Fractional AI director: when a company needs one

In a mid-size company, AI is an ownership problem before it is a tooling problem. Someone has to decide where AI may be used, what it may touch and when a pilot is stopped. If staff already use AI chat tools and nobody can say with what data or to what effect, the company has no AI programme, only private habits.

A full-time chief AI officer is rarely justified in a company of 20 to 250 people, which has neither dozens of projects nor a large team to manage. The proportionate answer is one accountable person for a few days a month, backed by engineers who can implement what that person decides. Without that backing, the role turns into advice that ends with a slide deck.

AI in a company starts with an owner

Tools are cheap and easy to get. What holds a mid-size company back is the absence of someone who can say yes, no or not yet, and then answer for the outcome. According to Eurostat, 30.36% of medium-sized EU enterprises used AI technologies in 2025, and in Poland the figure was 8.36%; the survey covers enterprises with ten or more employees and self-employed persons. Across the EU, among enterprises that considered AI and decided against it, the most common reason was a lack of relevant expertise (70.89%), followed by unclear legal consequences and data protection concerns.

Those figures measure what a company reports as its own use. They do not capture the employee who pastes a customer proposal into a free chat tool. The gap between the official picture and daily practice is exactly the area someone should be accountable for.

The NIST AI RMF puts this under its Govern function: roles, responsibilities and lines of communication should be documented and clear to teams, and executive leadership should take responsibility for decisions about risks associated with AI systems. The framework is voluntary and meant for organisations of all sizes; this point applies to a mid-size company as written.

Signals that the subject has slipped out of control

The first signal is informal use: personal accounts, no list of tools in use, and a policy, if any, that does not say which data must never be pasted in. The second is pilots without acceptance criteria: a team has been "testing an assistant" for three months and nobody has agreed what result counts as success and what result ends the trial.

The third signal is data leaving the company without the process owner knowing. AI features appear in the CRM, email and document editors as part of existing subscriptions. Someone should check where that data is processed, whether the vendor uses it to train models, and whether the company wants to pay for the add-on at all.

The fourth is regulatory obligations. Article 4 of the AI Act, on AI literacy, has applied since 2 February 2025, and the supervision and enforcement rules since 2 August 2026. The European Commission's questions and answers make clear that this also covers companies whose staff use tools such as ChatGPT for drafting or translation. After the changes made by the AI Omnibus, which entered into force on 27 July 2026, the wording of Article 4 requires providers and deployers to take measures that support AI literacy among their staff, without guaranteeing any specific level. The Commission says no certificate is needed and organisations can keep an internal record of trainings and other initiatives. Someone still has to plan those measures and document them.

What the role decides in a monthly cycle

A fractional AI director keeps a register of uses: where AI is used, by whom, on what data and with which vendor. NIST calls this an inventory of AI systems (GOVERN 1.6), and in a smaller company a spreadsheet with a named owner for every line is enough. From that register come the data rules: what may go to an external model, what stays in the company's own infrastructure, and who approves exceptions.

Each month opens with a review of earlier changes and ends with a decision on what to build next. Every change has a short specification: the baseline, the expected effect, an acceptance criterion, the cost to build and to run, and the person who signs it off on the company's side. The same person owns stopping things. MANAGE 2.4 calls for mechanisms, and assigned responsibility, to deactivate systems whose outcomes are inconsistent with their intended use. A pilot that missed its criterion ends with a recorded decision, not quiet abandonment.

Vendors and costs belong to the role as well: which AI licences the company pays for, which add-ons overlap, and whether a feature in an existing system would do instead of another tool. This is how CloudTech describes its AI director service: an accountable person on the client's side, backed by engineers who build and run what has been decided.

What the role is not

It is not a prompt trainer. Training staff is part of the Article 4 obligation, but running workshops does not decide which processes should change at all. A company that has trained everyone and keeps no register of uses still does not know what is happening to its data.

Nor is it a tool reseller. Someone whose income depends on licences sold will not credibly recommend ending a pilot. A useful test is whether the AI director has ever proposed a change without AI, such as removing an unnecessary step from a process or using a report the system already produces. If every recommendation ends in a new subscription, the role is serving someone other than the company.

Finally, it is not a compliance function detached from practice. An AI policy document that nobody follows meets neither business goals nor regulatory ones.

When you do not need one yet

If the company has a dozen or so people, AI is used mainly for drafting text, and the owner knows every process personally, a short data policy, one tool on a business contract and a note recording staff training are enough. An external role would have nothing to hold to account.

It also makes little sense when core data is in disarray and nobody intends to fix it. An AI director can say the CRM needs sorting first, but if the board gives that work neither time nor budget, every specification will stall at the same step. A one-off review is a better start than a standing engagement.

How to judge the engagement after the first quarter

After three months there should be artefacts you can check without a presentation. A register of AI uses with owners and data classification. Usage rules that staff actually know, and an internal record of the trainings and other Article 4 measures carried out. At least one change delivered with a measurement before and after, or one stopped with a documented reason. A summary of AI tool costs with a decision on what stays and what is switched off.

The board's checks are simple. Do we know where AI processes our data? Can we name one change whose effect we measured? Has anyone decided to end a trial that was not working? No answer to all three after a quarter means the problem is not pace but the design of the role.

How it typically goes wrong

The most common failure is a role without decision rights. The AI director recommends, and every change needs approval from several managers, none of whom answers for the result. Accountability has to come with authority, including the right to stop a pilot.

The second is having nobody on the company's side to sign off changes. An external director knows the process less well than the head of department and should not declare success alone. The third is measuring activity instead of outcomes: workshops held or prompts collected say nothing about how long an enquiry takes or what a mistake costs. The fourth is handing recommendations to another contractor without a specification or acceptance, so plan and delivery drift apart at the first change.