CIO Priorities

The breakneck pace of change in IT has thrown long-term strategic planning into question. As the year heads toward its final stretch, CIOs have been given the tall task of helping organizations respond to the most recent technological advances — without losing sight of the bigger picture.

AI will render plans stretching two or more years into the future outdated, while even one-year plans would be “susceptible to disruption,” according to a CGS Immersive report. In July, McKinsey cited AI chip development as a factor complicating long-term plans. A month later, Grant Thornton said six- to eight-week cycles were replacing multiyear projects.

But IT leaders would be mistaken to cope with this shift by becoming shortsighted, Kristie Grinnell, EVP and CIO at TD Synnex, an IT solutions aggregator and distributor, told CIO Dive. 

“We still need a vision that looks out several years so the business understands where technology is headed and how it supports our growth strategy,” Grinnell said. “What has changed is the way we build flexibility into those plans.”

This year, shorter IT planning cycles have become more important, as more companies have made the jump from learning about generative AI to actually adopting it, said Tony Dinola, technology modernization principal at Grant Thornton, reflecting on the firm’s clientele. AI aligns with a deployment strategy based on use cases, so companies can deploy the technology for one scenario, evaluate it and then iterate. 

This shift doesn’t mean companies are forgoing enterprise technologies that cannot be fully deployed in the short term. Investments in AI application software, a category that encompasses CRM and ERP, will soar to nearly $270 billion next year, according to Gartner.

Such tools can be implemented in a modularized way that focuses on narrowing the project scope and measuring value in quicker deployments, Dinola said, which lets companies pivot if short-term value targets are not being met. 

“If you're not getting end-user adoption, or the technology is not driving the value that is anticipated, [you have] the ability to recognize that faster and shift gears if and when needed,” Dinola told CIO Dive.  

TD Synnex uses frameworks that allow space to pivot, instead of roadmaps that don’t, to achieve flexibility, Grinnell said. Long-term vision provides foundation and direction, while shorter and interactive planning horizons layered on top allows the organization to stay agile.

The frameworks are “living documents that can adjust” alongside the market, customers and staff, she said. Another way to create flexibility is to define success in terms of outcomes rather than attach desired results to specific tools. Locking a strategy into a specific tool can hamper the ability to use new capabilities as they emerge. 

Any flexibility tactic, however, is dependent on the organization’s talent and culture, Grinnell said. 

“When teams are curious,” Grinnell said, “when they’re encouraged to learn, experiment, and adapt, the whole organization becomes more resilient and ready to take advantage of new opportunities.”

A faster future

AI is expected to continue developing at an exponential rate, with UN Trade and Development projecting the global market will increase 25-fold between 2023 and 2033. Planning cycles and deployments are likely to speed up, too – especially, Dinola said, if new technology makes testing, validation, and other steps quicker. 

For IT leaders, the key to keeping up is to continue modernizing the department’s role in the organization. 

Over the past decade, CIOs have transformed their roles from back-office technician to key business partner. AI, in particular, has elevated some tech chiefs’ responsibilities to the board level, as technological literacy becomes a must-have.  

“Frankly, from a CIO's perspective, you really need a seat at the table,” said Dinola, adding that Grant Thornton still sees structures in which CIOs aren't top-tier executives. “It's going to continue to be critical that they're involved in those discussions and decision making.”

The concept of IT leaders as partners also enables flexibility. Communicating across departments is an essential part of change management. 

“Flexibility doesn’t mean a free-for-all,” Grinnell said, as fast-paced planning and deployment still need to align with businesswide principles and priorities, as well as security measures. Having the right people and culture in place is also critical. 

“Every IT leader is a business leader,” Grinnell said. “And when this happens, IT planning moves at the pace of business.”

Most CIOs welcomed generative AI as more than just a visitor in the enterprise IT workshop. Like it or not, the technology rapidly spread across cloud platforms, into software bundles and onto PCs, popping up in chatbots, copilots and, most recently, newly minted agentic tools.

