformations have followed a predictable pattern. A new system is implemented, then employees learn how to use it. Productivity dips for a while, then recovers as the organization adapts. Whether it was a CRM implementation, ERP modernization, a claims platform replacement, or a core banking upgrade, the skills gap eventually disappeared because the technology itself stopped changing. AI is different. Unlike traditional enterprise software, AI capabilities continue to evolve after implementation. New models are released, AI agents become more capable, and workflows change faster than most organizations can retrain employees. The result is a workforce that isn't simply learning a new system, but continuously adapting to one. That fundamentally changes how organizations should think about workforce readiness. Recent research from the World Economic Forum and Microsoft's Work Trend Index suggests many organizations already recognize the challenge. Are enterprises doing enough to prepare for a skills gap that may never close? AI Changes the Rules for Workforce Training Traditional enterprise software had a finish line. Once employees learned the new system, their knowledge remained valuable for years. Training programs could be planned, measured, completed, and archived because the technology itself remained relatively stable. AI doesn't offer that stability. Employees who learned effective prompting techniques six months ago may now be using AI agents. Teams that started with document generation may now be automating entire workflows. Capabilities continue to expand, changing what effective work looks like almost as quickly as organizations can document it. That means workforce readiness can no longer be viewed as a milestone that follows implementation, as it needs to become part of day-to-day operations. The AI Skills Gap Doesn't End After Go-Live The challenge isn't simply that AI is changing jobs. It's that AI itself keeps changing. Foundation models continue to improve. New copilots are released. AI agents take on increasingly sophisticated tasks. Features that didn't exist six months ago become standard workflow tomorrow. Employees aren’t learning one “system” because they need to continuously adapt to new capabilities. Someone who learned the most effective way to use AI six months ago may already be working differently today. Traditional training models weren't designed for that pace of change. AI Is Reshaping the Workforce Faster Than Organizations Can Respond The World Economic Forum's Future of Jobs Report 2025 highlights just how significant this challenge has become.

Trustworthy AI Starts With the Data You Can't See.

By Paul Benvenuto • July 31, 2026
PwC's April 2026 AI Performance Study surveyed 1,217 senior executives across 25 sectors and found something that should reframe how every regulated organization talks about AI investment: nearly three quarters of AI's economic value is being captured by just one fifth of organizations. Not because that top fifth has better models. PwC is specific about the differentiator: those organizations are 1.7 times more likely to have a Responsible AI framework and 1.5 times more likely to have a cross functional AI governance board. Their employees trust AI outputs at twice the rate of everyone else's. The value gap is structural, not a matter of who bought the better tool. That finding lands differently once you connect it to where trust actually comes from. It doesn't come from a more sophisticated model. It comes from knowing where your data originated, who touched it along the way, and what controls sat around it the entire time.  McKinsey's June 2026 research on AI data readiness makes the case that most organizations manage data like a storage problem when they should be managing it like a supply chain. A single PDF can expand into extracted text, tables, images, metadata, sensitivity tags, and quality scores, each one an intermediate artifact that AI systems reuse and recombine downstream. A small error introduced upstream doesn't stay small. It propagates. This matters more in regulated industries than almost anywhere else, because the data causing the most exposure is usually the data getting the least attention. Structured fields get governed. Clinical notes, claim narratives, loan officer comments, and audit trails, the unstructured stuff, usually don't, even though AI systems depend on it heavily. Gartner and IDC both put the share of enterprise data that is unstructured at somewhere around 80 to 90 percent. McKinsey's own research doesn't cite that specific figure, but makes the same underlying point: unstructured content is where AI systems draw the most context, and where governance attention is thinnest. None of this is an argument for waiting until your data is perfect before you deploy anything. PwC's 2026 Digital Trends in Operations Survey argues directly against that instinct: AI can help bridge data gaps, particularly through agents that reason using whatever data is actually available. The real mandate isn't clean data as a prerequisite. It's disciplined governance and iterative improvement running in parallel with deployment, calibrated to how much risk a given use case actually carries. So what does that look like in practice for a CIO or CDO sitting inside a regulated organization right now? A few diagnostic questions worth asking before your next AI initiative launches: Where does data quality actually break down in your pipeline, and does anyone own fixing it? Is lineage visible for the data feeding your highest risk AI use cases, or is it assumed? Where do unstructured assets, like clinical notes, policy documents, and loan files, enter your systems without any governance attached? Have you defined what "good enough" data quality means for each use case, calibrated to its actual risk profile, rather than applying one standard everywhere? Answering those honestly is uncomfortable in most organizations, because the answer is usually "we don't fully know." That's the point. You cannot govern what you cannot see, and you cannot trust an AI output built on a data foundation nobody has actually traced. The organizations in PwC's top 20 percent didn't get there by waiting for perfect data or by buying a better model. They got there by treating governance as a financial performance variable, not a compliance checkbox, and by building the lineage and controls that make trust possible at scale. Kona Kai's data supply chain assessment is built to answer exactly these questions before tool selection, not after. If you're not certain where your organization would land on that list, that uncertainty is worth resolving now. Get in touch to talk through what the assessment covers. Sources: PwC 2026 AI Performance Study, April 13, 2026 (74%/20% figure and 1.7x/1.5x/2x multipliers confirmed directly at pwc.com); McKinsey, AI Data Readiness: The Key to Scaling Impact, June 2026; Gartner and IDC estimates for the 80-90% unstructured data share; PwC 2026 Digital Trends in Operations Survey.

Agentic AI Changes the Job. Your Workflows Haven't Caught Up.

By Paul Benvenuto • July 29, 2026
Every governance and workflow framework most organizations are running today was built for AI that waits for a human to ask it something. Agentic AI doesn't wait. It initiates, executes, and chains actions across systems on its own, and the workflows built around human initiated, human reviewed steps simply don't have

AI Literacy Isn't Training. It's an Operating Model.

By Paul Benvenuto • July 27, 2026
Education was the number one way companies say they adjusted their talent strategy in response to AI. And yet most organizations still treat training as an event. A workshop. A certificate. A box that gets checked once and never revisited.

Policies Don't Create Governance. Enforcement Does.

By Paul Benvenuto • July 20, 2026
Most organizations think they have AI governance because someone in legal drafted a policy and got it signed off. They don't. A policy sitting in a shared drive doesn't know where your AI is actually running. It doesn't flag it when a model drifts. It doesn't do a single thing when an employee routes a client file thro

Why Regulated Industries May Have an Unexpected AI Advantage

By Carly Whitte • July 1, 2026
AI success depends on more than technology. Governance, regulation, and operational oversight are helping organizations turn AI pilots into scalable business capabilities.

The Missing Ingredient in Healthcare AI Adoption: Accountability

By Carly Whitte • June 27, 2026
Healthcare AI adoption depends on more than technology. Governance, accountability, and AI readiness determine whether AI delivers measurable business value.

The Hidden Enterprise Risk Behind “Vibe Coding”

By Carly Whitte • May 24, 2026
AI-powered “vibe coding” is accelerating enterprise software creation, but governance and security controls are struggling to keep pace. Learn the hidden risks of AI-generated applications and why responsible AI governance is critical for scalable enterprise adoption.

Rethinking AI Skepticism in Healthcare Governance

By Carly Whitte • May 6, 2026
Why does AI adoption stall in healthcare? Discover how accountability, governance, and risk management influence success beyond change management.

When Change Management Isn’t Enough for Healthcare AI Adoption

By Carly Whitte • April 28, 2026
AI adoption in healthcare often stalls due to unclear accountability, not resistance. Learn how governance design, risk management, and liability structures impact successful implementation.