// in this post
A working AI strategy fits on one page. This piece shows what goes on it: what you'll invest in, what you've ruled out on purpose, who decides, how you'll know it's working, and the date you'll look at it again.
The case for doing it is in the numbers. The Office for National Statistics found that 30% of UK businesses were using at least one AI technology in its survey that closed on 4 October 2026, and 38% of those with ten or more employees. But use is thin. In the ONS's analysis of June 2026 data, the average number of AI technologies per adopting business rose only from about 1.4 to 1.6 between 2023 and 2026, and just 10% of adopters with ten or more employees said they used AI extensively. That last question is new, so the ONS treats the result as an early indication.
Ask businesses what is holding them back and the answer isn't the technology. In research for the Department for Science, Innovation and Technology, published in January 2026 from fieldwork in spring 2025, 71% of businesses said they hadn't identified a use for AI in their organisation. Among those with no plans to adopt it, the figure was 81%. The missing ingredient is a decision about what AI is for. An AI strategy is the document that makes it.
What a strategy is, and what it usually is instead
Most things called an "AI strategy" are a vision statement with a roadmap graphic. Ambition, a few named technologies, a slide about culture. Nobody's job changes because of it. It gets presented once, filed, and referenced again only when someone asks whether AI is "on the roadmap."
A working AI strategy does something different. It's a small set of decisions, written down, specific enough that someone could read it and know what to do differently. Which use cases get real investment this year. Which ones don't, on purpose. Who signs off on what. What gets measured, and by when. If a document doesn't let you point to a decision it drove, it's the deck version wearing a strategy's name.
The organisations that report real returns do something different. McKinsey's State of AI in 2026 (published 25 August 2026, from a survey of 1,719 people in 97 countries in May and June) singles out the 6% of respondents it calls high performers, who attribute at least 5% of their earnings before interest and tax to AI. Nearly three-quarters of them report fundamentally redesigning workflows around AI. Only a quarter of other respondents say the same. Across all respondents, 37% attribute at least some earnings impact to AI. The sample leans large, with 36% from organisations turning over more than $1 billion, so read it as direction for a 200-person business, not a benchmark. The pattern isn't new, though: McKinsey's 2025 report found that redesigning workflows had the biggest effect on earnings impact of the 25 attributes it tested.
What actually goes in an AI strategy
Five sections, each answering a specific question, each short enough that a leadership team could produce a first draft in a few working sessions.
The use cases you're investing in, and the ones you're not. Name three or four, specifically. "Improve customer service with AI" isn't a use case; "reduce first-response time on billing queries using AI-drafted replies with human sign-off" is. For each one you name, say what you're deliberately not doing this year, and why. The second half is easy to skip and is usually the more useful sentence in the document, because it stops every team treating its own AI idea as automatically in scope. It's also how you answer the 71%: you've picked what AI is for.
The workflow redesign each one needs. Not "roll out the tool", the actual sequence: what changes at the step AI touches, and what has to change downstream because that step is now faster. This is where most strategies go quiet, and it's the part McKinsey's data points to. A use case without a redesigned workflow around it is a demo, not a plan.
The review tier for each use case. Not every piece of AI output needs the same scrutiny. Internal drafts, customer-facing content and anything regulated need different sign-off levels, and the document should say which is which, in one line per use case. This is what turns "we'll be careful" into something a reviewer can check against. The tiers themselves are set out in the piece on AI governance.
Who owns which decisions. Not just who owns the programme overall. Who decides whether a new use case gets added to the list. Who decides when to pull one that isn't working. Without this, decisions happen by whoever's loudest in the room, and the strategy stops governing what happens.
What you're measuring, and by when. Outcome metrics, not activity metrics. Not "how many people were trained", but the number the use case was chosen to move: response time, error rate, hours reclaimed on a specific task. Put a date on when you'll look at it.
Here is the whole thing on one page. The example lines are illustrative.
| Section | The question it answers | What a good line looks like |
|---|---|---|
| Invest | Which three or four use cases get real investment this year? | "Cut first-response time on billing queries with AI-drafted replies and human sign-off" |
| Not doing | What are we choosing not to do, and why? | "No AI-written customer emails without a named reviewer until the review process is proven" |
| Workflow | What changes at the step AI touches, and downstream? | "Drafts arrive in the queue pre-written; the agent's job moves from typing to checking" |
| Owners | Who adds a use case, and who pulls one? | "[Name], agreed with the MD at each quarterly review" |
| Measures | Which number moves, and when do we check? | "Median first-response time, reviewed on [date]" |
The one line most documents are missing
Put a date in the document for when it gets revisited, and mean it. Quarterly, not annual. The ground under an AI strategy moves. In 2026 alone the UK's automated decision-making rules changed in February, the government shelved its SME self-assessment tool the same month, and the EU moved its high-risk AI deadlines in July. A strategy that gets looked at once a year is behind by month three.
An easy way to keep the date is to attach it to something that already happens. The strategy review is the last item in the one-hour quarterly check described in the piece on AI governance: are the use cases still the right ones, and are the numbers moving?
How the strategy, the policy and the governance fit
They do different jobs, and a business needs all three. The strategy says what you're using AI for and what you're not. The usage policy says what your staff may do, with which tools and which data. The governance says who owns it all, what's running, how new uses get approved and when you look again. A strategy with no policy leaves staff guessing. A policy with no strategy is a list of rules for a destination nobody chose. Governance is what keeps the other two true.
If you're not sure where your organisation starts, is your organisation ready for AI? is a good first read. The thinking behind the competencies a strategy depends on is in what it takes to build AI capability and the five organisational competencies.
Doing this yourself, or not
The five sections above are enough to draft a real first version without anyone's help. Most leadership teams can get through it in a handful of focused sessions if they're honest about the second half of section one, the things they're choosing not to do.
Where outside help tends to earn its cost is the room, not the framework: getting a leadership team to agree on trade-offs, rather than everyone's favourite use case making the list, is the harder part in practice than writing the document. That's the bulk of what a Discovery engagement does: a strategy, a policy and the governance to hold them, worked through with your actual team, on your actual workflows, over four to six weeks. If you'd rather talk it through first, get in touch.
FAQ
What should an AI strategy document actually include?
A short, named list of the use cases you're investing in and the ones you've deliberately ruled out, the workflow redesign each use case needs, the review tier and sign-off level for each, who owns which AI decisions, the outcome metrics you're tracking, and a fixed date to revisit the whole thing. If a document doesn't let you point to a decision it drove, it isn't a strategy.
How is an AI strategy different from an AI vision statement?
A vision statement describes an aspiration. A strategy is a set of choices: which three or four use cases get investment, which ones don't, who's accountable for each, and what you'll measure. If nothing in the document would change what someone does on Monday, it's a vision statement wearing a strategy's name.
Do small and mid-sized businesses need an AI strategy?
If you're using AI at all, you're already making choices about which tools, which tasks and who checks the output. A strategy makes them on purpose. In research for the Department for Science, Innovation and Technology, 71% of UK businesses said they had not identified a use for AI in their organisation. A short strategy is the document that answers that question.
Should I write my AI strategy myself, or get help?
The framework here is enough to draft a first version yourself; most leadership teams can produce something workable in a few focused sessions. Where outside help earns its cost is facilitation (getting a leadership team to agree on trade-offs) and pattern-matching from having done it with other organisations before.
How often should an AI strategy be reviewed?
Quarterly, not annually. The tools, the workflows and the rules around them move faster than an annual planning cycle can track. Build the review date into the document itself rather than waiting for it to feel out of date, and run it alongside your quarterly governance review.