Building an AI roadmap: The 4-phase method for enterprise AI transformation

An AI roadmap is built in four phases: (1) Potential assessment with business case and data readiness, (2) Use-case selection via a scoring matrix, (3) Pilot with fail-fast gates, and (4) Scale with MLOps and governance. Realistic timeline: 12 to 18 months to two or three production-scaled use cases.

What an AI roadmap actually is — and what it is not

An AI roadmap is a plan that translates an organisation's AI ambition into an ordered sequence of decisions, milestones, and investments. It is not a wish list, not a tool shopping basket, and not a PowerPoint vision deck. It is a working document that sets priorities, assigns accountabilities, and makes explicit what the organisation must learn first before it scales.

In practice, most AI initiatives fail not on technology but on sequencing. McKinsey's State of AI research reports that only a minority of pilots reach production — the often-cited figure is roughly 70 percent of pilots never scale. The root causes are almost always strategic rather than technical: weak business case, wrong use-case selection, unclear data accountability, or governance that is bolted on after the first model is rolled out.

A credible roadmap addresses those weak points before the first model experiment. It answers three questions in order: where is the largest value pool? Which use cases within it are realistically feasible? And how do we move successful pilots into steady production — compliant, observable, and owned by the business line?

Common misconceptions ADVISORI regularly corrects in client engagements:

• "We need an AI platform first, then we'll find the use cases." — Wrong sequence. Platform investments without a proven use case produce expensive shelves.
• "We'll run three pilots in parallel and see which one performs." — Without defined fail-fast gates, this turns into a permanent state rather than a decision point.
• "Governance comes once we're in production." — The EU AI Act requires risk classification before market deployment. Retrofitting governance in Phase 3 doubles the work.

The 4-phase method at a glance

The ADVISORI method organises AI transformation into four sequential phases, each with a distinct objective, output, stakeholder set, and stop criterion. Each phase has a defined ending — not a gradual transition, but an explicit go/no-go decision. This creates steerability in a discipline where hype and impatience are the classical risks.

In summary:

• Phase 1 — Potential assessment (4-8 weeks): business case, data-readiness check, strategic framing. Output: prioritised shortlist of 15-25 candidate use cases plus an organisation-maturity diagnosis. Stakeholders: executive board, CDO/CIO, business-line leadership.
• Phase 2 — Use-case selection (4-6 weeks): scoring matrix, portfolio view, no-go criteria, AI Act risk pre-check. Output: two to three prioritised use cases for pilot. Stakeholders: steering committee, Legal/Compliance, data owners.
• Phase 3 — Pilot (12-24 weeks per use case, in parallel): MVP scope, fail-fast gates, data integration, first working model. Output: validated or discarded use cases with quantified business impact. Stakeholders: business line, data science, IT operations.
• Phase 4 — Scale (6-12 months per use case): MLOps stack, operational handover, governance operating model, change management. Output: a production AI system with monitoring, business ownership, and AI Act documentation. Stakeholders: business-line owner, platform team, Compliance.

A typical enterprise needs 12 to 18 months from kick-off to two or three scaled use cases. Plans shorter than that systematically under-estimate Phase 4.

Phase 1: Potential assessment — business case, data readiness, ROI model

Phase 1 looks inward before anything is built. It answers three questions: where in the business model sits the material AI value potential? What data is available, and at what quality? And which organisational prerequisites (skills, architecture, governance maturity) must be in place before AI can operate reliably?

Opportunity analysis: Structured along the value chain — Sales, Service, Operations, Risk, Finance, HR — hypotheses are developed for where AI moves a measurable lever. The analysis draws on benchmark data (industry comparisons, Bitkom report, Stanford AI Index) and internal drivers. Output: a shortlist of 15-25 candidate use cases, each with a first-pass ROI estimate in a plus/minus 50 percent band.

Data-readiness check: For each candidate, the team examines whether the relevant data exists, where it sits, who is accountable for it, and what quality it has. The check captures completeness, historical depth, label availability (for supervised use cases), access rights, and GDPR classification. The most common finding: data exists but is not integrated — an insight that materially shapes the investment path.

Organisation maturity view: In parallel, the organisation's capability to operate AI is assessed — data-engineering capacity, MLOps experience, AI governance framework, internal communication. The maturity view is not an end in itself; it determines how ambitious the first pilots may be and which companion investments must run alongside.

