Nearly Half of CFOs Have Never Held the AI Governance Meeting That Matters

A board-ready framework for AI ambition, governed data, permitted autonomy, executive accountability, insurance, and multi-model strategy — the two-hour meeting the CFO should convene before another Copilot purchase order.

By Errin O'Connor — Founder & Chief AI Architect, EPC Group · Microsoft Solutions Partner across all six designations · Four-time Microsoft Press bestselling author

The meeting that never happened

EPC Group's research across the finance leadership of mid-market and Fortune 500 buyers we have spoken with over the last twelve months surfaced a number that stopped me cold. Nearly half of the CFOs we interviewed have never sat down with their CIO, their CDO, their General Counsel, and their controller and had an explicit, written, board-visible conversation about how ambitious their organization intends to be with artificial intelligence over the next twenty-four months.

Not a hallway comment. Not a Slack thread. Not a slide in someone else's deck. The actual conversation — the one where you commit to a posture, a risk appetite, an accountability owner, a budget floor, a budget ceiling, and a set of enterprise decisions that AI will and will not be permitted to make on its own.

That conversation has not happened inside almost half of the finance organizations that are, at this very moment, actively buying Microsoft Copilot licenses, funding pilots in Azure AI Foundry, and signing statements of work with system integrators for "AI transformation."

The consequence of that missing meeting is the story I want to tell. Because when I look at the AI failures piling up in the enterprise — the pilots that never reached production, the eight-figure spend that produced a chatbot the CEO's assistant already replaced with a shortcut, the boardroom presentation where somebody spent forty-five minutes on "adoption metrics" without a single financial outcome attached — the root cause is not the model. It is not the vendor. It is not even the data. The root cause is that the CFO was sold a license before the CFO was invited to have the conversation.

Why this is a CFO problem, not an IT problem

For twenty-nine years I have watched enterprise technology arrive with a promise attached. I was on the SharePoint beta team in 2001 when it was still code-named Project Tahoe. I was on the original Power BI beta team when it was code-named Project Crescent. I served as the eDiscovery lead for the Federal Reserve Bank of New York during the Troubled Asset Relief Program. I sat on Vivek Kundra's advisory team for the twenty-five-point plan to reform federal IT under the first United States Chief Information Officer. Every one of those engagements had one thing in common: the technology was inevitable, the financial exposure was inevitable, the governance question was inevitable — and in almost every case, the CFO showed up to the conversation eighteen months later than they should have. AI is that pattern accelerated by a factor of ten.

Here is why the CFO must convene this with the CIO. The CIO owns and operates the platform. The CFO owns the financial-control boundary around what the platform is permitted to do. When a large language model inserts a number into a financial statement, an agent acts against the vendor master, or an AI-assisted forecast cannot be reproduced, the CFO's signature and the organization's control environment become central. The CIO may be questioned. The General Counsel may be questioned. But the CFO still has to defend the number, the process, and the decision to permit a probabilistic system into a financially material workflow.

So the meeting that has not happened inside nearly half of the finance organizations we surveyed is not a governance meeting or an IT meeting. It is the CFO's fiduciary meeting. And every quarter it is delayed is a quarter of unbounded exposure sitting on the balance sheet of an organization that has convinced itself it is being modern.

The wrong purchase order

Here is the anatomy of the mistake I see repeated with almost mechanical consistency. A CFO reads a productivity headline. Microsoft's widely cited "11 by 11" research describes roughly eleven minutes saved per day over eleven weeks before many users report sustained value. The finance model converts those self-reported minutes into enterprise-wide annual hours, multiplies them across three thousand employees, and produces a nine-figure productivity case. The CIO runs a pilot. Procurement issues purchase orders. Six months later the CFO asks for the productivity report and receives an adoption dashboard showing that thirty-eight percent of employees opened Copilot at least once. Nobody can reconcile the modeled hours to a realized financial outcome.