“We are using AI all over the place,” Amanda Luther, managing director and partner at Boston Consulting Group, said during a CIO Dive virtual event in March 2025. “We've created these different tools, and now we're trying to bring that together into the overall workflow for a typical person on one of our teams.”

KPMG is leveraging the technology, too. The professional services firm is keeping a close eye on where and how generative AI is yielding the biggest efficiency gains, Htike Htike Kyaw Soe, managing director at KPMG U.S., said during the event.

“We're integrating it into the overall process of how we think about how we build and how we do the work, as well,” Kyaw Soe said. “We’re also taking a hard look internally at where could be the pockets of value.”

Generative AI remains deceptively difficult to scale safely and profitably. It’s a technology so approachable it speaks the same language as its users. Yet harnessing the expansive vocabulary of a large language model for enterprise use cases has been tricky.

Companies have struggled to implement strategic adoption plans even as the great majority plow forward with short-term, tactical deployments, according to Pluralsight. As vendors roll out generative AI-powered autonomous agents, data security and privacy concerns continue to fester among IT leaders, a February 2025 SnapLogic survey found.

Despite ongoing upskilling efforts, AI talent woes persist, blocking the path to adoption.

IT consulting firms like BCG and KPMG are developing task-ready enterprise AI tools while they scale up internal usage.

Luther said roughly 80% of BCG’s employees are using generative AI weekly. The company used the technology to soup up its internal knowledge navigation tool and developed a content-creation application for internal presentations and reports, she said.

At BCG's campus in Austin, Texas, there’s a process in place to encourage further adoption. “Every month at our all-staff meeting, we have a GenAI moment,” Luther said. “We have somebody come up and talk about something that they did that month that made their lives easier.”

Failing forward

False starts and unsuccessful pilots have been a painful part of the generative AI adoption process. In 2024, the average organization abandoned nearly half of its AI pilots before they reached full production, according to a recent S&P Global Market Intelligence report.

While it may seem counterintuitive, CIOs should embrace the occasional misfire and focus their AI efforts on a few promising use cases.

“It's a trite thing to say, but celebrating failures on some of this matters,” Luther said.

Kyaw Soe concurred. “Sometimes when people hear the word failure, they freak out about it,” she said. “It’s OK to try some things out … Some things work and some things don’t.”

Companies that are meeting the scaling challenge have limited the number of active proof-of-concept trials, BCG found. Organizations focused on three or four problems they’re trying to solve with AI are two times more likely to succeed than companies with 10 or more pilots in process, Luther said.

“If 2023 was the year of POCs all over the place, I think 2024 was the year of trying to clean that up and actually focus on a few things that matter,” said Luther. “It's what you don’t do that matters.”

When an AI chatbot or assistant is ready to roll out, workforce buy-in is crucial and not to be taken for granted. CIOs should be cognizant of the learning curve inherent in a new technology.

Even the small things can be difficult initially, Kyaw Soe said.

“What we're finding is that it's challenging for people to say, ‘OK, I see that you're giving me this opportunity, but I'm struggling to figure out what the first thing that I want to ask is.'”

Broader stakeholder sentiment can be a key lever to speed or slow adoption.

If a CFO is enthusiastic about AI use cases for accounts receivables, that can be a good place to get the momentum rolling. “Push on the open doors,” said Luther. “You're fighting an uphill battle if the end user at the most senior level isn't excited about what you can do.”

Sponsored content

By Rippling IT

If you’re a CIO in 2026, or aspiring to become one, unfortunately, your job isn’t getting easier. In CIO.com’s latest State of the CIO report, 54% of CIOs point to staff and skill shortages as the #1 challenge taking time away from innovative and strategic tasks. The added pressure of AI and a constantly expanding scope of responsibilities aren’t helping either.

So, how should you approach IT planning for 2026? Recent research from Rippling IT shows that 76% of IT professionals are spending more than a quarter of their workweek on admin work instead of strategic work. If this sounds familiar, then it may be time to audit your existing ecosystem to make sure you’re set up for success in 2026.

