An AI operating model is the way your organization decides who owns AI, who can approve it, how it gets built or bought, how it is governed and how it is paid for. It is less a diagram than a set of answers to practical questions. For a small or mid-sized Australian business, the first step is not picking a framework. It is finding out how AI is already being used across your team today.
CalibreforumSee How AI Is Used Across Your TeamCalibre Forum’s AI readiness assessment combines employee insights into a scored report and a 90-day action plan for your business.Explore the AI readiness assessmentTL;DR
- An AI operating model joins people, decision rights, delivery, data, technology and governance so AI is used on purpose, not by accident.
- There are five common archetypes, from siloed to embedded. Dataiku’s overview says none is best, and the right one depends on readiness, data maturity, governance needs and your technology stack.
- In Australia, the AICD says a senior executive should be accountable for AI governance. In smaller organizations that can be the CEO.
- A target operating model is the future-state version. You cannot design it well without an honest picture of the current state.
- Start small: pick the highest-risk or highest-value uses first, assign owners, and review on a fixed rhythm.
Table of Contents
- What an AI operating model actually is
- The components of an AI operating model
- The five common archetypes
- What a target operating model adds
- Roles and accountability in an Australian business
- How to build and measure one in 90 days
- Perspective
- Get a clear current-state picture first
- FAQ
- Sources
What an AI operating model actually is
Every business already has an operating model: how work gets done, by whom, with which tools and under which rules. An AI operating model is the part of that which covers AI. It answers a handful of questions:
- Who decides which AI tools and use cases are allowed?
- Who is accountable when an AI-assisted decision goes wrong?
- Where does the money for AI come from, and who tracks it?
- How do staff get the skills to use AI well?
- How do data, tools and vendors connect to the work?
The pages that rank for this topic are mostly written for large enterprises, with central teams, chief AI officers and platform programs. The ideas still apply to a 30-person accounting firm or a 200-person manufacturer. The difference is scale: one person may hold three roles, and a one-page policy may stand in for a governance committee.
Operating model versus strategy versus policy
These three get mixed up, and the confusion causes real stalls.
| Layer | Question it answers | Typical form |
|---|---|---|
| AI strategy | Why are we using AI and where do we expect value? | A short list of priorities tied to business goals |
| AI operating model | Who does what, decides what and funds what? | Roles, decision rights, workflows, governance cadence |
| AI policy | What is allowed and what is not? | Acceptable use rules, data handling rules |
Strategy without an operating model stays a slide. Policy without an operating model gets ignored, because nobody owns it and nobody checks it.
The components of an AI operating model
Published frameworks slice this differently. One framework from VDF AI names six components: decision rights, ownership, funding, talent, governance and delivery. A Cogniver article lists seven connected elements: business alignment, people and roles, decision rights, delivery workflows, data, technology architecture and responsible-AI governance. It argues that designing any one of them in isolation leaves a gap.
The labels differ, but the same layers keep appearing. Here they are in plain terms for a smaller organization.
1. Business alignment
List the two or three outcomes AI should serve, such as faster quoting, fewer rework loops or quicker client reporting. Anything that does not connect to one of them is a candidate to pause. Our own view on where gains actually come from is in AI operational efficiency.
2. People and roles
Name an accountable owner, and name the people who use AI daily and who can tell you how it really works. Skills matter as much as roles: staff need to know what the tools can and cannot do with your data.
3. Decision rights
Decision rights say who may approve a new tool, who can accept a risk, who can pause a use case. VDF AI’s framework notes that the right to stop an AI system is the decision right most often missing. Write it down: “Any manager can pause an AI use case that touches client data, and the owner reviews within a week.”
4. Delivery workflows
This is how an idea moves from a request to a tested, monitored use. Even a small team benefits from a simple path: request, quick risk check, trial with a small group, decision, review. If your team builds or maintains software, it helps to see how a mature engineering team handles the full cycle, from developer team workflows through incident review, and borrow the parts that fit.
5. Data
AI is only as safe as the data that goes into it. Know what data staff paste into tools, where it is stored and who can see it. Our guide to AI data governance covers the practical steps.
6. Technology and vendors
Most businesses buy AI rather than build it, so vendor choices are operating-model choices. Keep an inventory of tools, who uses them and what each can access. See our one-page AI vendor risk checklist and the notes on AI access control.