Stop criterion: if Phase 1 surfaces fewer than five use cases with a robust business case and sufficient data basis, the initiative is not ready for Phase 2. Data foundations or skills build-out are prioritised instead — no pilot without prospective value.

Phase 2: Use-case selection — scoring matrix, portfolio view, no-go criteria

Phase 2 turns the shortlist from Phase 1 into two or three concrete pilots. The central instrument is a scoring matrix that rates each candidate along three dimensions: impact, feasibility, and risk.

• Impact (weight 40%): expected EBIT contribution, customer effect, strategic differentiation.
• Feasibility (weight 40%): data availability, technical complexity, integration effort, skill fit.
• Risk (weight 20%): regulatory risk (EU AI Act), reputation risk, vendor lock-in.

Each dimension is scored per use case on a 1-5 scale, weighted, and summed. The result is a numerically comparable ranking — not gut feel, but also not a deterministic oracle. The matrix reveals tendencies; the final selection remains a steering-committee call.

Portfolio view: The two or three selected pilots should form a portfolio, not a monolith. A typical mix contains one quick win with short time-to-value (e.g., text classification in Service), one strategic lever with moderate complexity (e.g., supply-chain forecasting), and optionally one moonshot with high learning value. This mix insulates the organisation and the board against the all-loss risk of one pilot failing.

No-go criteria: Regardless of score, use cases are dropped if: (a) the data basis does not exist and cannot be built within three months, (b) the use case clearly falls under Article 5 of the EU AI Act (prohibited practices) or Annex III high-risk without a viable compliance path, (c) no clear business accountability can be assigned, or (d) the expected delta could already be achieved by conventional automation without AI.

AI Act pre-check: before phase end, Legal/Compliance tests each remaining use case against Annex III of the AI Act (biometric identification, critical infrastructure, education, employment, access to services, law enforcement, migration, justice, democratic processes). A high-risk classification is not an exclusion, but a signal that Phases 3 and 4 will carry substantially more compliance work — which must be reflected in the business case.

Phase 3: Pilot — MVP scope, fail-fast gates, avoiding PoC Hell

Phase 3 is the costliest and politically most delicate phase — not because it is especially complex, but because many organisations never bring pilots to a decision point. They drift on, get labelled "interesting", and slowly fade without anyone announcing the end. That is PoC Hell.

The antidote is an explicit pilot plan with three elements:

1. MVP scope: the pilot addresses a narrowly defined sub-question, not the full use case. Example: instead of "AI-supported credit decisioning for the entire corporate portfolio", start with "AI recommendation for standard credit decisions below €250,000 in the retail/DE segment". Scope reduction is not timidity; it is accelerated learning.
2. Fail-fast gates at defined intervals — typically weeks 8, 16, and 24. At each gate, the steering committee tests three criteria: is the technical feasibility proven? Does the expected value lever show at pilot scale? Is the business line ready to own the transition into Phase 4? Two or more negatives end the pilot — not extend it.
3. Defined documentation depth: training-data provenance, model choice, bias tests, and first risk-assessment notes are captured already in the pilot — not as bureaucracy but as the foundation for AI Act technical documentation in Phase 4. Reconstructing this retroactively in Phase 4 doubles the effort.

A typical pilot footprint: an interdisciplinary team of 4-7 people (data scientist, data engineer, domain expert, product owner, optional UX, optional Legal), 12-24 weeks of duration, budget in the low-six-figure range depending on complexity. Two to three pilots run in parallel — more overwhelms steering capacity, fewer reduces the learning effect.

The output of Phase 3 is not a finished AI solution. It is a validated hypothesis: the use case holds, the business case survives contact with reality, the business line is committed. Or not — and the organisation learns that quickly, rather than after an 18-month investment.

Phase 4: Scale — MLOps, governance, change management

Phase 4 moves a successful pilot into durable production. It is the most under-estimated phase — in the excitement after pilot success, the shape of the scaling curve is systematically mis-drawn. In practice, the jump from pilot to scaled application often takes twice as long as the pilot itself, because three parallel workstreams must run.