IT Planning for 2026

When talking to our customers as they prep for 2026, the priorities that we hear the most at Rippling IT are:

• How do we continue to modernize our IT stack to remove blockers to speed & innovation?
• How do we create a product-driven IT operation & employee experience?
• How can we improve governance + sustainability?
• AI is everywhere, how do we scale responsibly & securely?
• How do we create cyber resilience in an AI-powered threat world?

If you’re asking yourself these questions, then you’re not alone. In fact, 41% of CIOs and IT professionals say that they face weekly disruptions from disconnected systems that don’t communicate. The goal of a CIO has always been to create a connected environment that empowers employees, but as the pace of tool sprawl keeps accelerating, this task has become an almost insurmountable challenge.

And if you’re like other CIOs, you’re probably looking to offset some of that sprawl . The question is how to even begin approaching that in the face of all this noise. And the answer, simple as it may sound, is consolidation.

At the peak of the SaaS boom, CIOs were told to find the best tool for the problem that they were trying to solve. In doing so, we welcomed many of the problems we’re struggling to solve today: fragmented data, poor understanding of performance and according to recent data from Zylo, 53% of applications are going underutilized or unused altogether.

So, what should next steps look like?

This is where the intersection of governance, compliance and technology meet, in what can sometimes be a really messy and inefficient process. Due to tool sprawl, it can be hard to get a true understanding of employee performance, the costs associated with poor onboarding and offboarding and the ROI from your overall technology investments. This is where having the right platform can help you reduce process inefficiencies and free up resources to focus on more strategic and innovative tasks.

To find the right platform for your needs, you should conduct an audit of your existing IT infrastructure to identify gaps, redundancies and areas you could consolidate to a single vendor.

The steps you should take to audit and inventory are to list out:

1. Current IT management tools: monitoring, MDM/EMM/UEM, RMM, configuration management, etc.
2. Existing service management systems: ITSM workflows, ticket volumes, SLAs
3. Identity and access systems: directories, IAM, SSO
4. Hardware assets: servers, desktops, laptops, mobile, IoT
5. Software assets: software-as-a-service (SaaS), licensed apps, legacy/custom apps
6. Security controls: endpoint, network, detection, & response
7. Cloud usage: infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), containers

IT management software evaluation checklist for CIO’s

As you consider the future of your IT stack, our solutions consultants at Rippling IT have put together this checklist to help you evaluate IT software vendors to ensure they fit the needs of your business.

Platform & Consolidation

• Unifies device mgmt, identity, access, apps, ticketing
• Reduces tool sprawl
• Provides centralized admin & reporting

Identity & Access

• Automates provisioning/deprovisioning
• Integrates with HR data as system of record
• Enforces least privilege & Zero Trust policies

Device & Endpoint Management

• Cross-platform MDM
• Automated policy enforcement
• Zero-touch deployment

Inventory

• Show device assignments
• Report on devices by location
• Secure data destruction and device buybacks

Security & Compliance

• Combines identity + device + access posture
• Real-time compliance monitoring
• Automated audit reporting

Automation

• Low-code/no-code workflow builder
• End-to-end lifecycle automation

Visibility & Analytics

• Unified data for insights
• Device/app/access visibility
• Real-time dashboards

Integrations

• Native connectors to HR, apps, security tools
• APIs + workflow triggers
• Custom SAML + SCIM support

Scalability

• Supports growth & reorgs
• Global-ready rulesets
• Multi-entity support

Cost & ROI

• Reduces tool count
• Demonstrates measurable automation ROI
• Low operational overhead

Customization

• Custom data fields synchronization
• Granular permissions and administration roles
• Flexible and deep reporting

Enterprises have big plans for AI agents in the year ahead despite looming concerns over security and governance, according to Tray.ai research. 

More than 2 in 5 enterprises plan to build more than 100 AI agent prototypes, the survey of more than 1,000 U.S.-based enterprise tech pros found. Most organizations intend to spend at least $500,000 per year on the initiative.  

Businesses are aiming implementation efforts mostly at the IT service desk, data processing and analytics and code development and testing. Other priorities include cost reduction and increased automation.

