Case Studies

Evidence base

Today's AI Adoption Stories

Five recent organizational AI deployments. Each card names the company, the year, what was deployed, and the outcome reported in public sources. Cases range from Level 1 shadow adoption to Level 3 designed integration.

Level 1 — Shadow Technology / Semiconductor

Samsung Electronics ↗

When governance is absent, exposure is invisible until it isn't.

Three engineers submitted proprietary source code and meeting transcripts to personal ChatGPT accounts within one month in April 2023. No policy governed this. Samsung had no visibility into what data had left the organization until after the fact. The data could not be recalled.

Do you know which AI tools your employees are using today — and which organizational data they've submitted to those tools?

Samsung banned all external AI tools, built an internal LLM (Samsung Gauss), then selectively re-admitted external tools under a governed protocol over two years. The arc — incident → ban → internal alternative → governed re-admission — is the most documented Level 1 exit path available. The Samsung incident was not unusual in scale: contemporaneous Cyberhaven research found that in a 100,000-person company, confidential data was being shared with AI services hundreds of times per week. (Cyberhaven, Q1 2024.) Most organizations move directly to re-admission without building the governance protocol the ban was meant to create space for. The ban without a governed alternative is as common a failure mode as the original leak.

Level 2 — Sanctioned Financial Technology

Klarna ↗

The mandate produced adoption. Adoption revealed quality failures. Quality failures required protocol. Designing protocol required slowing adoption. Leadership didn't want to slow adoption.

90% daily AI adoption in the first month. Two-thirds of customer service handled by AI. $40M in claimed profit improvement. Twelve months later, the CEO reversed course and began rehiring human agents, citing quality failures the absent governance layer could not address.

When your AI produces a wrong answer in a customer-facing workflow, does a defined process exist for catching it — or does someone fix it when they notice?

The financial results and the quality failures coexisted for longer than they should have. Cost savings from AI-handled volume were immediate and measurable. Quality degradation was diffuse and slow to surface — it required customers to complain, complaints to accumulate, and leadership to connect the pattern. That lag is the Level 2 trap: the metrics that look good are leading, and the metrics that matter are trailing. By the time the reversal became necessary, Klarna had already built the customer expectation that human support was gone.

Level 2 — Sanctioned Software / Commerce Platform

Shopify ↗

A mandate without a competency standard produces compliance theater. The reported adoption rate climbs; the governance maturity does not.

April 2025: CEO Tobi Lütke's internal memo declared AI use "non-optional" for every employee. Managers must demonstrate AI use before requesting additional headcount. The mandate produced an adoption signal but did not define what acceptable AI use looks like in non-technical roles. High adoption rate, unmeasured quality.

Does your organization's AI mandate include a definition of acceptable use — or just a directive to use it?

Shopify is mid-Level 2: broad AI access has been granted, the workflow design hasn't been done. Without competency criteria, every team interprets "AI use" differently. Some teams genuinely redesign; most layer AI on existing work and report adoption metrics. The Level 2 risk surfaces when financial results and AI claims accumulate alongside un-measured quality drift — the gap between what's reported and what's actually happening becomes the next year's audit problem. The reversal scenario plays out when an external incident or stakeholder forces leadership to define what they meant by "AI use" — at which point the absence of that definition becomes the story.

Level 2 — Sanctioned Airline / Customer Service

Moffatt v. Air Canada ↗

External parties hold the organization responsible for AI outputs regardless of internal disclaimers. The chatbot speaks for the company because the company deployed it.

February 2024: Air Canada's chatbot informed Jake Moffatt that bereavement fares could be claimed retroactively. Air Canada's actual policy did not permit retroactive claims. In court, Air Canada argued the chatbot was a "separate legal entity" responsible for its own statements. The British Columbia Civil Resolution Tribunal rejected the defense and ruled Air Canada liable.

If your AI-assisted customer-facing system tells a customer something that contradicts your formal policy, what's the customer's recourse — the chatbot, the policy, or the company?