MLOps stack: The pilot usually ran in a data-science sandbox. Scaling demands model versioning, automated retraining, performance monitoring (accuracy, drift, data quality), incident response for model failures, and clear release processes. Typical components: feature store, model registry, deployment pipelines, observability stack. Betting everything on a single platform creates material vendor dependency — a decision that must be visible in the business case.

Governance operating model: Every scaled AI application needs a named business owner, a technical owner, a compliance owner, and a documented escalation path for model failures. For high-risk applications under the EU AI Act, additional mandatory elements apply: technical documentation, logging, human oversight, risk-management system. Organisations running an AI management system per ISO/IEC 42001 already have this framework systematically structured.

Change management: The users of the system are now no longer benevolent pilot participants but the day-to-day workforce. Their acceptance decides whether the application creates value or merely runs. Change management in Phase 4 means trainings, feedback loops, wave-based rollouts, and transparent communication of the system's boundaries (what it can do, what it cannot, when the human must decide).

At the end of Phase 4 the output is not only a running AI application but a reproducible path. The organisation has learned how to scale AI — and can move use case four, five, and six through the same four phases faster. The real strategic gain is not the individual application; it is the practised organisation.

Common pitfalls: tech-first, broken data, governance gap

Three pitfalls appear in client engagements more often than all the others combined. They are not mistakes of individual teams but systemic patterns that must be planned against from the start.

1. The tech-first trap. The organisation buys an AI platform or signs a GPU framework agreement before the use cases exist. Reasoning: "We need to be ready." Result: an expensive shelf, unused licences, data scientists without meaningful work. Antidote: platform decisions only after Phase 2, derived from concrete use-case requirements.

2. The broken-data trap. AI is placed on top of a data landscape that has grown historically, is fragmented, and is poorly governed. Models learn artefacts rather than business logic; drift warnings become indistinguishable from normal data noise. Antidote: data-readiness check in Phase 1 with an investment budget for foundational work before models are built.

3. The governance gap. After the first successful pilot, scaling happens before an AI governance framework is in place. The EU AI Act applies once the system is on the market — and suddenly technical documentation must be reconstructed, risk assessments back-filled, human oversight retro-fitted. Antidote: governance design in parallel with Phase 2, not starting in Phase 4.

How long an AI roadmap realistically takes

Boards often expect ROI within six months. The honest answer: from kick-off to the first production-scaled use case is realistically 9 to 12 months, and 12 to 18 months to two or three scaled use cases. Faster plans usually cut either Phase 1 (selecting the wrong use cases) or Phase 4 (inheriting regulatory catch-up work later).

Comparative data supports this range. The Stanford AI Index 2024 shows that organisations with successful AI scale-ups typically need 12-18 months from first investment to measurable EBIT contribution. McKinsey's State of AI reports similar horizons; the few faster cases are almost always narrow service automations, not strategic applications.

What accelerates: mature data architecture, existing MLOps practice, clear product ownership in the business line, small pilot scopes. What slows things down: large platform programmes running in parallel, re-organisation during the roadmap, unclear data accountability, and under-estimating change-management effort in Phase 4.

AI roadmap template and checklist

The following checklists are adaptable directly for a roadmap workshop. They do not replace consulting but they structure the decisions that matter per phase.

Phase 1 kick-off checklist

• Top three strategic drivers of the organisation explicitly named.
• At least three workshops along the value chain held with business lines.
• Shortlist of 15-25 candidate use cases with business-case sketch (plus/minus 50 percent).
• Data-readiness check per candidate: availability, quality, access rights, GDPR classification.
• Organisation-maturity view: skills, MLOps, governance, communication.

Phase 2 scoring-matrix fields

• Impact (1-5): expected EBIT contribution, customer effect, strategic differentiation.
• Feasibility (1-5): data availability, technical complexity, integration, skills.
• Risk (1-5): AI Act classification, reputation, vendor dependency.
• No-go flags: prohibited practice, no business owner, conventional automation faster.
• Portfolio tag: quick win / strategic / moonshot.

Phase 3 fail-fast gates

• Gate at week 8: technical feasibility proven?
• Gate at week 16: value lever visible at pilot scale?
• Gate at week 24: business line committed for Phase 4?
• Stop condition defined (two or more negatives).

Phase 4 scale-readiness checklist

• MLOps stack operational: model registry, monitoring, retraining, incident response.
• Business owner, technical owner, compliance owner named.
• Technical documentation per EU AI Act requirements complete.
• Change-management plan with trainings and wave-based rollout.
• KPI definition and reporting cadence agreed.

