Framework for AI strategy
RISE is my four-phase framework for AI strategy: Research, Implement, Sustain, and Evaluate. It settles why and what before anyone buys a tool, ties every AI use case to a business outcome and a metric, and decides how much autonomy each use case earns before an agent acts on its own. It runs as one program with CARE, my framework for AI security and governance.
Research turns a list of ideas into a ranked portfolio. Every use case gets a hypothesis, a baseline, a target metric, a sponsor, and a value-versus-feasibility score. Twelve ideas become two funded bets and ten parked ones, with the reasons written down.
Every use case carries an autonomy tier, from T1 copilots to T4 multi-agent systems. Anything above T1 needs a least-agency justification: why autonomous action beats assisted work, and which tools and permissions were taken away because the job doesn't need them.
RISE doesn't write governance policy. Research hands the risk appetite, the accountable executive, and the least-agency justifications to CARE, which writes the policies. Implement then checks that the required CARE controls are live before any agent goes live.
Evaluate reports return in three lenses, economic, intangible, and capability, and nets the cost of autonomy against the gain. Every use case ends the cycle with one of three decisions: hold, raise maturity, or lower the tier.
RISE has four phases, ten categories, and fifty activities. Each phase pairs with a CARE phase in the same position on the cycle, so strategy and governance move on the same clock.
Decide what AI is for before choosing tools.
A ranked list of use cases, each with an autonomy tier, plus the inputs CARE needs to write policy: risk appetite, permitted tiers, an accountable executive, and a least-agency justification for every agent.
Turn that list into running systems in stages, confirm governance is in place before an agent gets more autonomy, and make sure decision makers can make those calls.
Use cases in production at their approved tier, on a roadmap staged by autonomy level with an exit metric and a rollback trigger for every stage.
Keep running systems tied to business results, and treat CARE's monitoring and audit findings as input to the strategy.
Scope and tier decisions made on evidence, tracked with agent KPIs: task success rate, blocked actions, approval override rate, and cost per completed task.
Measure what came back as economic, intangible, and capability return, decide whether to hold, raise maturity, or lower the tier, and feed that into the next Research cycle.
A decision record for every use case and the portfolio for the next cycle.
RISE doesn't bolt on a separate track for agents. It adds one decision to every use case, the autonomy tier, and weaves agent questions into the activities that already exist. RISE and CARE share the same four tier definitions word for word, so a strategy workshop and a governance assessment describe the same system the same way.
RISE decides what your organization will do with AI and how much autonomy it grants. CARE, my framework for AI security and governance, decides how those systems get governed and secured. They run as one cycle, and each phase hands something specific to its partner.
Research pairs with Create
Research hands over the risk appetite with permitted tiers, the accountable executive, and the use-case portfolio. Create writes the policies and returns the tier gates the portfolio has to clear.
Implement pairs with Adapt
Implement hands over the staged roadmap, the tool and platform choices, and the approval design. Adapt fits the program to what Create learned and returns whether each tier is cleared, conditional, or not cleared.
Sustain pairs with Run
Sustain hands over the KPI thresholds that trigger a review and the autonomy expansions planned next. Run returns audit results, runtime indicators, and incident summaries.
Evaluate pairs with Evolve
Evaluate hands over the realized-value record and any proposed tier changes. Evolve returns the management review decision on which tiers stay open.
The shared rule: when a use case needs a tier your organization hasn't cleared, you have two moves. Raise maturity or lower the tier.
Most AI initiatives don't fail because the model was wrong. They fail because nobody decided what the model was for, and agents raise the stakes because they act on the answer.
I run RISE as a one-day or two-half-day executive workshop. You leave with working artifacts, not a slide deck.
Tell me what you're trying to decide, and I'll tell you whether a RISE workshop is the right place to start.
