Petri’s report on the survey describes broad confidence that AI spending and returns will continue to rise. Independent coverage from IT Pro adds the hard numbers that make the gap more concrete: 77% of surveyed IT leaders say business context is critical to accurate, relevant AI results, but 53% struggle to build that context into AI systems and workflows. Only 18% say business users have fully self-service access to cloud data.
Alteryx, whose research is being cited, says the study surveyed 1,400 IT leaders and identifies a small 7% group of organizations already ahead of the broader market. But the publicly accessible report page leaves important details behind its download form, including the survey’s field dates, respondent selection, the definition of a “return,” and the thresholds used to identify the advanced group. That does not invalidate the findings; it does mean that “most organizations are seeing ROI” should be read as a self-reported enterprise sentiment measure, not as independently audited evidence that AI projects are routinely producing net financial gains.
The ROI claim is less useful than the measurement discipline behind it
The headline that AI returns are growing is appealing, especially after several years of pilots that struggled to become operational services. But a productivity claim from an AI deployment can mean very different things: fewer minutes spent drafting a document, faster ticket routing, a lower support backlog, reduced external-services spending, or revenue that would not otherwise have occurred. Those are not interchangeable measures, and they can point in opposite directions once licensing, model usage, cloud infrastructure, data preparation, security review, and human validation are counted.
IT Pro reports that respondents most commonly measure AI success through productivity improvement, followed by cost reduction and revenue growth or wider business impact. That ordering is revealing. Productivity is comparatively easy to report because teams can estimate time saved; it is much harder to convert those hours into actual savings unless the organization can retire work, avoid hiring, reduce contractor expense, or move people into measurable higher-value activity.
For IT departments, the operational question should therefore be narrower than “Did our AI program create value?” Each production workflow needs a named owner, a baseline, a measurable target, and a cost ledger. A help-desk summarization feature might be measured by average handling time and post-resolution reopen rates. An AI agent that changes records in ServiceNow, Dynamics 365, or a line-of-business system needs additional measurements: exception rate, rollback rate, approval time, and the cost of human review.
Without that discipline, organizations risk treating consumption as success. An expanding number of Copilot seats, Azure AI calls, or agent prototypes may prove enthusiasm, but it does not demonstrate that the workflow is safer, faster, cheaper, or more accurate than the process it replaced.
Business context has to become an executable control
Alteryx and IT Pro use “business context” to describe the rules, definitions, thresholds, policies, and operational knowledge that people apply when making decisions. In a Windows and enterprise IT setting, that includes far more than a document repository or a retrieval-augmented generation index.
Consider a seemingly ordinary access-management request. Whether an employee should receive an application role may depend on their identity attributes in Microsoft Entra ID, department, manager, employment status, device compliance, location, segregation-of-duties policy, training status, and the risk classification of the target system. A natural-language assistant can summarize that policy. An agent allowed to act on it needs something more precise: authoritative sources, approved logic, clear escalation conditions, an audit trail, and a mechanism for handling conflicting or missing data.
The same problem appears in finance, procurement, security operations, and customer support. A model may correctly retrieve a policy yet still apply it to the wrong business unit, use an outdated exception, confuse a preliminary estimate with a binding figure, or overlook a rule that exists only in a spreadsheet maintained by an operations team. Those failures are often described as hallucinations, but many are really workflow-design failures: the organization has not converted its living business rules into testable, governed inputs and constraints.
This is why broad permissions and more connected data are not a cure. They can enlarge the agent’s view while also enlarging the chance that it retrieves contradictory information or exposes data that should remain compartmentalized. The practical objective is not “connect the AI to everything.” It is to define which source is authoritative for each decision, what data can be used, what conditions require a human approval, and how the action can be explained afterward.
Self-service data access remains a bottleneck, but unrestricted access is not the answer
The finding that only 18% of organizations have full self-service cloud-data access for business users is one of the report’s more useful figures. It helps explain why AI initiatives often appear to work in demonstrations but stall during deployment: the demo starts with a curated data set, while the production system encounters fragmented ownership, inconsistent identifiers, access restrictions, retention rules, and older systems that were never designed for automated consumption.