EU AI Act and ISO 42001: how compliance enters the roadmap

Regulation is not an end-game after scaling; it is a series of gates along the four phases. Three anchor points are enough to keep the roadmap compliance-ready.

Annex III self-check at end of Phase 2: Legal/Compliance tests every remaining use case against the eight high-risk categories of the AI Act. A high-risk label is not an exclusion but a signal that Phases 3 and 4 will carry substantially more effort — and the business case must be adjusted accordingly.

Technical-documentation discipline in Phase 3: Training-data provenance, model choice, evaluation metrics, bias tests, and first risk assessments are already documented in the pilot. This is the foundation of the AI Act technical documentation that must be in place when the system is placed on the market.

AI management system in Phase 4: ISO/IEC 42001:2023 provides an international framework for durable operation of AI systems — from planning through decommissioning. Organisations that stand up an AI management system per ISO 42001 have the organisational core of AI Act compliance systematically covered and can signal that through certification.

Regulatory specifics are only indicated here; for deeper treatment, ADVISORI's dedicated AI Act advisory applies. What matters at this stage is the sequence: compliance is built into each phase alongside the work, not bolted on at the end.

Frequently asked questions about AI roadmaps

What is an AI roadmap?

An AI roadmap is a strategic plan that translates an organisation's AI ambition into an ordered sequence of phases, decisions, and milestones. It prioritises use cases, assigns accountabilities, and defines which prerequisites (data, skills, governance) must be in place before which stage of development. The goal is a reproducible path from idea to scaled production.

How do I build an AI roadmap in 4 phases?

In four sequential phases. Phase 1 is a potential assessment with use-case identification, data-readiness check, and organisational diagnosis. Phase 2 selects two to three use cases via a scoring matrix for piloting. Phase 3 runs the pilots with tight MVP scope and fail-fast gates. Phase 4 scales successful pilots into production with MLOps, governance, and change management.

How long does it take to develop an AI roadmap?

From kick-off to two or three production-scaled use cases, budget 12 to 18 months. Phase 1 takes four to eight weeks, Phase 2 four to six weeks, Phase 3 twelve to 24 weeks per pilot (in parallel), Phase 4 six to twelve months per use case. Significantly shorter plans usually cut Phase 4 and under-estimate scaling effort.

How much does an AI roadmap cost?

The roadmap-creation phases alone (Phases 1 and 2) typically cost in the mid-five- to low-six-figure euro range for consulting services, depending on organisation size and analysis depth. Total investment including Phases 3 and 4 scales with number and complexity of use cases — typical enterprise programmes run in the mid-to-high-six-figure range, larger transformations into seven figures over 18 months.

What role does the EU AI Act play in an AI roadmap?

The EU AI Act (Regulation (EU) 2024/1689) anchors compliance gates in every phase of the roadmap. At the end of Phase 2 the Annex III self-check determines risk classification. In Phase 3 technical documentation is built up already during the pilot. In Phase 4 risk-management system, human oversight, and logging are operationalised — ideally embedded in an AI management system per ISO/IEC 42001.

What is the difference between AI strategy and AI roadmap?

The AI strategy is the destination and direction: why does the organisation pursue AI, what strategic ambitions does it hold, what value proposition should emerge? The AI roadmap translates that strategy into an executable sequence: which use cases first, which prerequisites, which milestones, which timeline. The strategy answers the why and the what; the roadmap answers the how and the when.

How many use cases should be evaluated in Phase 2?

Phase 1 produces a shortlist of 15 to 25 candidate use cases. Phase 2 prioritises these via the scoring matrix, selecting two to three for piloting in Phase 3. More than three parallel pilots overwhelm the steering and skills capacity of a typical enterprise; fewer than two reduces the learning effect and raises the all-loss risk.

What happens if a pilot in Phase 3 fails?

If a pilot fails at a fail-fast gate, it is stopped deliberately, not extended. Failure is explicitly budgeted for in Phase 3 and counts not as project failure but as a learning outcome. What matters is the documentation: why was the hypothesis rejected, which assumptions were wrong, which use cases from Phase 1 now move up? The portfolio logic of Phase 2 protects the roadmap from a single failure threatening the whole programme.