7. Governance and risk
Governance is the rhythm that keeps the rest honest: a regular review, a risk register, an escalation route. It connects to security, privacy and model risk, which we cover in AI model risk management and AI risk mitigation.
Funding
Funding is easy to forget. The VDF AI framework reports that 51% of CIOs in a Gartner survey expected AI to raise the total cost of ownership of technology, and advises governing AI costs across the whole life cycle, not just at purchase. For a smaller business, that means someone owns the subscription list and checks it quarterly.
The five common archetypes
Larger organizations usually pick one of five patterns. The Dataiku article on AI operating models describes them and when each fits.
| Archetype | How it works | When it fits |
|---|---|---|
| Siloed | Teams experiment on their own | You are just starting and need to learn fast with little coordination |
| Center of excellence | A central team leads AI and supports others | You have early wins and need to spread adoption, especially when AI talent is scarce |
| Hub and spoke | A central hub sets standards, and business units build with embedded people | The center has matured and the bottleneck is now capacity, not capability |
| Center for acceleration | AI building is spread across the spokes | Business units are ready to build more themselves |
| Embedded | Each function owns AI development end to end | AI fluency is high across the business and you want maximum agility |
What this means for a smaller business
Most Australian small and mid-sized businesses sit in the first two columns, whatever they call it. Staff adopt tools on their own (siloed), and one person, often the owner or an IT lead, tries to set some order (a one-person center of excellence). That is a reasonable place to start. The risk is not the archetype. It is that nobody can see what is happening across the business.
A workable path looks like this:
- Map first. Find out which tools are used, by whom and for what.
- Centralize the rules, not the work. One owner sets acceptable use, approves tools and keeps the inventory.
- Let teams keep their use cases. Those closest to the work often know best where AI helps.
- Move toward hub and spoke only when capacity, not clarity, is the bottleneck.
There is no universal winner. Dataiku itself says the right choice depends on people’s readiness, data maturity, governance needs and the technology stack.
What a target operating model adds
A target operating model (TOM) is the same idea pointed at the future. It describes how you intend to run AI at a set point ahead, perhaps 12 to 24 months out, across the same layers: roles, decision rights, workflows, data, technology and governance.
The gap between current and target is your roadmap. That is why the current state matters so much. Many AI TOM efforts stall because they begin with an ideal structure and skip the question of what people are doing now. Staff may be using five different assistants, pasting client details into some of them, and no one in management knows.
A useful TOM for a smaller business fits on two pages:
- Current state: tools in use, owners, data touched, known gaps.
- Target state in 12 months: named accountable executive, approved tool list, review rhythm, training plan.
- The steps between: a 90-day plan, then a quarterly update.
If you want a way to rate where you stand on each layer, our AI maturity model guide explains levels and scoring.
Roles and accountability in an Australian business
Australian guidance is clear on one thing: someone senior must be accountable.
The AICD’s Director’s Guide to AI Governance says that at a minimum, most large organizations should have a senior executive accountable for AI governance. In smaller organizations the CEO may take the role. In larger ones it may be a standalone role, such as a Chief AI Officer or Chief Data Officer, or it may be shared across the CTO, CIO and other senior roles. The same guide says boards should understand how AI, cyber security and data governance risk controls intersect, and that external vendors are central to most AI systems.
The National AI Centre’s implementation guidance says organizations should assign, document and clearly communicate who is accountable for the operation of their AI management system. That includes policies, development and deployment of each AI system, oversight of third-party AI, testing, redress and continual improvement. The guidance also says you do not need to do everything at once. Start with the areas that matter most for your current systems and risks.
If you are in financial services
Regulated entities face tighter expectations. On 30 April 2026, APRA wrote to banks, insurers and superannuation trustees calling for a step-change in AI risk management. As summarized by Regulation Tomorrow, it expects reporting lines, ownership across the AI lifecycle, an inventory of AI tools and use cases, human involvement in high-risk decisions and staff training. It also expects visibility over third-party and fourth-party dependencies. If you are regulated, take advice on your obligations from your compliance lead or a qualified professional. For everyone else, the same list is a sound checklist for a first operating model.
How to build and measure one in 90 days
A first operating model does not need a year. A tight 90 days is enough to get structure in place.
Days 1 to 30: see what is really happening
- Survey staff, anonymously, on which AI tools they use, for what tasks and with what data. Anonymity gets honest answers.
- List every tool and subscription, including free accounts.
