Enterprise AI conceptual framework

When discussing “becoming AI first” in any company it is often not clear what exactly is meant. Do you want to speed up your developers, knowledge workers in general or automate your business? And what does AI even mean in this context?

AI flavors #

Roughly there are three flavors of AI:

• Symbolic and rule-based AI: rules engines with hard business rules (e.g. expert systems, fraud workflows, credit approval). Often dismissed as “GOFAI” (Good Old Fashioned AI), these systems are still highly relevant, as they frequently act as deterministic guardrails around probabilistic models. Ontologies and semantic models belong to this flavor too: instead of encoding what to do, they encode what business terms mean.
• Predictive ML: pattern recognition and estimation systems (e.g. churn prediction, demand forecasting, recommendation systems). By now known as “classic ML”.
• Generative AI: unstructured reasoning and generation (e.g. code generation, text synthesis, multimodal analysis, image generation). Probably what most people refer to when they say “AI” today.

Combinations #

Combining symbolic AI with neural approaches, including generative AI, is called neuro-symbolic AI. The neural side brings language and ideas; the symbolic side constrains and validates the output against explicit rules. This reduces hallucinations and makes the result verifiable.

Combining predictive ML and generative AI makes it possible to predict what is likely to happen and to determine how to respond. For instance, a churn model flags the at-risk accounts and a generative agent drafts the retention outreach.

AI applications #

Besides understanding what AI is, it is important to know in what areas AI can be applied.

I currently differentiate these five areas:

Dev acceleration is furthest from the business. It is all about accelerating the software development lifecycle. A lot of the experience gained in this area translates to other knowledge work.

Knowledge worker augmentation (area 2) and business process automation (area 3) are closely related, but mainly differ on autonomy and risk. Area 2 keeps a human in the loop (someone reviews the output before action is taken); area 3 is agentic (systems execute tasks end-to-end via APIs).

The difference in autonomy is also why the business owner shifts. In area 2 the tooling is provided centrally, but every individual stays accountable for their own output. In area 3 nobody reviews each run, so accountability moves to whoever owns the process itself. This results in IT providing the runtime and the business owning the outcome.

Product & service differentiation (area 4) is where the customer interacts directly with your AI. It is the only area where the output is not for internal efficiency gain, but instead is a product feature. This area has a similar autonomy level to area 3, but now when it goes wrong, it is the customer who sees it. Public AI mistakes can cost reputational damage, regulatory complaints and, ultimately, lost customers. This is why it needs the tightest guardrails of all five areas: retrieval limited to approved content, hard rules on what the agent may commit to, and a fast escalation path to a human.

The regulatory burden increases in the same way. Area 1 barely touches it. From area 2 onwards you are processing personal data, so GDPR governs what the AI may retrieve, retain and expose. Areas 3 and 4 add the EU AI Act. Its transparency rules have applied since 2 August 2026, meaning that users of area 4’s systems must be told they are dealing with a machine. Systems that make or significantly influence decisions about people, such as creditworthiness, hiring or life and health insurance, count as high-risk. From 2 December 2027 (pushed back from August 2026) they will require documentation, human oversight and logging. Area 5 inherits all of it, because a data platform with access to every system means it can do the same as the other areas. None of this should block adoption, but it does inform the design of each AI solution.

This is where the flavors and the areas meet. Areas 1 and 2 are almost purely generative AI. Areas 3 and 4 are where neuro-symbolic introduces deterministic guardrails that make autonomy acceptable. Area 5 is where all three come together: generative AI to interpret the question, the semantic layer to define what the answer means, and predictive ML to estimate what happens next.

The areas also differ in what data they need access to:

• Area 1 works on source code and the documentation next to it.
• Area 2 needs access to documents: SharePoint, Confluence, mail, Slack, ticket systems.
• Areas 3 and 4 mainly use APIs so that the agent can act; area 4 adds a curated set of data it is allowed to expose to the customer.
• Area 5 uses the data platform (or platforms) and effectively has access to data from every system in the company. Structured, semi-structured and unstructured.

This means that the scope of data widens with each area, requiring more work to ensure the data is ready to be used by AI, while also increasing the potential of AI with every data source added.

AI, data and analytics #

Data & analytics acceleration has overlap with knowledge worker augmentation and business process automation, but approaches the same problems firmly from the data angle. It uses semantic models and ontologies so that the AI understands how the business domain works and can use data to solve business questions.

That knowledge layer is what makes conversational analytics (’talk with your data’) trustworthy. It teaches the AI what terms like “revenue” and “active customer” actually mean in your business. Not just the definition, but also how to find, join and interpret the underlying data across systems. Grounded that way, the AI is far less likely to hallucinate, and every answer traces back to an explicit definition, so results can be audited and reproduced.

Combining generative AI with data is extremely powerful. A natural language interface opens data analytics to any user who can ask a clear question and think critically about the answer. It also creates a path to something larger: steadily building a continuously evolving map of the business domain, a digital twin. Process models connected to event data give you a live model of how the company actually operates, accurate enough to ask questions of and to simulate against.

When I look beyond the obvious daily business impact of data & analytics acceleration, I can also see how this capability will open the doors to completely rethinking how business is done. It can for instance enable AI-driven business process re-engineering: mapping how the business operates, surfacing alternative process designs, training ML models to simulate them, guiding the re-engineering itself, and monitoring the results of the changes you implement.

So what does “AI first” mean? #

Going back to the opening question, it is clear that “becoming AI first” is not one thing. It needs attention in five areas, with different owners, different risks and very different timelines. The first step is not to pick a tool or vendor, but to agree which areas you want to accelerate, what fits your appetite in terms of risk and change management, who owns the outcome, and how you will know it is working.

In my experience companies often start with dev acceleration. The risk is low and it has the lowest barrier to entry: the data is code, so it is already well structured and readily accessible, and developers adopt the tooling on their own.

Knowledge worker augmentation usually follows quickly, and that is where progress tends to stall. It is the first area that needs access to the company’s own unstructured data, which raises questions about data sovereignty (do I want to send all of this to the AI provider?) and data security (are the access controls actually tight enough?).

Once a company is able to get past this point, moving to autonomous agents and AI-powered data and analytics becomes the next step.

This is where I will spend most of my time on this blog. In the next posts I will dig deeper into the knowledge layer, address the foundational work needed to organize data for AI (such as poor data quality), and explain how to start small while thinking big.