While CIOs are still learning how to best navigate the generative AI wave, another emerging technology is creeping up: agentic AI. 

Unlike current tools that require prompts, AI agents can decide next steps autonomously, such as checking calendars for availability without being explicitly asked to do so before coordinating a meeting time. 

Most tech pros anticipate agents will become core to operations over the next 12 months, powering more than 25% of processes by year-end, according to the Tray.ai survey. 

While vendors are stepping in to provide enterprises with a path to implementation, most CIOs and analysts say organizations are not yet prepared for autonomous tools.

Similarly to generative AI, enterprises have high expectations for the technology and readiness gaps loom large. Nearly 9 in 10 IT pros say their organization’s tech stack needs upgrading in order to deploy AI agents, the survey found. 

The introduction of agents will also require CIOs to strengthen AI governance and security, a process already underway at many organizations.

Enterprise cloud strategy matured last year as organizations scrutinized IT spending and invested in technologies to support generative AI adoption. 

Despite the shift, mixed signals abounded, according to Flexera’s 14th annual State of the Cloud report, which drew on a survey of more than 750 IT professionals and executive leaders conducted by the software company in late 2024.

A move to repatriate select workloads gained momentum alongside growing enterprise appetite for hyperscaler services. Cloud budgets swelled, while the spread of FinOps cloud costs management practices helped organizations trim away wasted spend and identify applications ripe for repatriation, Flexera found.

One-third of participating organizations budgeted $12 million or more a year for public cloud, up four percentage points year over year. Optimization levels rose, too. Respondents estimate that 27% of their cloud spend in infrastructure and platform services is wasted, compared to 32% four years ago.

Optimization went hand-in-hand with repatriation, as respondents reported moving more than one-fifth of cloud workloads back on-premises. The year 2025 marked the first time in the survey's history respondents were asked about repatriation.

“Going back five or six years, folks were talking about repatriation, but no one was doing it — it just wasn't a thing,” Brian Adler, senior director of cloud market strategy at Flexera, told CIO Dive. “As folks get more experience, they start to realize what is and is not appropriate for cloud.”

FinOps expands 

FinOps is one of the drivers behind the trend. IT leaders are simply getting smarter about how they leverage cloud, according to Jay Litkey, senior vice president of cloud and FinOps at Flexera and FinOps Foundation governing board member.

“They're getting very good at allocating costs and understanding the cost of workloads,” Litkey said. “FinOps is providing the data to make repatriation decisions.”

The cost optimization framework is gaining ground. The proportion of respondents from organizations with an active FinOps practice grew 8 percentage points year over year to 59%. Managing cloud spend was the top priority for 84% of respondents, surpassing cloud security by 7 percentage points.

FinOps principles are also spreading beyond cloud to attack software, data center and AI spending.

The FinOps Foundation found that nearly two-thirds of organizations are targeting SaaS spend, and roughly the same number have AI costs across cloud and on-prem ecosystems on their FinOps radar. The industry group surveyed more than 800 companies for its 5th annual report published in February 2025.

AI adoption is driving broad changes across enterprise technologies. Flexera tracked a surge in data warehouse services, which topped the list of public cloud services leveraged by enterprises. More than three-quarters of respondents reported leveraging cloud for data warehousing, up from 67% in 2024.

A 2025 Apptio report found that many organizations plan to divert budget to AI initiatives from other IT spending buckets.

Flexera identified a spike in cloud-based AI usage, too. 

In 2025, nearly three-quarters of respondents said their organization uses public cloud generative AI services, up from fewer than half in 2024. Most will be looking to manage that spend in the coming year.

“Some of the AI is in the cloud, some of it is through SaaS browsers, and some of it is in the data center,” Litkey said. “As execs get wind of the spend and the distraction level, they’re going to ask more questions about the business value of what feels like an endless supply of science projects.”

As Gen Z employees take up a larger share of jobs and older workers retire at later ages, onboarding is a challenge for technology chiefs. Generational differences can result in varying levels of comfort with technology, with AI often acting as an accelerator.