The CFO writes a memo about "AI investment discipline." The board approves another round on the assumption the problem was scale. More licenses. The next quarterly shows adoption at fifty-two percent, and productivity still cannot be attributed to the tool. At month eighteen, someone finally asks the month-zero question: which Copilot, Power BI, Fabric, or custom-agent experiences have been deliberately grounded against which governed data? In too many enterprises, the answer is the same tangled, half-labeled, duplicate-workspace-riddled analytics environment the organization has ignored since 2018.

The license was the wrong first purchase order. The right first purchase order was for Power BI and Fabric data readiness: a governed semantic layer, capacity architecture that can support grounding, OneLake-level security and sensitivity labels, and a documented approval gate defining which models may read which data, for which audience, under which retention policy. That work should arrive before broad license expansion, not after it.

Governance is always the core foundational floor. Management is the ceiling we forgot to build.

I have used this line in every article I have published this year, because it is the sentence I need finance and technology executives to internalize. Governance is not a compliance checkbox. Governance is not what you do after the model ships. Governance is the load-bearing floor that determines whether every dollar you spend above it produces a return or produces exposure.

When an enterprise skips the governance conversation and jumps straight to the license conversation, it is building the ceiling of its AI ambitions on assumptions it has not tested. That the data is clean. That the workspace structure is defensible. That the semantic layer says what the CFO thinks it says. That sensitivity labels are enforced. That the model is reading what it was told to read. Every one of those assumptions is, in the majority of Fortune 500 environments I have audited, wrong. The nearly one-in-two CFOs who have not had the conversation are, without knowing it, building the ceiling before the floor has been poured. The ceiling holds until a regulator, a plaintiff, a carrier, a journalist, or an activist shareholder asks a specific question. Then the ceiling comes down onto the CFO's desk.

The number nobody wants to look at

Let me put a piece of arithmetic in front of you that will change how you read every Copilot marketing email between now and Christmas. Published industry research on organizations with at least a thousand employees shows the average enterprise analytics team now works across roughly four hundred data sources, and nearly one in five enterprises is juggling more than a thousand. More than seven in ten data teams cycle through five to seven tools to complete daily work; about one in ten runs eleven or more. Data scientists in those organizations spend, on average, sixty percent of their time cleaning and organizing data and another nineteen percent just finding the datasets — leaving roughly a fifth of their time for the work the CFO thinks she is paying for, which is analysis and insight. Between sixty and seventy-three percent of enterprise data collected is never used for analytics at all. Eighty-three percent of respondents in the same research report data silos, and ninety-seven percent of those acknowledge the silos are actively hurting performance.

Now overlay AI on top of that. Microsoft 365 Copilot, Copilot in Power BI, Fabric data agents, Copilot Studio agents, and custom Azure AI solutions do not all ground against the same sources automatically. But whenever an organization deliberately connects an AI experience to poorly governed data, the system inherits the source environment's ambiguity, permissions, duplication, weak metadata, and lineage gaps. You have not deployed an AI transformation. You have deployed a highly confident tour guide through a poorly organized warehouse. It will still answer. Whether the answer is correct, defensible, reproducible, and appropriate for an auditor is a separate question no license fee resolves.

The perception gap that should terrify every executive team

There is a second number that pairs with the readiness numbers, and it belongs on the wall of every executive team currently telling its board that AI is going well. Independent research from MIT Technology Review Insights and Metrigy, published this year, examined the delta between how businesses believed their customer service had improved and how customers actually perceived it. Seventy-eight percent of businesses said their customer service had gotten better over the previous twelve months. Thirty-one percent of consumers agreed. That is not a rounding error. That is a nearly fifty-point perception gap between the executive team and the customer they claim to have transformed.

Sit with that. The organizations in the survey were not sandbagging — they believed their own metrics. They had adoption numbers, throughput numbers, resolution numbers, and Net Promoter theater. The customer looked at the same transformation and said, in effect, "it feels the same, or worse." The gap exists for the same reason nearly half of CFOs have not had the conversation: executive dashboards measure the tool, and customers experience the data. If the data underneath the tool is fragmented, mislabeled, and duplicated across workspaces — if it cannot answer "who is this customer, across every system that touches them, right now" — no chatbot on earth closes that gap. The chatbot simply narrates the confusion more articulately. The nearly-half and the 78-versus-31 are the same story told twice: one by the CFO who has not asked the question, the other by the customer who has already answered it.