Moffatt v. Air Canada became the canonical reference for AI-output liability — the first widely-cited tribunal ruling holding a company answerable for AI-generated statements. The "separate legal entity" defense became the textbook example of how not to handle AI-output liability. The implication for any organization deploying customer-facing AI: outputs in legally consequential functions need a review protocol the organization can defend in court — not a disclaimer that disclaims the AI itself. Air Canada's response after the ruling was operational (review and tighter constraints on the chatbot) rather than structural (a defined review protocol with named ownership).

Level 3 — Designed Aerospace / Manufacturing

Boom Supersonic ↗

When AI is embedded in the competitive position, governance shifts from controlling use to designing protocols that handle failure, versioning, and external dependencies while preserving the speed advantage AI provides.

mkBoom automates full aircraft structural analysis from a parametric configuration file. The design methodology depends on it. Removing AI from Boom's core workflows would require rebuilding them — not substituting a human. A design discovery — Boomless Cruise — emerged through AI-enabled iteration that would have taken months under previous methods. Zero safety incidents across the XB-1 program.

If your primary AI-assisted workflow stopped working tomorrow — would you pause it, or rebuild it?

Boom is a late Level 3 case, not Level 4 or 5. Their business model depends on AI; the aerospace industry does not depend on Boom's approach. Level 3 is organizational competitive reliance. Level 4 is when the industry itself cannot function at standard productivity without AI. Boom is the clearest documented case of an organization that designed its governance protocol alongside its AI capability — rather than after a failure forced it.

Historical patterns

Lessons from the Past

Five technology adoption arcs from earlier decades. Each card names the technology, the originating event or actor, and the protocol pattern that emerged. Cases span 1956 to 2005 and Levels 1 through 5.

Level 1 — Shadow Knowledge work

Visicalc and Excel ↗

Conventions nobody mandated became universal standards because the artifact carried its standards with it.

Visicalc launched in 1979 on the Apple II as the first recalculating-grid spreadsheet — an individual tool that finance and operations practitioners adopted for personal productivity. The product changed hands three times — Visicalc → Lotus 1-2-3 → Excel — but the file format and its conventions stayed in place. By 2026, more than a billion users run business operations through spreadsheet logic that nobody designed and no central authority approved.

Which AI conventions are already emerging in your organization within individual use? Should any be scaled?

Three structural properties let Excel's conventions spread by example: the file format was the standard; the artifact was pedagogical (open another team's pivot table and you learned how they thought); and no central authority gated adoption. Steven Levy's 1984 Harper's essay A Spreadsheet Way of Knowledge — linked above — was written while Visicalc was still the dominant package, before any convention had been institutionalised. It is the closest contemporary account of how an L1 substrate emerges.

Level 2 — Sanctioned Corporate communication

The Internet Tidal Wave (Gates, 1995) ↗

A written mandate lands when it sanctions what the periphery has been doing unofficially — and names concrete product-level specifics, not just a direction.

On May 26, 1995, Bill Gates sent a ~5,600-word internal memo to Microsoft's executive staff declaring "I assign the Internet the highest level of importance" and naming Netscape as the competitive threat. Twelve weeks later Microsoft shipped Internet Explorer 1.0 inside Windows 95; within two years Outlook and Exchange Server 5.0 had moved corporate mail decisively onto internet protocols. The memo ratified what Microsoft developers had already been doing unofficially for fifteen months.

What AI capabilities have been emerging on the periphery of your organisation and industry for the past twelve months? Are they ready for someone to champion?

The memo did not invent the strategy. Fifteen months earlier, Steven Sinofsky had sent an internal "Cornell is WIRED!" email after watching undergraduates use Mosaic; an April 1994 internet offsite and a 300-page briefing followed. By May 1995 Microsoft developers were already evaluating Mosaic and Netscape; consumer email was already on Hotmail and AOL. Gates's memo crystallised twelve months of practice into a dated, attributable mandate with specifics — browser, MSN repositioning, internet protocols inside the mail/server stack, content strategy.

Level 3 — Designed Software engineering

Git and the GitHub pull request ↗

The technology absorbs the coordination practice into the software itself. In git, the artifact and the conversation share one address, and the merge gate stays closed until the machine checks pass.

