AI is delivering returns, but enterprise readiness is falling. Kyndryl’s 2026–27 report shows why CIOs must align infrastructure, workforce redesign and governance before scaling transformation.
For enterprises, the AI conversation is entering a more consequential phase. The question is no longer simply whether artificial intelligence can deliver business value. Increasingly, it is whether organisations have the technology foundations, workforce capabilities and governance structures to sustain that value as AI becomes embedded in business operations.
The 2026–27 Kyndryl Readiness Report captures this contradiction. The study finds that AI investments are generating stronger returns even as organisational readiness to manage emerging risks deteriorates. While 64% of organisations investing in AI and machine learning report positive returns, up from 54% in 2025 and 42% in 2024, only 24% of leaders say their organisations are completely ready to manage external business risks, down seven percentage points year on year.
Furthermore, 84% of organisations report deploying AI in workflows beyond pilot projects. Yet, scaling deployment has not automatically translated into organisational preparedness. Cybersecurity readiness has experienced the sharpest decline, falling 11 percentage points to 26%.
For CIOs, this creates a strategic dilemma: how to accelerate AI adoption and demonstrate measurable returns without allowing infrastructure weaknesses, fragmented accountability and evolving risks to undermine enterprise performance.
The report identifies three interconnected dimensions of readiness: Foundation, Reinvention and Control. Together, they offer a useful framework for understanding why technology investments alone are insufficient to deliver sustained transformation.
1. A modernised IT estate does not necessarily mean an AI-ready foundation
One of the report’s most important findings is the disconnect between perceived infrastructure maturity and actual AI readiness.
Although 71% of leaders describe their organisations’ core IT estates as mostly or fully modernised, 62% say their technology foundations require further modernisation before they can fully realise AI’s benefits. The gap is even more pronounced among CIOs, with 66% saying their technology foundations require significant re-architecture to support AI at scale.
Data readiness emerges as a particularly important constraint. 40 percent of respondents say their organisational data is not ready to support AI at scale, while 46% identify data silos as an obstacle to scaling AI initiatives. The consequences are visible in investment outcomes: organisations reporting inadequate data readiness experienced AI initiative investment failures at 35%, compared with 17% among those whose data was ready.
Cloud modernisation presents a similar contradiction. While 86% say cloud investments have increased business agility, 60% experienced higher-than-expected costs. Additionally, 48% say their cloud environments evolved without deliberate design, while an equal proportion report inaccessible data in environments that were never properly decommissioned.
The business implications extend beyond infrastructure efficiency. Organisations that avoided cloud-related setbacks reported positive AI and machine learning returns at 73%, compared with 58% among those experiencing multiple setbacks. Similarly, organisations with mostly or fully modernised IT estates reported positive returns at 67%, against 56% among those with partially modernised or largely legacy estates.
What should be considered is that infrastructure modernisation should be evaluated against the requirements of intended business workloads, rather than the percentage of systems upgraded or migrated. Data quality, accessibility, integration, architecture and cloud cost visibility must become part of the same investment conversation. CIOs should also reassess legacy environments and stranded data before committing additional budgets to AI expansion.
2. AI deployment is outpacing the redesign of work
The second challenge is organisational rather than technological. AI is already changing how work moves across enterprises, but operating models and workforce capabilities are not evolving at the same pace.
According to the report, 77% of leaders say AI agents are already automating workflows that previously required handoffs between multiple teams or systems. Meanwhile, 81% report using AI for process automation and workflow execution, including 36% who say its use is widespread across their organisations.
However, the organisational changes needed to support this transition remain incomplete. Only 27% completely agree that roles have been formally redesigned around AI, 29% say formal AI change-management programmes are fully implemented, and just 33% believe their workforce is completely ready to leverage AI. IT skills and talent readiness is also limited, with only 30% reporting complete preparedness.
The investment implications are significant. Organisations that have both redesigned roles around AI and implemented formal change management report positive AI and machine learning returns at 69%, compared with 53% among other organisations. Their positive returns are also higher for generative AI (64% versus 49%) and agentic AI (59% versus 49%).
Yet, most enterprises continue to favour incremental adoption. 75 percent prefer embedding AI into existing processes or using it as a productivity layer, while only 13% favour rebuilding core processes and operating models around AI.
