Survey Results: We Don't Know What We're Doing With AI Adoption

Forbes

a day ago

It's coming up on three years since ChatGPT's public launch cracked open the current wave of AI adoption like a dam burst.
In that time, we've moved from being equal parts awestruck and alarmed by large language models to building copilots, chaining agents together, and now running entire agentic ecosystems within the enterprise. The corporate org chart has sprouted a new title when it gave birth to the Chief AI Officer, and every other C-suite role has quietly redefined itself. The enterprise rollout has begun in earnest, and while McKinsey recently found that Gen AI is yet to deliver enterprise-wide ROI, things are expected to change soon enough.
We've also seen the AI adoption industry professionalize almost overnight. There are thousands of courses from scrappy Udemy modules to MBA electives at the Ivy Leagues teaching executives and engineers how to deploy AI in their work. More CEOs now keep AI tools open on their desktops than they do Bloomberg terminals.
We've come a long way since November 2022. But the question of whether anyone really knows what they're doing with AI is still fair. The latest report from Anaconda, one of the pioneers of the ML revolution, suggests that we have much further to go.
Enterprises are putting security at the forefront of AI adoption
Let's start with the good news which is that we've matured from tinkering with AI to managing it like the enterprise IT asset it is.
According to Anaconda's survey of 300 AI practitioners and decision-makers, 82% of organizations validate open-source packages for security compliance. Documentation of model dependencies is up to 81%, and 70% now have some form of model drift monitoring in place.
This is a sign that lessons from past tech cycles have stuck. Security isn't being bolted on after the fact as it was before, instead, it's in the design from day one.
But this means security teams are also slowing some projects down. A quarter of respondents pointed to resistance from data science teams when security requirements are enforced, and over two-thirds reported deployment delays caused by security issues. To the surprise of no one in the field, the same tension that has dogged DevOps since its inception is alive and well in AI.
And even with these precautions, nearly 40% of organizations still frequently encounter security vulnerabilities in their AI projects. More than half have no automated anomaly alerts or A/B testing in production. There are more gaps for CAIOs, CIOs and CISOs to plug in than there are clear SOPs on how to do so, which leads us to the second set of insights from the report.
Keeping up with the Altmans: The treadmill of AI adoption
The speed of model releases is another point of strain. There's always a new launch, whether it's OpenAI's latest 'o' release, a Google Gemini update, or an open-source foundation model that's suddenly topping benchmarks. In fact, you could set your watch solely based on listening to the predictable waves of engineers across the industry sighing as they rewrite API calls and rerun integration tests.
Anaconda's data shows the cracks this pace creates. Only 36% of organizations say their business stakeholders can very effectively access information on a model's origin, components, and limitations. That means most people using these models, and in many cases making business-critical decisions with them, can't necessarily answer basic questions about how they work or where they might fail.
It's hard to blame them. The AI model supply chain is sprawling with open-source packages, pretrained models, cloud APIs, and proprietary fine-tunes, all stitched together with inconsistent documentation. Even within the same company, engineering may consider a lineage 'well documented' while compliance sees gaps big enough to halt an audit and the C-Suite can't find the words to sell their AI adoption process to their board.
If you don't know that a model miscounts the number of 'r's in 'strawberry,' you can't predict where else your AI stack might trip, and if you don't track which models have a tendency to drift after 90 days in production, you can't proactively retrain them before errors creep into customer-facing outputs.
For enterprise AI adoption to really take off, we need to urgently raise the 36% to as close to 100% as we can. That's the only way to move from using AI to knowing what we're doing with AI.
In 2025, the state of enterprise AI can be summed up like this. We're serious about security, getting better at documentation, and aware of the governance gaps. But we're still deploying tools faster than we're building the understanding to govern them.
This puts us at risk for more than regulatory trouble or embarrassing model errors. The lack of understanding of what AI models can do, and where they shouldn't be used, combined with the slow onset of ROI trickling in, can lead to a violent burst of the current AI bubble, freezing progress for years as leadership retreats from the tools until they are more battle tested.
A lack of understanding about the AI models can also lead to a creeping erosion of trust among customers, regulators, and employees, given how we can't fully explain the systems we've put at the core of our businesses.
Closing that gap is possible. It requires unified tools, clear policies, and a culture that treats governance as an enabler of innovation, not its enemy. It also requires knowing, with confidence, what's in your AI stack, where it came from, and how it's behaving in the real world.
Only then can we say, without irony, that we know what we're doing with AI adoption.