CIOs are looking to help all workers adapt to new tools, resorting to the use of buddies and coaches and maintaining a diverse set of training modules — both virtual, in person or a combination of the two. 

The goal is to help workers benefit from the strengths of their counterparts, regardless of age. 

Cybersecurity assessment firm Schellman learned some lessons on technology adoption while upgrading its case management system from older software developed more than seven years ago. The company swapped out a legacy “walled garden” list-based system with a more flexible platform-based architecture. The upgrade meant bridging workforce generation gaps.

Younger workers who can seamlessly switch between different technology platforms in their personal lives may be more comfortable with an ecosystem-based approach where multiple software tools connect with one another. They may grow frustrated using an older system they deem too restrictive. 

By contrast, older workers accustomed to having all the information in one place may struggle to use a platform that requires them to navigate across several tools laid out in a non-linear way, said Schellman CIO Christopher Kouzios.

“Younger workers might say ‘Can you add more features?’" said Kouzios. “Folks who are used to the older platform might say ‘Why is there stuff all over the place? I had a routine, and my routine has now changed.'”

Resistance to change

Xavier Rebeuf, chief product and technology officer at Paris-based banking software firm SBS, said the company wants all its developers to use technology to carry out API tests. Adoption has lagged for some workers over the age of 40 who are accustomed to delegating manual testing tasks, he said.

SBS uses two types of technology to conduct tests, including open source tool k6, and a generative AI testing tool, Rebeuf said.

Some older workers “only want only to specify the test and to delegate it to someone else to execute, which is not the pattern we want to use right now,” said Rebeuf. “There's a learning curve for sure to understand how to code that” using k6, according to Rebeuf. Older workers have also voiced trust concerns related to the generative AI testing tool.

Other firms also report that older workers may be more wary of AI and consequently are less likely to adopt it compared to their younger counterparts. For example, software company Pegasystems recently rolled out a contract summarization AI tool.  Experienced employees accustomed to researching contracts without assistance gave the tool a lukewarm reception.

“They're just used to doing things a certain way. Maybe it's doing all the research on their own, summarizing it, and then making decisions,” said Pegasystems CIO David Vidoni. “They're warming up to it, but I think it comes with just not trusting [it].”

Training older workers on new technologies is especially important because fluid learning abilities — which allow people to pick up new skills without prior context — can decline with age, said Stefan Tams, a professor at the department of information technologies at HEC Montréal. 

The advantage older workers have over their younger colleagues, however, is more crystallized intelligence, or skills and knowledge acquired through experience, Tams said. Both should be valued as companies approach learning and technology adoption strategies for employees, he said.

Reverse mentoring

Companies have devised a few learning approaches to encourage tech adoption across age categories. One way is through a "buddy" system, where older workers are paired with younger ones. 

This approach lets older workers benefit from younger colleagues’ fluency with technical tools, while younger workers can gain from older colleagues’ experience as they seek to gain more value from workplace tools, said Kouzios.

Schellman offers technology training modules that combine in-person and virtual instruction, given that older workers tend to prefer traditional classroom instruction while their younger counterparts may be more willing to use virtual self-service tools. 

In addition, the company pairs onboarded employees with workers familiar with important technologies, said Kouzios.

“The gap bridge is Gen X,” he said, noting that many buddy volunteers are either Gen X or are older millennials — workers who may be equally comfortable working with new and legacy systems.

Similarly, SBS has introduced a system where younger worker technology “champions” assist older colleagues, particularly on increasing adoption of AI-based testing. Rebeuf said the buddy system is helping older workers trust the technology and driving up adoption.

“[The] automatic test case using AI is increasing," he said. "Little by little, people start to trust the tool. We all know that perhaps people feel in danger regarding generative AI, so it gives the confidence that, at the end, what we are looking for is to accelerate our development.”

Employers should increasingly lean on “reverse mentoring” — instances where younger workers help their older colleagues — to help workforces adjust to technological change, argues Christina Janzer, Slack’s SVP of research and analytics, who also oversees an internal research unit called Workforce Lab. 