Copilot is not the problem. It is also not the answer.

I want to be careful here, because Microsoft is the platform on which the majority of EPC Group's engagements are delivered. Copilot is not the villain of this piece. It is not the hero either. Copilot is a component, and the mistake is treating a component like a strategy.

The most honest statement made about Copilot this year did not come from Microsoft's critics. It came from Microsoft. On July 2, 2026, announcing the $2.5 billion Frontier Company, Judson Althoff — CEO of Microsoft's Commercial Business — told Reuters: "Three years ago, when we built Copilot, we made a mistake by binding it to OpenAI models only." Customers, he said, need swappability — the freedom to route between state-of-the-art models as the state of the art shifts. The maker of Copilot said, on the record, that single-model architecture was the wrong bet.

Weeks earlier, the June 2026 Gartner Magic Quadrant for AI Platforms for Data Science and Machine Learning placed Microsoft in the Leaders quadrant — alongside Databricks, Google, AWS, and IBM. Microsoft was a leader, not the leader: Databricks was positioned highest on Ability to Execute and furthest on Completeness of Vision. If you are a CFO who has been told your enterprise's AI strategy is "Microsoft," what you have actually been told is that your enterprise is betting on one of several Leaders in a genuinely competitive platform tier, while quietly binding the assistant layer to a single-vendor foundation model that the maker of that assistant just conceded was a mistake to bind. That is not a strategy. That is a purchase order pretending to be a strategy.

The strategy that survives contact with what your data actually looks like is multi-model on governed data. Use Copilot where Microsoft-native context and workflows make it the right choice. Use Claude through an approved orchestration layer, with MCP-connected tools where appropriate, when reasoning quality dominates. Use GPT-class models through Azure AI Foundry when broad capability and tenant controls matter. Use sourced research engines for external intelligence. Use private, tenant-resident models where sensitive data cannot leave. Multiple approved models. One governed semantic layer. The models change. The data does not.

What AI actually is, written for a CFO who is tired of being talked down to

Before I walk you through what the conversation nearly half of finance leadership has been avoiding looks like when it goes well, I want to remove the vagueness around the word "AI" in board decks. AI is not one thing. It is a family of techniques stacked on each other, and when a CFO nods along without being able to distinguish them, the CFO is trusting the presenter's taxonomy — which is where a great deal of enterprise money gets misallocated. There are, at minimum, seven distinct techniques hiding inside the term.

• Machine learning — statistical models that learn patterns from history to predict, classify, or cluster. The bulk of production AI in finance today, unglamorous and enormously valuable: AP anomaly detection, cash-flow forecasting, churn prediction, fraud scoring.
• Deep learning — layered neural networks powering image classification and speech-to-text, mostly reaching finance through vendor systems.
• Natural language processing — the layer where Copilot, ChatGPT, Claude, and Gemini live; not intelligence, but very good pattern matching over language.
• Rule-based systems — deterministic logic, essential for compliance and tax and any workflow where the answer must reproduce.
• Optimization — best-answer-under-constraints math that finance has run for decades and vendors are now relabeling as AI.
• Graph data science — relationship analysis across entity networks: money-laundering detection, supply-chain risk, related-party discovery. This is the technique the SEC and Treasury enforcement use, and most CFOs have never had a graph analysis run against their own vendor master file.
• Agent-based computing and orchestration — the newest and most volatile layer, where the system does not merely answer but acts, chains steps, calls tools, and completes tasks with minimal human intervention.

When somebody sells your CFO "AI," they are almost always talking about one or two of these and letting the CFO's imagination fill in the rest. The conversation begins here, with a shared taxonomy, because you cannot budget for what you cannot name.

The autonomy decision the board has not made

Sitting on top of that taxonomy is the single most important decision the CFO's leadership team has not made explicitly: how much autonomy is your organization willing to grant to an AI agent? Not in theory. In writing. In a matrix. Approved by the board.

