The seven AI questions mid-market operators keep asking me

Six weeks ago I was in a boardroom in Calgary answering the same seven questions I answered on a call to Bangkok in June, a Toronto meeting in July, and three separate conversations last week. Different industries. Different sizes. Same seven questions, in roughly the same order.

What follows is not the answer to each question. The tactical answer for every one lives on our AI & Digital practice page. What follows is the pattern I have started to notice sitting on the other side of the table ten-plus times this year, and what the pattern says about where the mid-market actually is on AI right now.

Question 1“Which AI should we actually be using?”

Everyone starts here. Almost nobody starts here well. The operator arrives with a single-vendor answer already selected, usually because their MSP told them to pick Copilot, or because someone on the leadership team uses ChatGPT personally. They frame the question as if they need permission to consider anything else. What they need is permission to run a portfolio.

“Which model” is not a religion question. It is a job-portfolio question, and most mid-market operators will end up running two or three. How we actually handle this →

Question 2“What’s our AI acceptable use policy supposed to cover?”

Operators treat the policy as the finish line. Download a template, fill in the blanks, get legal to sign off, done. The template covers two things (approved tools, allowed data) and misses four. The four it misses are the ones that get you into a difficult conversation with a client, a regulator, or a court.

The policy is not a document. It is a governance process, and the document is the artifact. How we actually handle this →

Question 3“How do we stop our client data leaking into a public model?”

This question always arrives about six months later than it should. By the time an operator asks it, someone in their organization has already pasted something they should not have into a consumer AI tool. The question is not preventative. It is remedial, and the operator does not always know that yet.

The failure mode is never the tool. It is the person on personal ChatGPT on a Saturday. Both layers, technical and cultural, have to move together. How we actually handle this →

Question 4“Can we make our own AI tool, or should we just use Copilot?”

The answer is almost always both. Copilot for the horizontal knowledge-worker use cases. Custom for the specific workflows where your business has a unique process, unique data, or unique language a general model does not understand well. Almost every mid-market operator has one or two workflows that fit. Almost none realize the threshold for “build something custom” has dropped this much.

Two-quarter builds with a team are now two-to-six-week builds with an API and an MCP server. The smallest useful build is usually smaller than the pitch decks are quoting. How we actually handle this →

Question 5“What’s MCP and does it matter for us?”

This question is a signal. When an operator asks it, they have been paying attention. When an operator has not heard of MCP, they are usually six months behind where they think they are.

The Model Context Protocol conversation separates operators treating AI as a productivity tool from operators treating it as an integration project. If your MSP cannot explain MCP in one paragraph, they are not thinking about AI beyond the demo. How we actually handle this →

Question 6“How do we govern this once it’s in the building?”

Operators who ask this ahead of a rollout succeed. Operators who ask it six months into a rollout are cleaning up incidents. There is no third group.

Governance is not a hurdle. It is what makes rollout possible in the first place, because it gives you a coherent answer when the CFO asks “who is allowed to use what, on which data, with which model, and how do we know.” How we actually handle this →

Question 7“Where does IT end and OT begin when AI is in the picture?”

This question comes from operators in energy, manufacturing, or anyone running real operations. When it comes, it comes because a controls engineer or a plant manager already raised it and nobody had a clean answer. Almost nobody in the MSP market is answering it. That is not an exaggeration. I have looked.

The operators who ask this question are ahead of their MSP. Which means they are usually looking for a different MSP conversation, whether they realize it yet or not. This is the question I care most about, because it separates knowledge-worker AI from the actual business. How we actually handle this →

The pattern behind the pattern

All seven questions have one thing in common. They are not really about AI. They are about whether your organization has the operational maturity to use AI without hurting itself. The AI is the newest surface. The maturity is what determines whether AI becomes an accelerant or a liability. AI does not create maturity. It reveals it, and it multiplies whatever it finds.

If you find yourself asking any of the seven above, you are asking the right questions. If you find yourself asking all seven in the same week, you are ready for the conversation.

James