In September, the Workforce Lab published a study of 5,000 full-time desk workers and uncovered distinct AI personas employers need to understand as they implement AI in the workplace. Among the personas, four out of five maximalists — those who frequently use AI and encourage others to use it — were under age 44. 

Meanwhile, the polar opposite of that persona, called the rebel — most of whom don’t use AI at work and feel it’s a threat to society — skewed older, with more than half aged 45 or older. 

“There's an opportunity and an expectation that Gen Z is going to help the rest of the workforce," said Janzer. "Let’s give Gen Z the opportunity to reverse mentor and help the older generation."

Most businesses gained ground on their AI goals last year, but returns on AI investments were harder to come by, according to IBM-commissioned research. 

Less than half — 47% — of IT leaders said their AI projects were profitable in 2024, the survey of more than 2,400 IT decision-makers found. One-third said they broke even, and 14% recorded losses.

Most businesses that have yet to reach ROI expect cost savings to occur within three years. Around 44% anticipate turning the corner sooner, within the next two years. 

Generative AI got a bad reputation in 2024 for its elusive returns, which ultimately clouded the technology’s initial hype and spurred enterprise disillusionment. Most organizations pivoted from a wide-eyed adoption sprint to a more deliberate pace, eyeing costs and prioritizing high-value use cases.

Along the way, organizations have also changed the way they gauge return on investment.

Quicker software development, faster innovation and time saved were the most important metrics IT leaders used to calculate AI investments ROI, according to IBM’s report. Far fewer leaders are focused on quantifiable savings.

While technology leaders expect AI projects to bring cost savings in the long term, the price tag associated with the tech stack is already rising. Nearly 4 in 5 U.S. organizations experienced software price hikes last year, according to a July Forrester report. Most technology leaders blame AI and expect the technology to raise software costs again this year. 

Countless analysts rang the alarm on the risk of ballooning AI costs last year. Gartner said enterprises could be miscalculating AI costs by as much as 1,000% as they scale deployments.

Tech executives are working to manage the cost creep by increasing audits, leveraging their purchasing power and turning to open-source alternatives when appropriate, Forrester said, though contract complexities and predicting future needs present additional challenges. 

Governing generative AI initiatives was overwhelming for organizations in 2024. Enthusiasm has waned and skepticism has increased as enterprises forge on. The most common place for Fortune 500 companies to mention AI in SEC filings is in the risk factor section, according to an Arize AI report published in August. 

CIOs enter the new year facing even more pressure to achieve positive ROI on AI initiatives. In response, vendors are marketing applicable use cases tied to new updates and innovations to accelerate adoption.

Younger job seekers are more concerned than their older counterparts about AI’s effect on their skill sets and education, according to an Indeed report published in April 2025. The job site commissioned a Harris Poll survey of 772 U.S. adult workers and job seekers with an associate’s degree or higher for the report.

Businesses show no signs of slowing AI adoption, and already almost half of Gen Z job seekers say the technology’s adoption has made their college education irrelevant, compared with about one-third of Millennials. About one in five Gen Z and baby boomer survey takers say the same of their college education.

The ongoing push to deemphasize college degree requirements in job postings has led half of Gen Z job seekers to view their degrees as a waste of time and money, according to the report.  

The deluge of AI adoption in the workplace has influenced in-demand roles, salary trends and even the C-suite’s purview. The effect is far from over, with younger generations grappling with the potential for additional disruptions ahead.

Every job currently posted on Indeed's job board will likely experience some level of exposure to generative AI and the changes it represents, according to Indeed Senior Talent Strategy Advisor Linsey Fagan.

"For any organization to succeed with AI, every single employee needs to have a basic understanding of AI and how their company uses it," Fagan said in an email to CIO Dive. "Leaders play a crucial role in this shift by assessing their teams, listening to individual needs and supporting their development."

One way CIOs have responded to the wave of change is by creating upskilling programs. Technology vendors, eager to remove the obstacles toward enterprise adoption, have also deployed training programs open to the general public.

Online learning and training platform O'Reilly found skyrocketing demand for AI-specific training in 2024, according to a January 2025 report. The number of professionals seeking training on AI principles more than quadrupled, the firm said.