The answer today, inside almost every enterprise I audit, is: zero percent officially, and an unknown percentage unofficially. Employees are using consumer AI on personal devices to draft emails and translate contracts. Vendors are embedding agents into products licensed for other reasons. Copilot Studio and Foundry are in the hands of citizen developers with no governance charter. The effective autonomy granted to AI inside the average large enterprise is somewhere between fifteen and forty percent, and nobody has counted, because nobody was told to count. Independent research now projects that by 2028 at least fifteen percent of day-to-day work decisions will be made autonomously by agentic AI — a number that was zero in 2024 and is climbing faster than the governance frameworks written to contain it.

The conversation nearly half of CFOs have not had is the one that says, out loud: "By fiscal year end, our organization will grant AI autonomy over these decisions, at these dollar thresholds, under these approval workflows, with these logging requirements, and with these named human owners of the outcome." Every clause in that sentence is a decision the CFO makes with the General Counsel, the CIO, and the audit committee. It cannot be made after the fact. It cannot be delegated. And it cannot be inferred from a Microsoft license agreement.

The conversation, written out

For any CFO who has read this far and realized this meeting has not happened inside their own organization, here is the agenda. It is short. It is not comfortable. It is the single most important two hours you will spend on AI this year.

1. AI ambition

What is our AI ambition, on a scale from custodial to transformational. Custodial means AI accelerates existing workflows without changing them. Transformational means AI is permitted to change the shape of the organization, the composition of roles, and the sequence of decisions. There is no correct answer. There is only a decision made explicitly.

2. Governed data and named owners

What data does our AI touch, and who governs it. Not the license — the data. The Power BI workspaces, the semantic models, the OneLake destinations, the sensitivity labels, the retention policies, the row-level security definitions. Named owners. Written accountability. Not a diagram in a slide — a directory in Purview.

3. Permitted autonomy

Which decisions is AI permitted to make autonomously, at what dollar threshold, under what human approval, and with what audit trail? This is the matrix the board approves, insurers may request, and auditors, regulators, or litigants may later ask to inspect after a material AI-driven error.

4. Named executive accountability

Who is the named executive accountable for AI outcomes, and how is that executive measured? If the answer is "the CIO," confirm that the role includes explicit accountability for business outcomes, financial controls, model risk, and autonomous actions — not only platform operations. Some organizations create a full-time Chief AI Officer. Others use a fractional vCAIO. Both can work when the accountability is written and board-visible.

5. Insurance posture

What is our insurance posture, and does the current policy respond to the exposure? What AI-specific exclusions, sublimits, human-oversight requirements, and documentation obligations now apply? Six major carriers I have spoken with directly this year asked for more formal AI governance evidence than they did a year ago.

6. Multi-model position

What is our multi-model position, and are we bound to a single vendor by accident. If your entire AI strategy is downstream of one foundation model, you are one provider's outage, policy change, pricing change, or regulatory action away from it becoming your problem. Multi-model is not ideology. It is continuity of operations — the same reason your treasury team does not keep all the operating cash in one bank.

Those six items are the meeting. Two hours. Once a quarter. Documented. Signed. Delivered to the audit committee. Nearly half of the CFOs we interviewed have not held that meeting once, let alone quarterly — and every quarter it is delayed, the exposure compounds and the ceiling gets taller while the floor stays thin.

The six pillars EPC Group certifies against

I have described the shape of the problem. Let me be equally explicit about the solution, because EPC Group has spent the last year translating all of the above into a certifiable framework a CFO can hand to a board, an auditor, or a carrier without paraphrase. We call it Power BI Data Readiness for AI Certification, built on six pillars — not because six is a marketing number, but because when we mapped the failure modes across audits, deposition transcripts, incident reports, and carrier questionnaires, they resolved into six categories with almost no overlap.

Pillar 1: Metadata enrichment at the semantic layer

Every table, column, measure, and relationship carries structured, human-readable metadata in the Tabular Model Definition Language, version-controlled in PBIP. If Copilot cannot read your metadata, Copilot is guessing. Guessing is fine until it is deposed.

