Every portfolio company has an AI plan. Few have asked whether their technology can support one.
The pitch is easy to like: agents that draft the proposals, reconcile the invoices, answer the support tickets, and update the CRM. The demos are impressive.
The mistake is treating AI as a tool purchase when it’s an operating-model decision.
Technology diligence has traditionally asked "What are we buying?" The question that now belongs beside it is "What will this technology actually let us automate, safely?"
The answer has less to do with which model you choose than with what sits underneath it.
Can the Systems Be Reached?
An AI agent is only as useful as the systems it can read from and act in.
In many companies, the critical information lives in places software cannot easily reach: spreadsheets, inboxes, legacy applications with no usable interface, and processes that depend on someone remembering the right steps.
Before funding an AI initiative, ask:
Do core systems expose clean, documented interfaces?
Is key data accurate, current, and in one place, or scattered across tools?
Which processes are written down, and which live in people's heads?
If the answer to most of these is "it depends," the first AI investment is not an AI investment. It is integration and data cleanup.
Who Is Allowed to Do What?
Once an agent can act, it needs permissions, and permissions need owners.
Can a tool send an email on behalf of an executive? Issue a refund? Change a customer record? Approve a payment?
Most organizations have clear rules for what employees may do. Very few have extended those rules to software that acts on an employee's behalf.
That gap is where the real risk sits: access that is too broad, approvals that are unclear, and no one certain who is accountable when an automated action goes wrong.
Can You See What It Did?
Every automated action should leave a trail.
What was done, on whose authority, using which data, and with what result? If the answer requires reconstruction after the fact, the organization is not ready to hand the process over.
Auditability is not a compliance afterthought. It is what allows leadership, investors, and customers to trust the outcome.
Don't Start With the Most Ambitious Use Case
The temptation is to chase the biggest prize first.
Resist it.
The better path is a small number of narrow, well-governed workflows with measurable results: hours saved, errors reduced, cycle time shortened, cost per transaction lowered. [Insert a brief, anonymized example from Cumulus engagements here.]
Prove the value. Establish the controls. Then expand.
A collection of AI tools is not a strategy. A few governed use cases that move operating metrics are.
Keep Your Options Open
The AI market is changing quickly. Models improve, platforms compete, and vendor terms shift.
Companies that tie their processes to a single vendor's approach take on a risk that is easy to miss until it is expensive to reverse. Favor tools that connect to the systems you already run, keep your data portable, and can be swapped without rebuilding the workflow around them.
The model is replaceable. Your data, your permissions, and your processes are the assets.
What Leadership Should Know
When AI readiness is part of diligence and the first 90 days, leadership should have a clear view of:
Which processes are strong candidates for automation, and what each could return
Where data and systems need work before AI can help
What access and approval rules need to exist
How actions will be logged and reviewed
Who owns each use case and its results
Which vendor dependencies create lock-in
Most importantly, AI should not be a promise on a slide. It should be a set of decisions tied to cost, risk, growth, and enterprise value.
Because the objective isn't to adopt AI.
It is to make the business stronger.
Cumulus Partners helps organizations translate technology complexity into measurable business outcomes across technology strategy, AI, cloud operations, cost optimization, and transformation.
