Artificial intelligence has become the newest corporate arms race. Across boardrooms, executives are under mounting pressure from investors, clients and regulators to prove that their organisations are AI-ready. Yet as spending on AI accelerates, a more fundamental question is emerging: how should enterprises actually adopt the technology?
The debate is increasingly centred on two competing models. One favours a top-down approach, where management selects approved tools, sets governance standards and drives deployment across the organisation.
The other is a bottom-up model, where employees independently adopt publicly available AI applications such as ChatGPT, Claude and Perplexity to improve productivity, often outside formal enterprise programmes.
The choice is becoming one of the defining technology and capital-allocation decisions facing corporate leaders as they seek to balance innovation, cost, security and compliance.
In India, Microsoft recently disclosed that the country’s three largest IT services firms — Infosys, Tata Consultancy Services and Wipro — have each expanded their Copilot deployments to more than 100,000 employees, taking the combined commitment beyond 300,000 licences within six months.
The CFO’s dilemma
The top-down approach offers clear advantages: stronger governance, better data security, greater vendor leverage and tighter integration with enterprise systems.
However, it also suffers from a structural weakness. Traditional enterprise procurement cycles move far more slowly than the AI market itself. By the time a vendor is evaluated, security reviews completed, contracts negotiated and deployment plans finalised, the chosen technology may already be outdated.
The alternative — bottom-up adoption — is already taking place across enterprises. Employees in finance, marketing, legal and operations functions are increasingly incorporating AI tools into their workflows without waiting for formal approval.
This model is faster, self-selecting and grounded in real business needs rather than hypothetical use cases. But it also introduces significant risks. Sensitive client information, financial forecasts, legal documents and proprietary business strategies may be processed through systems over which enterprises have little visibility or control.
In a post-DPDP Act environment, where India’s data protection regime is acquiring greater regulatory teeth, these risks are becoming increasingly difficult to ignore, according to industry observers.
For chief financial officers, the challenge is equally complex. A top-down strategy can result in stranded capital invested in underutilised AI infrastructure and licences. A bottom-up strategy can create fragmented spending, hidden operating costs and unclear returns on investment.
A middle path
Industry experts increasingly believe that the answer lies in a hybrid model that combines enterprise governance with employee-led innovation.
“The ideal strategy would be an enterprise-wide unified AI governance framework. However, organisational silos can make that difficult and, slow down innovation and adoption,” said Anushree Verma, senior director analyst at Gartner.
Verma said the rapid proliferation of AI, generative AI and agentic AI is creating demand for centralised “control planes” that can manage, monitor and govern deployments across organisations.
“We are seeing the rise of AI agent management platforms to unify, run, manage and govern agents. Gartner estimates that by 2028, an average Fortune 500 enterprise will have more than 150,000 AI agents in operation, compared with fewer than 15 in 2025, creating significant management complexity,” she said.
Verma added that most organisations do not need to build their own large language models because of the substantial costs associated with development, retraining and maintenance.
Instead, enterprises should increasingly adopt domain-specific models that are fine-tuned for specialised business functions. Such models can be deployed more efficiently, operate at lower cost and offer stronger control over data and intellectual property. Gartner expects domain-specific models to overtake general-purpose LLMs as the dominant enterprise AI architecture by 2028.
Padmashree Shagrithaya, executive vice-president and head of insights & data – India at Capgemini, described the emerging model as “governed autonomy”.
“The question now is how to combine governance with employee empowerment at scale,” she said. “Leadership must establish clear guardrails around security, data and compliance while giving employees the flexibility to identify and apply use cases that create measurable business impact.”
In practice, this means providing access through secure enterprise gateways rather than mandating a single tool, classifying data according to sensitivity and closely tracking AI use to measure value creation. Shagrithaya argued that building proprietary foundation models rarely makes economic sense for most enterprises.
“The sustainable advantage lies one layer above the model — in proprietary knowledge, business workflows and robust governance and evaluation frameworks,” she said.
Samaresh Datta, associate vice-president (IT) at Electrosteel Group and member of the BCC&I IT Committee, also favours a hybrid approach.
“A governed-agility model is the most practical path forward,” he said. “Organisations should provide secure AI platforms, governance frameworks and compliance controls while empowering business units to identify and implement use-case-specific applications. This enables innovation and faster adoption without compromising security, accuracy or regulatory requirements.”