This preference is understandable given the pressure to demonstrate near-term returns. However, it raises a longer-term question: are enterprises merely automating existing processes, or redesigning them to capture the full potential of AI?
3. Cybersecurity and operational resilience are becoming critical readiness gaps
As AI becomes embedded in enterprise operations, the risk environment is becoming more complex. Cyberattacks have remained the leading external concern for business leaders for the third consecutive year. Yet, only 26% say their organisations are completely ready to manage them, an 11-percentage-point decline from 2025.
The contradiction is particularly relevant to AI adoption. While 76% consider AI essential to effective cybersecurity operations and an equal proportion say it helps identify threats faster than traditional approaches, 61% believe AI increases the sophistication of cyber threats. Another 55% say the threat landscape becomes harder to manage every year.
Operational disruptions add another dimension. Eighty-four per cent of organisations experienced at least one significant outage in the past year. Human error accounted for 35% of reported outage causes, followed by network or connectivity issues at 30% and hardware or software failures at 27%. Cybersecurity incidents accounted for 24%, while third-party disruptions, AI-system malfunctions and AI-driven cyber threats each accounted for 22%.
These findings suggest that resilience cannot be treated as a cybersecurity department’s responsibility alone. It must encompass infrastructure reliability, third-party dependencies, incident response and continuity of critical operations.
4. Governance and digital sovereignty need to move from policy to execution
The report highlights another gap between organisational intent and operational action: AI governance.
75 percent of respondents say they have clear governance over third-party technology and AI tools, and an equal proportion report appropriate governance for AI-related cybersecurity risks. However, only 28% say their data governance and management are completely ready to manage future risks. Furthermore, 40% say uncertainty around AI governance makes it difficult to establish accountability.
The implementation figures reinforce this disconnect. Only 32% have defined accountability for AI-related risks, decisions and outcomes. Similarly, just 35% have conducted risk assessments or audits of AI systems currently in use.
Interestingly, organisations taking six or more of the ten AI governance actions examined in the report report positive AI and machine learning returns at 76%, compared with 63% among organisations taking five or fewer actions. They are also more likely to be completely ready to manage cyberattacks: 45% versus 25%.
Digital sovereignty presents a related challenge. 65 percent believe sovereignty considerations should shape their entire technology strategy. However, 78% have taken three or fewer of the ten sovereignty-related actions examined, and only 6% have taken six or more.
The report also indicates a willingness to accept trade-offs for greater control: 68% say technology solutions providing full operational control are worth paying a premium of 10% or more, while 60% believe greater control justifies slower deployment and adoption of advanced capabilities.
The CIO’s next priority
The report’s central message is that enterprise readiness cannot be measured by technology adoption alone. It requires simultaneous progress across infrastructure, organisational reinvention and control.
Its four readiness profiles illustrate the varying degrees of progress. Confident Frontrunners, representing 21% of respondents, report 85% positive AI/ML returns. Fast Movers account for 45% but report 61% positive returns, despite relatively limited governance action. Steady Builders represent 28%, while Risk-Led Adopters account for 5% and report the lowest readiness and positive returns.
For CIOs, these profiles offer a useful way to assess organisational priorities rather than simply benchmark technology spending.
The immediate agenda should include:
- Reassess AI readiness: Evaluate data quality, infrastructure architecture, integration and cloud economics before expanding deployment.
- Connect technology with business strategy: Ensure AI investments have defined business outcomes, measurable success criteria and executive alignment.
- Redesign work alongside technology: Integrate workforce development, workflow redesign and change management into AI programmes.
- Operationalise governance: Establish clear decision ownership, risk assessments, audit mechanisms and human oversight.
- Strengthen resilience: Test critical dependencies, third-party continuity arrangements, cybersecurity response and recovery capabilities.
- Treat sovereignty strategically: Assess where sensitive data resides, who controls access and how critical operations would continue if a provider became unavailable.
Ultimately, the competitive advantage will not belong simply to organisations deploying AI fastest. It will belong to those that can repeatedly translate technology investments into business outcomes while maintaining operational control, organisational adaptability and resilience. For CIOs, readiness is no longer a prerequisite to transformation; it is an ongoing management responsibility that determines whether transformation can be sustained.