Foundation first: Why building a resilient IT infrastructure is your path to AI-readiness

Strategically ready, operationally unsure. That's how 42% of organizations describe their own AI preparedness when it comes to strategy versus infrastructure, data, risk, and talent, according to Deloitte's State of AI in the Enterprise 2026 report. As AI adoption accelerates, organizations now face the mounting pressure from the board to move past pilots and show AI delivering measurable business outcomes. What that pressure doesn't account for is whether the underlying infrastructure can support what's being asked of it.

Why AI initiatives break down

To move from ambition to activation, IT teams first need to do the less glamorous work of knowing what assets they own, documenting dependencies, maintaining accurate data, and getting permissions right. Today, most organizations are scaling AI on data and systems that were never built for it, and finding out the hard way.

For example, say a technician is asking an AI agent to remove access employees no longer need. To do that safely, it needs to know who has access to what today, which of that access is actually being used, who granted the access, and what actions the AI is authorized to take. All of these details come from the organization's records, not from the AI. And when those records are incomplete, the AI does exactly what it was told and someone loses critical access in the middle of their shift.

The foundations of operational AI

Every organization needs to have these foundations in place before AI moves deeper into enterprise operations:

1. Trusted data

   AI needs trustworthy data to take the right decisions. This could include maintaining accurate asset inventory and the assets' current configuration information, reliable ticket history, complete audit and access logs, and accurate patch and update status per system. Maintaining accurate and reliable data should be the first priority of IT teams that want to be AI-ready. An engineer who knows that the configuration management database (CMDB) is showing incorrect information may directly fetch the correct information through the host machine, without rectifying the data in the CMDB. This could be a temporary workaround, but AI will not have this context nor the instinct. It will simply take the current data at face value and act on it.

2. Reliable relationships and context

   Having access to reliable organizational context allows AI to understand the relationship among the core IT layers—infrastructure, systems, applications, and services—to execute a command safely. For instance, AI should be able to reason across the entire IT infrastructure to determine which applications are mapped to a server, which organizational services run on those applications, and which IT components could be impacted by an automated action. The context is unavailable when no established relationship mapping exists between these layers.

   This context is provided by the CMDB. It is known as the single source of truth and provides an organization with visibility into its technology assets and, critically, the relationships between them.

3. Strong identity and access controls

   An AI agent will need access to systems, applications, and data to execute a task. But how does an AI agent know not only what can be done, but what it is allowed to do? Unless an organization has strong identity and access controls in place, it cannot safely let AI agents take action. Role-based access control (RBAC), least privilege, and just-in-time access are some of the access controls that allow teams to scope permissions to the specific action and not over-grant it.

4. Integration hygiene

   This is where many AI initiatives quietly fail. An agent may be able to reason (i.e., analyze, correlate, and recommend) across the enterprise, but it can only act (i.e., execute tasks) if the enterprise is connected. For example, say there's a high-severity vulnerability on a host machine. To patch it, the agent needs to reason across domains to know what's installed on that machine and its patch level, who has access to it and if it is privileged, whether anyone reported a related incident, and if this pattern has caused outages before. To take actions, the organization needs to have APIs that not only let the agent retrieve information from a system but also let it take bulk actions, like closing tickets, applying patches, revoking accesses, and more.

5. Governance and ownership

   Assigning ownership and having a strong governance policy will make AI initiatives auditable and explainable. Teams need to decide who will own the accuracy of the data and who will own the decision of the AI agent. In plain terms, this means who sets the guardrails and the decision framework, and who will be accountable for the consequences if something goes wrong. When an AI recommendation does turn out to be wrong, explainability is paramount: why the agent reached that conclusion, which sources influenced it, what actions it took, who approved it, and how to reverse it.

Conclusion

The organizations best positioned for AI aren't the ones with the most ambitious pilots. They're the ones that fixed their IT foundations, let each pilot tell them what to fix next, and then scaled. Accurate data, dependencies mapped in the CMDB, strong identity and access controls, deep contextual integrations, and clear ownership are the groundwork that every organization needs to establish before getting started with AI. It is only when the foundations are strong that an organization can deploy AI to achieve meaningful business outcomes.