According to IT Pro, 38% of respondents describe a mixed model in which business users can access some data but still depend on IT or data teams for routine requests; another 15% say business users remain largely dependent on technical teams. That dependency becomes acute with AI agents. A chatbot can offer a generic response when a data connector fails. An agent tasked with closing an incident, approving a refund, or updating a business record cannot safely proceed on missing context.
The answer is governed self-service, not a bypass around IT. Teams should establish data products for common AI use cases: documented sources, named data owners, access controls, quality checks, retention requirements, change notifications, and clear business definitions. In a Microsoft-heavy environment, that could mean tying Entra ID groups and sensitivity labels to data access; documenting Microsoft Fabric, Azure SQL, SharePoint, and Dynamics 365 sources; and ensuring that an agent’s delegated identity cannot silently exceed the permissions of the user or service it represents.
The most important test is whether a business team can obtain approved, current information without opening an ad hoc ticket—and whether the platform can prove what the AI saw, what rule it applied, and what action it performed. If the answer to either part is no, the organization has not solved the data-access problem; it has only moved the bottleneck downstream.
Ownership cannot end at the AI platform team
The study’s central management problem is ownership. IT Pro reports that 71% of technology leaders believe AI initiatives work best when IT and business teams collaborate closely, yet strategy and delivery often remain concentrated in IT while business teams primarily define requirements. That split is familiar: IT is asked to secure, integrate, operate, and govern a service, while the business is asked to describe what it wants. Neither group independently owns whether the output remains correct after policies, data, and processes change.
AI systems magnify the weakness of that arrangement because business logic changes continuously. A finance policy is updated, a supply threshold shifts, a support escalation rule changes, or a compliance exception expires. If those changes live in meetings, email, undocumented spreadsheet edits, or tribal knowledge, the AI’s behavior will drift from the organization’s actual intent even if the model itself never changes.
A production AI workflow needs at least four accountable roles:
- The business owner must define the intended decision or outcome and approve the rules the workflow is allowed to apply.
- The data owner must attest to the source, freshness, quality, and permitted use of the data.
- The IT or platform owner must operate identities, connectors, logging, resiliency, and access controls.
- The risk, security, or compliance function must set boundaries for review, escalation, retention, and prohibited actions.
Those roles can sit in different departments. They cannot be left implicit. An agent without a clear owner becomes a difficult incident to investigate because nobody can say whether the problem was data quality, prompt behavior, a connector, an access control, a changed policy, or an unauthorized action.
Agentic AI makes the missing controls more expensive
Alteryx’s survey indicates high confidence in agentic AI’s potential, with IT Pro reporting that 93% of respondents expect measurable ROI within two years. The same coverage says IT operations and incident management are the leading expected targets for early automation. That is plausible: these functions contain repeatable actions, large volumes of telemetry, and familiar systems of record.
They also present a high bar for implementation. An agent that summarizes alerts or proposes remediation can be introduced with reviewer approval and measured against analyst workload. An agent that changes firewall rules, disables accounts, restarts services, alters endpoint policy, or closes incidents changes the organization’s risk profile. It needs least-privilege access, environment separation, approval gates for consequential actions, immutable logs, tested rollback procedures, and regular evaluations against known cases.
The most mature organizations in Alteryx’s framing are not simply spending more on models. They are building the operational machinery around them: better data access, defined governance, IT-business coordination, and measurement tied to outcomes. The vendor’s interest in emphasizing that approach is obvious—it sells analytics and governance tools—but the underlying conclusion is supported by the survey’s weakest numbers as well as its strongest ones.
AI ROI may be rising, but the usable lesson for enterprise IT is more demanding than “invest more.” Put business rules under change control, make authoritative data accessible within enforceable boundaries, assign ownership before deployment, and measure the full cost of the workflow. Otherwise, organizations will keep reporting promising pilot results while their most consequential AI systems remain too uncertain to trust.