Linus Torvalds wrote the first version of Git in two weeks in April 2005 after BitMover revoked the Linux kernel's BitKeeper licence. Three years later, GitHub introduced the pull request: a Git branch wrapped in a discussion thread with inline review, approvals, and merge controls. By 2026 the PR-with-CI/CD workflow is the assumed shape of professional software work — roughly 100 million developers, present in essentially every IDE, CI service, and cloud development environment.

What are the new modes of collaboration that are becoming the default? How are your core business technologies absorbing that new pattern of collaboration?

Three properties did the work. The Git data model (content-addressed, branch-cheap, distributed) made it safe to experiment in branches and merge selectively. The pull-request UI (comments threaded against lines of diff, with approval state) made review a structured activity rather than a meeting. The CI/CD layer (machine-readable pass/fail signals attached to each commit) automated the routine parts of judgement. Coding agents producing PRs at scale — Stripe's "minions" reportedly ship ~1,300 PRs per week — are now stress-testing whether the existing review capacity is the constraint, and whether a new automated review layer needs to sit on top without losing what made the original workflow durable.

Level 4 — Infrastructural Supply chain

Walmart's EDI mandate (1988) ↗

A single buyer with enough market power can install a coordination protocol across an entire industry — if the spec is concrete, the deadline is enforceable, and the receiving infrastructure is built before the mandate ships.

In 1988 Walmart told its top suppliers: send purchase orders, invoices, and shipping notices via EDI (X12 transaction sets 850, 810, 856), or lose our business. Smaller suppliers had to invest in EDI infrastructure or be cut. The mandate cascaded: every major retailer copied Walmart's terms within a few years, and EDI compliance became a precondition for US retail shelf space. By 2026, EDI underlies roughly 95% of US supply-chain B2B document exchange.

Which of your industry's largest customers has the leverage to mandate AI capabilities and standards? Are you aware of the conditions on which the industry will demand these standards for you?

The mandate worked because Walmart paired it with operational specifics on its own side. The Bentonville distribution centres restructured around Advance Shipment Notifications: a supplier's truck arriving at a DC could be unloaded directly into outbound trucks (cross-docking) because the inventory data had arrived 24–48 hours ahead of the goods. Walmart's lead time on stock replenishment dropped from weeks to days; inventory carrying cost dropped accordingly. The Walmart playbook — pick the spec, set the deadline, make compliance a precondition for participation, then build the receiving infrastructure — has been reused by Toyota (kanban), the EU (e-invoicing mandates from 2019), and healthcare regulators (HIPAA EDI). The receiving infrastructure is what separates infrastructure-installation from compliance theatre.

Level 5 — Planetary Global logistics

McLean's Ideal X (1956) and the global container protocol ↗

A technology that succeeds at planetary scale becomes a background to the people who depend on it. This invisibility concentrates at chokepoints whose failure modes few plan for until they trigger.

On April 26, 1956, Malcom McLean sailed the SS Ideal X from Port Newark to Houston with 33 standardised steel containers welded to a converted oil-tanker deck. The maritime industry ignored him for a decade. In 1968 ISO 668 codified the 20-foot and 40-foot TEU dimensions globally. By 2000 essentially all manufactured-goods trade moved by container. By 2026 about 90% of non-bulk world trade moves through this standard — and a single ship grounding in the Suez Canal blocked roughly 12% of world trade for six days in 2021.

Where are the chokepoints in the AI-coordination infrastructure your organisation now depends on? How would you find out you had a single point of failure before the failure happens?

Containerization has reorganized civilization. Only now has it become apparent how the technology concentrated its failure modes at five geographic chokepoints — Suez, Malacca, Panama, Hormuz, the Bosphorus — whose physical capacity does not change with the volume flowing through them. The 2021 Ever Given grounding cost an estimated $9–10 billion per day for six days. The pattern that the container era makes legible: planetary protocols become invisible to their users, and the equivalent of an Ever Given event is what makes the chokepoint visible. Marc Levinson's The Box (2006) is the canonical history.