The account manager on your marketing team found an AI tool that halved her proposal drafting time. The operations director saw the result and asked whether the same approach would work for client onboarding. The finance lead mentioned invoice processing. Within six weeks you’re fielding three separate requests from different departments, each with a slightly different use case, each involving different data.
This is the scaling moment. The question is how to do it without creating three separate problems.
What does scaling AI across departments actually mean?
Scaling AI across departments means moving from a single contained pilot in one team to a repeatable model other parts of the business can follow safely. The UK Government’s AI Playbook frames this as scan, pilot, scale: test a use case, validate its value and controls, then replicate with governance rather than copying the tool without the safeguards. The gap between those two approaches is where firms lose ground.
For a small services firm, scaling usually involves three shifts. The first is from individual use to workflow integration, where AI becomes part of a team’s standard process rather than a personal shortcut one person happens to use. The second is from informal understanding to written standards, with a shared view of which data is allowed in which tool and who reviews the outputs. The third is from one team’s experience to shared learning, where what the pilot team found out about prompts, errors, and edge cases gets passed on rather than rediscovered.
The UK Government Playbook also notes that capability needs change across the project lifecycle and that teams often need to collaborate across internal functions and external stakeholders. For an owner-managed firm, that means involving someone from operations, IT, or compliance before the rollout starts, not after the first problem appears.
Why does the sequence matter more than the speed?
Fragmented adoption is how scaling most commonly goes wrong: each department adopts AI independently, with different data habits, different tool choices, and no shared controls. The ICO’s AI and data protection guidance requires firms to maintain a documented lawful basis, carry out data protection impact assessments where required, and ensure transparency about how personal data is used in AI systems. Skipping this in one department doesn’t remove the obligation.
The UK Government Playbook’s 10-principle framework addresses this directly. It calls for multidisciplinary teams that include people who can identify risks such as bias and discrimination, and stresses that capability needs change as the project grows. An early decision to standardise access, review, and escalation across departments costs far less than unpicking inconsistent implementations after the fact.
A firm that moves fast but separately ends up with one team that met its compliance obligations and three that didn’t know those obligations existed. The review steps, data permissions, and escalation routes that made the pilot work don’t transfer automatically. They transfer when someone writes them down, hands them to the next team lead, and confirms the team understands them before the tool goes live.
Going department by department without shared standards multiplies exposure rather than value.
Where does fragmented adoption break down?
The cracks appear first at the data layer. A firm might have a sensible prompt policy for its marketing team, preventing client names from going into a public-facing AI tool. When operations picks up the same tool independently, they bring client onboarding data with them, because nobody told them the policy existed. The NCSC’s AI security guidance notes that scaling AI to more teams widens the attack surface through more users, prompts, connectors and vendors.
The second failure point is review and escalation. In the pilot team, someone has been checking AI outputs before they leave the business. When the next department adopts, that review step often doesn’t transfer, because it wasn’t written down and wasn’t part of the handover. The FCA has flagged that generative AI in professional services creates risks around consumer harm, explainability and governance. The same logic applies in any context where AI-assisted output reaches a client.
The third failure point is supplier sprawl. When each department selects its own tool, the firm ends up with multiple AI vendors, multiple data terms, and multiple retention policies, with no single person who knows all of them. The ICO’s guidance on AI makes clear that firms are responsible for how personal data is handled across every tool in the stack, not just the tools IT formally approved.
Each failure point compounds the others, and the longer the firm waits to address them, the harder they become to unpick.
When should you extend to the next department, and when should you wait?
Extend when the pilot team can answer yes to four questions: has the use case produced a stable, measurable result over at least six weeks? Have the data permissions, review steps, and escalation routes been written down in a form another team can follow? Has the firm checked that the tool is appropriate for the data the next department would bring? And has someone in operations or compliance reviewed the plan before rollout?
Wait if the pilot team is still resolving edge cases, if there is no clear data owner for the next department’s work, or if basic cyber hygiene is not in place. The NCSC advises that security controls should be built in before rollout, not retrofitted afterwards. If the firm lacks access controls, logging, or supplier assurance processes, those gaps compound with each department added.
The EU AI Act, which took effect in 2024 and is being phased in through 2025 and 2026, creates documentation, transparency, and human oversight obligations for certain AI system types. These apply to UK firms serving EU clients or using EU-based deployment infrastructure. A firm that has been careful with one department may need to review its position when the next department handles EU client data or uses an EU-based supplier.
If management cannot enforce tool choice and data rules across the business, holding at one team until that governance authority is established is the more pragmatic option.
What else do you need to understand before you start?
Scaling AI across departments sits at the intersection of three other areas of the business: data governance, supplier management, and change management. Understanding how they connect before you start the second department rollout saves time and reduces the chance of a compliance gap appearing six months later. Each one demands a different kind of attention, and none of them belongs to IT alone.
Data governance starts with the ICO’s AI and data protection guidance, which sets out the requirements for lawful processing, data minimisation, security, and, where required, a data protection impact assessment before deploying AI in higher-risk contexts. For firms that have never written a formal data policy, the DPIA process is often the moment they first map what data flows where across the business. That mapping is valuable regardless of AI.
Supplier management means reviewing contracts, data retention terms, and subprocessor arrangements for each new tool before the next department goes live. The NCSC’s AI security collection covers supplier assurance as part of secure AI deployment and is a practical starting point for small firms without a dedicated procurement function.
Change management is where rollouts most commonly stall. Teams who weren’t involved in the pilot don’t trust the tool. Reviewers who weren’t trained skip the check. Managers who weren’t briefed don’t hold the standard. The UK Government’s AI Playbook repeatedly emphasises the need for domain expertise alongside technical skill, and for collaboration across internal functions. In a small firm, that means the person coordinating the rollout needs more time with people than with software.
The firms that scale AI well don’t do it quickly. They do it once, properly, then use what they learned to move faster with the next department. If you’d like to work through what a staged rollout could look like for your firm, book a conversation.