Pillar 2: Explicit measure discipline

Implicit measures are the single most common cause of Copilot returning a plausible number that is subtly, expensively wrong. Every measure AI reasons over must be authored explicitly, documented, tested, and certified. Not optional. The floor.

Pillar 3: Workspace ownership, lineage, and deduplication

In the average Fortune 500 tenant we audit we find between forty and two hundred duplicate workspaces, orphaned datasets, and reports whose owner left eighteen months ago. That is the environment Copilot is reading. Cleaning it is the difference between an AI you can defend and one you cannot.

Pillar 4: Fabric capacity readiness

Grounding Copilot requires Fabric capacity that is provisioned, monitored, and governed. Undersized capacity produces silent throttling; silent throttling produces intermittent failures; intermittent failures produce a loss of executive trust that is nearly impossible to rebuild.

Pillar 5: Row-level security, object-level security, and OneLake hardening

Copilot will happily surface exactly what you told it it was allowed to surface. Every grounding path must be preceded by a hardened security posture tested against the specific personas AI will speak to.

Pillar 6: Approved-for-AI matrix by model, audience, and retention policy

Not every semantic model should be grounded by every AI system. Some data should never be grounded by an external model at all; some by Claude but not Copilot; some by Copilot but not Perplexity. The matrix belongs in writing, approved by the General Counsel, refreshed quarterly, integrated into your Purview posture.

An organization certified against these six pillars can walk into any board meeting, any audit, any carrier renewal, and any regulator inquiry and produce evidence — not vibes, not adoption dashboards, but evidence — that the AI investment is producing bounded, defensible, insurable, reproducible outcomes. Everything else is theater. Start the conversation.

The multi-model architecture, made concrete

Briefly, what a properly architected multi-model environment looks like once the pillars are in place — because too many CFOs have been sold multi-model as a slogan without seeing it in operation. At EPC Group we operate a Multi-Model AI Platform for Power BI and Fabric that treats Copilot as the default assistant for Microsoft-native workloads, Claude as the second brain reachable through the Model Context Protocol where reasoning quality dominates, OpenAI's frontier models through Azure Foundry for broad-capability workloads with tenant boundaries preserved, Perplexity for grounded external research with verifiable sources, Microsoft's MAI-class models for the workloads purpose-built inside its stack, and private, tenant-resident open-source models for the data that must never leave.

Underneath all six models: one governed semantic layer, one Fabric capacity envelope, one OneLake, one Purview posture, one sensitivity-labeling regime, one approved-for-Copilot matrix. The models change. The data does not. The result is an AI strategy that survives the next Microsoft product rename, the next OpenAI policy change, the next Anthropic pricing shift, the next European regulatory update, and the next carrier questionnaire — without rebuilding the foundation each time. The models are the ceiling. The data is the floor. And the floor is what determines whether the ceiling holds.

What a Chief AI Officer actually does, and why most organizations should rent one first

The named-executive item trips up the most CFOs, because the honest answer for most mid-market organizations is that they do not yet have enough AI operational surface area to justify a full-time Chief AI Officer at officer-level compensation. But they also cannot delegate the accountability to the CIO. That was covered.

The right answer, for the majority of organizations between $250 million and $5 billion in revenue, is a virtual Chief AI Officer — a vCAIO — retained fractionally. The vCAIO chairs the quarterly AI governance meeting, owns the approved-for-Copilot matrix, signs off on model swaps, liaises with the carriers, briefs the audit committee, and produces the documentation that turns "we have AI initiatives" into "we have an insurable AI program." Above roughly $5 billion in revenue, the vCAIO transitions into a full-time seat with a small standing team — often housed inside an AI Center of Excellence. Below $250 million, the vCAIO may be shared across a portfolio. EPC Group offers vCAIO services as a companion to the readiness and insurance certifications because we found, engagement after engagement, that a certification without an accountable executive decays within a quarter. Renting the officer while you decide whether you need one full-time is the pragmatic bridge.

The insurance cliff that is already beginning

One more item most CFOs have not read carefully enough, and I am closing on it because it converts the abstract governance discussion into an urgent financial one. I have personally interviewed six major carriers writing AI, cyber, and errors-and-omissions coverage in North America over the past twelve months. Every one of them is tightening.

