Most organizations start at implementation and work backwards under pressure. The order below costs less and survives contact with an audit.
Readiness
Current systems, data availability, security posture, staff capability, existing policy and technology maturity. An honest baseline.
Strategy
Where AI should be used, and just as importantly where it should not. Named use cases with expected value, not a wish list.
Workforce
AI literacy, prompting, role-specific applications, executive education and responsible use. The part almost everyone skips.
Workflows
Redesigning existing work around augmentation — research, draft, review, approval, distribution — rather than bolting a chatbot onto the old shape.
Governance
Permissions, security, usage standards, human review, data rules, model policy and auditability. Written before an incident, not after.
Implementation
The systems themselves, built against real workflows with the guardrails already agreed and the people already able to use them.