“To truly unlock the potential of AI, organizations must invest in their people, offering training, hands-on experiences and opportunities to explore new tools in a supportive environment,” Fagan said. “Organizations need employees to be motivated to try these tools and want to apply them in their day to day.”

Enterprises have a lot to consider before launching AI projects, from which use case to pursue to which guardrails to implement. Behind every good idea lies a battery of legal implications, requiring CIOs to tread carefully. 

Compliance with the various laws and regulations on AI in different countries, states, and jurisdictions is not an easy feat. Trying to future-proof projects only adds to the complexity. 

“You’ve suddenly got to this point where all these different nuances need to be captured within governance programs, which is really hard,” Martha Hirst, associate in Debevoise and Plimpton’s data strategy and security team as well as the white collar and regulatory defense group, said during an April 2025 panel at IAPP’s Global Privacy Summit. 

Businesses should aim to create processes and governance that rein in AI’s risks while enabling innovation, panelists said during the event. 

Here are four questions with legal implications that CIOs should consider when planning and moving forward with AI projects:

1. Is the AI use case high risk?

AI use cases are typically considered high risk if they involve critical infrastructure, employment opportunity or biometrics. Businesses may already have these types of use cases without realizing it, such as within HR functions. 

“Companies are struggling to be able to use their traditional recruiting processes,” Cynthia Bilbrough, global head HR privacy, digital, and risk at GSK, said during the April 2025 event, referring to a spike in applications across open roles. 

Enterprises could be breaking laws if leaders use AI to filter through applications. AI-produced results can contain bias, which could make businesses noncompliant with existing anti-discrimination laws, for example. 

Enterprises will need to take extra precautions should leaders plan to move forward with high-risk use cases. Decision-makers should also become familiar with laws that require guardrails on automated decision-making to avoid fines and other repercussions. 

2. In what jurisdiction will this tool be used?

Ensuring compliance with existing rules and regulations requires businesses to know exactly where an AI tool is being used. Laws vary across jurisdictions. 

“There's already 140 privacy laws,” Christina Montgomery, vice president and chief privacy and responsible technology officer at IBM, said at the event. “We’ve got the EU AI Act. We’ve got every jurisdiction pretty much out there regulating AI at this point.”

Some organizations are navigating the diverging regulatory approaches by aiming for compliance with the highest standards.

“A siloed approach … just doesn’t cut it anymore,” Stephanie Westfield, senior privacy counsel at Ford Motor Company, said during a panel at the event. “Now is the time to think about how you align with a global approach and find the highest watermark.”

3. How is data used — and where does it come from?

Quality data makes AI better. But organizations have varying levels of comfort as to what they want their AI systems to be trained on and what employees are allowed to put in.

Brigette Guyer, global data protection, privacy and risk officer at The Wendy’s Company, said every project goes through a risk review process before kicking off. As part of the initial assessment, teams consider using real data versus using synthetic data, according to Guyer. 

Synthetic data doesn’t contain actual personally identifiable information, putting organizations closer to compliance with privacy laws such as the European Union’s General Data Protection Regulation. If done correctly, using synthetic data could also reduce historical biases found in real-world data sets. 

Businesses can also benefit from data-mapping exercises. 

“Be organized,” Amber Cordova, AI, privacy and cybersecurity counsel at Vistra Corp., said in a panel discussion at the April 2025 event. “Data mapping is something nobody wants to do, and yet is so important and worth putting resources into.”

4. Build or buy?

The need to manage third-party risk cannot be overstated, according to several experts speaking at the IAPP event. 

Technology leaders should understand how third-party organizations plan to use information entered into their systems and what guardrails are in place to limit bias, reduce risks and promote responsible practices.

Often, organizations want to take risk management a step further than what’s already within boilerplate contracts, such as copyright indemnification, which is offered to some extent by leading providers. 

Panelists talked about contractually requiring additional information from vendors and protection against potential AI mishaps. CIOs can lean on their privacy counterparts during negotiations to suss out avoidable risks.