Lloyd's syndicates are narrowing coverage for AI-driven decisions where the human-in-the-loop cannot be documented. Munich Re, through its aiSure product, prices on the presence or absence of documented AI governance. Armilla, Counterpart, Beazley, QBE, Chubb, and Testudo are repricing quarter over quarter. The NAIC's AI Model Bulletin has been adopted or proposed in more than half the states. The European Union AI Act's next wave of obligations — Article 50 transparency requirements — becomes generally applicable on August 2, 2026. And the Insurance Services Office — ISO, the Verisk unit, not the standards body — has introduced generative-AI endorsements, the CG 40 47 and CG 40 48 forms, that are showing up in renewal letters most CFOs pass straight to their broker without reading.

The cliff is no longer theoretical. Organizations with documented governance, tested controls, human-oversight evidence, named accountability, and model inventories enter renewal conversations with a stronger evidence package and greater negotiating leverage. Organizations without those artifacts face harder questions, narrower terms, exclusions, sublimits, or repricing. Governance does not guarantee coverage. It determines whether the CFO can negotiate from evidence rather than accept the letter without a technical response.

What changes if you have the meeting tomorrow

I want to close with the reason I wrote this at four thousand words rather than four hundred. The meeting is not the transformation. The meeting is the ignition. Once the ambition has been named, the autonomy matrix drafted, the accountable executive designated, the six pillars begun, the multi-model architecture sketched, and the insurance posture reviewed — the enterprise begins accumulating the compounding advantages that separate the organizations that survived the AI transition from the ones that did not. The board conversation gets shorter, because the framework exists. The audit-committee conversation gets shorter, because the documentation exists. The carrier conversation gets shorter, because the certification exists. The vendor conversation gets shorter, because the architecture exists. Every recurring executive conversation about AI converges toward a state where AI becomes routine — governed, insurable, reproducible, and boring in the best possible sense of the word.

Boring AI is winning AI. Exciting AI is usually the AI that ends up in a deposition. The nearly 50 percent of CFOs who have not had the meeting are still living in the exciting phase. They can move to boring in one quarter if they choose to. The meeting is two hours. The framework is six pillars. The insurance posture is one certification. The architecture is one platform. The executive is one seat, fractional or full-time. None of it is out of reach. All of it requires the CFO to move first, because in every organization I have watched succeed, the CFO moved first.

The CIO can build the platform. The General Counsel can write the policy. The CDO can govern the data. The Chief AI Officer can operate the program. But only the CFO can convene the meeting. And until the meeting is convened, the platform, the policy, the governance, and the program are individually competent and collectively rudderless. You are the CFO. You are the convener. The meeting is yours to call.

If you would like the agenda above in a format your team can hand to the audit committee, EPC Group publishes it as a working document accompanying every Power BI Data Readiness for AI engagement. It is neutral, framework-based, and does not require a purchase order to read. Governance is the floor before it is a service. Request it here.

The two-hour CFO AI governance agenda at a glance

EPC Group practices that implement the framework

Frequently asked questions

About Errin O'Connor

Errin O'Connor is the Founder & Chief AI Architect of EPC Group, a Microsoft Solutions Partner across all six designations. He is a four-time Microsoft Press bestselling author, an original Project Tahoe (SharePoint) and Project Crescent (Power BI) beta participant, former eDiscovery lead for the Federal Reserve Bank of New York during TARP, and an advisor to the first U.S. CIO on the 25-point federal IT reform plan. Contact: contact@epcgroup.net · (888) 381-9725 · about/errin-oconnor

Editorial, legal, and certification note. This article is executive thought leadership, not legal, insurance, accounting, audit, or regulatory advice. Coverage, underwriting, regulatory obligations, and financial-reporting duties vary by organization, policy, jurisdiction, and use case. EPC Group's readiness certifications are proprietary technical and governance frameworks and are not issued or endorsed by Microsoft, an insurer, a regulator, or an accreditation body. Organizations should have their counsel, broker, carrier, auditors, and board review the final controls and evidence package.