- Identify the three highest-risk uses, such as client data in a public chatbot.
The AI security assessment guide explains how to find shadow AI without turning it into a witch hunt.
Days 31 to 60: assign owners and set rules
- Name the accountable executive. In a small firm, that is probably the owner or managing director.
- Write a one-page acceptable use policy and an approved tool list.
- Set decision rights, including who can pause a use case.
- Apply access controls and basic security. Our AI security checklist is a starting point.
Days 61 to 90: put it on a rhythm
- Schedule a quarterly review of tools, risks, costs and incidents.
- Train staff on safe use, limitations and what not to paste into tools.
- Pick two or three use cases to improve, and set a simple measure for each.
What to measure
Keep the measures few and practical:
| Area | Example measure |
|---|---|
| Visibility | Share of tools in use that are on the approved list |
| Accountability | Every AI use case has a named owner |
| Risk | Number of high-risk uses with a documented control |
| Skills | Share of staff who completed safe-use training |
| Value | Time saved or rework reduced on chosen use cases |
| Cost | Total AI subscription spend against budget |
Track the same measures each quarter. The trend matters more than any single number.
Perspective
We see the same pattern in Australian and New Zealand businesses. Leadership assumes AI use is modest and controlled. Then the staff survey comes back, and it shows several tools, a handful of workflows nobody documented, and data going places nobody approved.
That is not a failure of staff. People reach for tools that make the work easier. It is a gap in visibility, and an operating model cannot be designed on a guess.
This is why we start by asking every employee, anonymously. When people are not worried about being singled out, they tell you what they actually do. We then combine the answers into one scored report and a 90-day plan, with no software to install and no individual data collected.
We think this is the right order of work: see the current state, then decide the target state. Our approach is designed to give owners, managers and IT leads a shared picture to build on.
Anthony
Get a clear current-state picture first
If you want the current-state map without running the survey yourself, our AI readiness assessment is built for this. Staff answer a structured anonymous survey, and you receive a scored report that maps capabilities, flags risks and sets out a tailored 90-day action plan. The report is A$1,990 one-off. If you want quarterly reassessments to track progress, the membership is A$2,388 per year.
You can see what is in the readiness report and how the process works from setup to report before you decide.
FAQ
What is an AI operating model?
It is how an organization arranges people, decision rights, processes, data, technology and governance so AI is used deliberately and safely. It covers who owns AI, who approves tools, how work flows and how risk is managed. It is separate from AI strategy, which says why you use AI, and from AI policy, which says what is allowed.
What is the difference between an AI operating model and an AI target operating model?
An operating model describes how AI is run now. A target operating model describes how you intend to run it at a set point in the future. The difference between the two becomes your roadmap, so an accurate current-state picture comes first.
What are the main types of AI operating model?
The five common archetypes are siloed, center of excellence, hub and spoke, center for acceleration and embedded. Each fits a different stage of maturity. Smaller businesses often begin siloed, then add one central owner who sets rules and keeps the inventory.
Who should be accountable for AI in a small Australian business?
The AICD says that in smaller organizations the CEO may take the senior accountability role. What matters is that one named executive holds it, that it is documented and that staff know who it is. Day-to-day tasks can then be shared with IT or operations leads.
How long does it take to put an AI operating model in place?
A basic version can be set up in about 90 days: map current use, assign owners and rules, then set a review rhythm. It then grows with your use of AI. The National AI Centre advises starting with the areas that matter most, rather than doing everything at once.
Sources
- AI operating models: 5 that scale enterprise success (Dataiku)
- AI Operating Model: Framework, Archetypes and Design Steps (VDF AI)
- AI Operating Model: Roles, Governance, Workflows (Cogniver)
- A Director’s Guide to AI Governance (AICD)
- Guidance for AI adoption: implementation guidance (National AI Centre)
- APRA calls for a step-change in AI-related risk management (Regulation Tomorrow)
- Developer Team Workflows: From First Ticket to Incident Review
Recommended
- AI Maturity Model: Levels, Scoring and How to Use One
- AI Operational Efficiency: Where Gains Come From
- AI Risk Mitigation: A Practical Guide for Australian Businesses
- AI Adoption Roadmap: A Practical Plan for Australian Businesses
General information only. Articles on this blog are written with the help of AI writing tools and published by Calibre Forum. They are not legal, insurance, tax or financial advice, so check anything important with a qualified adviser.