You cannot fund one pillar and call it a strategy.
A company gets serious about AI and reaches for one lever. It buys the licenses, or writes the policy, or ships a tool. A year later the lever moved and the company did not. Here is the system that builds the capacity, across three pillars that grow together or not at all.
The operating system
Three pillars that build the capacity to keep turning new capability into how you actually work. They grow together, or none of them grows.
They are not phases
The three are easy to say in order, so people run them in order: finish the policy, train the people, then start the programs. That sequence fails, because these are not phases. They are dimensions of the same thing, and they mature together. Better Permission lets your people move faster and with more confidence. More capable people find and adopt better Programs, because they can see the openings in their own work. Programs surface new risks and new questions, which send you back to sharpen Permission. You never finish one. You grow all three, and you grade yourself on all three.
Permission: the space to move
Organizations cannot move fast when people do not know where they are allowed to move. Permission is executive and board alignment, explicit strategic intent, a responsible-use policy, approved tools and environments, human accountability, review requirements, escalation paths, and clear decision rights. It is not a brake. Good governance creates responsible speed. It is the shaping cone that turns a blast into flight.
Most of what people call an AI policy is a data policy in disguise. The durable version is simple enough to hold in your head. Tier 1 is business-confidential information, and it belongs only in contracted, enterprise-secure environments approved for that class of data. Tier 2 is public or non-confidential information, where you should not limit the tools at all and should push people to explore. Data sensitivity decides the environment. Ask ten of your people which information goes in which tool. If they cannot answer cleanly, you have a classification problem wearing an AI-policy costume, and no amount of training will fix it.
People: the capacity to move
Your people need literacy, confidence, examples that look like their own work, real practice, and a reason to care. Most of all they need to watch a respected peer do it first. That is why AI Ambassadors matter: distributed catalysts inside the functions, not machine-learning experts, who translate between central capability and local work and give everyone else the social proof they are waiting for. Small wins that clear away low-value busywork build the habit that larger change stands on.
The hardest part of transformation is behavior, not deployment, and it is not close. Someone can have the tool, the training, and the policy in front of them and still work exactly the way they did last year. This is not just my read: McKinsey's work on why transformations stall points at the same place, the organizational and human side, not the technology, as the common pitfall.
A license is not adoption. Changing how a person does their job is slow, social, and personal, and no amount of budget shortens it.
Programs: the capability itself
Programs are where permission and people turn into repeatable value. The question is never whether to run one. It is how each capability should be delivered, and there is a routing logic for that: self-service, buy, or build. Two more options belong on the same list, not in the footnotes. Redesign, when the real fix is a different workflow or decision structure, because a bad workflow with a tool on top is still a bad workflow. And do nothing, because not every problem needs AI, and declining the weak requests protects your attention and your credibility. The goal is not to ship tools. It is to make the institution operate differently, and to keep the learning. That discipline has its own page: buy the system of record, build the system of intelligence.
What it is, and what it is not
This is an operating system, not a maturity ladder and not a checklist you complete from the top down. There is no finish line: the technology keeps moving and the work keeps changing shape under it. And it is not a technology decision. None of the three pillars is about which model you picked. Permission is about people knowing where they can move. People is about whether they actually move. Programs is about whether the institution changes shape. The model is a catalyst. The organization is the transformation.
Why it bites harder in biotech
In a biotech the stakes make each pillar sharper. Permission stops being abstract when your Tier 1 data is a program's sequence, a patient's record, or a result that has not been filed, and the environment you allow decides whether a shortcut becomes a disclosure. People stops being abstract when the person you need to change is a scientist with a decade of hard-won method and a healthy distrust of any tool that offers to think for them. Programs stops being abstract when the choice between a commodity platform and something built on your own assay data is the choice between a faster competitor and a defensible one. The framework is general. Biotech is where getting it wrong shows up as a therapy that arrives late, or not at all.
Grade yourself on all three.
Score your company on Permission, People, and Programs this week, and start with the one you are worst at, not the one you like to show off.
If your governance is clean but your people work the way they did last year, you have Permission without People, and nothing has transformed yet. When you are ready to give this an owner, read the AI Product Partner.