Enterprise AI strategy: how to adopt AI agents top down and bottom up

On September 29, 2026, the White House signed an executive order directing federal agencies to stop saying “artificial intelligence” and start saying “super intelligence.” And if you follow the AI space closely, you’ll remember Nvidia’s Jensen Huang stirring up the public a few weeks earlier with his three-word X post after the GPT-6 Astra launch: “AGI has arrived.”

Behind the name-dropping, we think the industry can agree on one thing: AI is more autonomous and capable than it was three years ago. Now that the demo phase is over, the question for every enterprise has changed from “Should we deploy AI agents?” to “How fast, and how securely, can we deploy them?”

In this article, we’ll discuss practical steps CIOs can take to deploy AI effectively and securely across the organization.

What do superintelligence and AGI mean for a CIO’s AI strategy?

They mean you should acknowledge the fact that AI is getting more advanced and can already outperform your teams in many tasks. For example, Google says 75 percent of its new code is now written by AI. Anthropic’s CFO puts their figure at over 90 percent.

So instead of debating whether superintelligence and AGI are hype or real, focus on redesigning your AI strategy and workforce around AI.

At xpander, we’re optimistic about this shift, and we think “superintelligence” is a better name for what we’re dealing with. “Artificial” was always a slightly wrong word. Artificial means not real, and for decades that was the reality: models were experiments, demos, machine learning algorithms you tuned for one task. What exists now is different. AI agents can take a goal, decide what to do next, use tools to act, and adjust when the results aren’t what they expected, without a person babysitting every step.

If you haven’t acted on this yet, you’re already behind. It’s like your competitor is using Excel and you’re using a calculator.

So the question isn’t whether to deploy agents. It’s how fast you can do it, and how securely and responsibly. Think about it the way you think about buying your people computers, Excel, and Word. You can’t imagine running the business without those tools. That’s where AI agents need to be, this year. Everything your company does, can be faster and better with agents in the loop.

How should enterprises approach AI adoption: top down or bottom up?

The short answer is both. Some decisions can only be made at the top. For example, a product team can’t sign a GPU contract, a sales team can’t decide where the company’s data lives, and no single department can set the security policy every agent has to follow. Those are CIO and executive decisions, and if nobody makes them, every team improvises its own answer and you end up with twenty incompatible setups. That’s the top-down half.

The bottom-up half is adoption itself: the people doing the work are the ones who know which tasks to hand to an agent, so they have to be the ones using agents every day. But that has to be enforced, not left to chance, because organic adoption is too slow and too uneven.

Leave either half out and you get what most companies have now: a few enthusiasts, a lot of pilots, but little real improvement in how the company works. You don’t just need more agents, yes. But you also need the right infrastructure to put them to work.

What are the four top-down decisions for enterprise AI adoption strategy?

1. Secure your compute

If you’re a very large enterprise, the first top-down decision is to make a commitment and buy GPUs, the processors that run AI models. Physical ones, if you can get your hands on them. If you don’t have the need or the budget for physical hardware, buy from cloud providers like Nebius, AWS, or GCP, and make sure you have access to the models you’ll need.

Compute is like electricity. It’s not even an advantage. You can’t run an office without power, and you can’t run agents without tokens.

There’s a shortage, not of literal electricity but of intelligence. World demand is outrunning capacity, and it’ll take four or five years before everyone gets enough. Until then, it’s your job as a leader to make sure the company has the resources it needs. Take care of your own grid, and don’t depend on one supplier for it. You won’t survive without access to power, and you won’t survive without access to intelligence.

One caution: buying compute from a hyperscaler like AWS or GCP is fine. Buying your whole agent platform from one is a different decision, and hyperscaler AI agent platforms are a double-edged sword: strong building blocks, but you’re tied to their model and cloud.

2. Own your data

The second top-down decision: be the owner of the data. Everything happening in your company with AI should be stored and captured. Every prompt being sent, every model call, every workflow, every tool, everything gets saved, and you own it.

If you fall under the EU AI Act, some of this is already required. If you don’t, make it a requirement anyway. It’s that important. Owning your data is what gives you the competitive advantage against your competitors, when it compounds.

3. Pair strict governance with open enablement

You can’t cut corners on governance. But agents also need access to real production systems to do useful work. That can make governance and enablement feel like a tug-of-war: lock everything down and agents can’t do their jobs. Open everything up and you expose the business to risk.

Most companies resolve the tension by letting agents do only low-stakes work. And that’s a trust issue.

In PwC’s AI agent survey, 38% of executives trust agents to analyze data and generate insights, but only 20% trust them to conduct financial transactions and 23% to escalate high-stakes decisions to a human. That gap is exactly what the tools below are meant to close.

You solve the trust issue not by shrinking what agents are allowed to do, but with the tools that let you trust them with more:

• Simulated data: so you can test an agent against a realistic copy of your world before it touches anything real. xpander also gives you mock data that you can use for experimentation.

• Deterministic human-in-the-loop: so this specific button cannot be pressed without a specific person approving it, and every other action runs without waiting.

• A policy on who can touch which button: set once and enforced on every agent, rather than negotiated agent by agent.

• An audit trail: so you can answer who pressed that button in the last 30 days.

If you have all those tools, you increase your level of trust, your level of confidence, and you get to a place where you can delegate more and more tasks. Good governance doesn’t reduce autonomy. It makes autonomy possible.

4. Run an open-weight strategy

An open-weight model is one whose trained weights are published, so you can download it and run it on your own hardware or cloud instead of calling a vendor’s API. Kimi, GLM, Qwen, DeepSeek, Llama, Meta Muse are the ones most enterprises will meet first. Alongside a multi-vendor strategy, you need a strategy that supports multiple open-weight models: your teams should be able to choose from an expanded set of LLM providers, open-weight models included, for whichever workloads they choose. Nobody will set this up for you, and if you don’t have the environment and tooling for it, you’ll fall behind on this axis too.

The reason for an open-weight model strategy is control. These models are the only way to be sure, one hundred percent of the time, that your data isn’t leaving your perimeter. It doesn’t go to OpenAI or Anthropic, for example.

One caveat: open weight on its own doesn’t give you that. The same Kimi or DeepSeek model is also served by neoclouds and inference services like Fireworks AI and OpenRouter, and if you call it there, your data is leaving your perimeter exactly as it would with OpenAI or Anthropic. The control comes from self-deploying the weights on your own hardware or your own cloud. That’s the only way to be sure, one hundred percent of the time, that your data stays where you put it.

Open-weight models are also cheaper. For example, you can move a workload from Opus 5.5 to GLM today and get the same results for about 95 percent less. Most companies can’t do it because they don’t have the skills, the enablement, or the governance to run their own models and hand their developers a clean API. Some can. We think it should be democratized, and that’s part of what xpander exists to do.

Bottom up: how do you drive AI adoption across enterprise teams?

You enforce it. Organic bottom-up adoption, where you hand out licenses and hope for the best, fails for a reason. People have very different levels of AI literacy. The enthusiasts automate their own work while everyone else waits, and six months later, you have a few impressive demos and no change in how the company runs. Enforced bottom-up adoption means leadership sets defaults that make agents part of the job for everyone. Here’s what that means in practice:

1. Agent before headcount

Start treating every hiring request as an agent experiment first. For example, when HR says it needs another recruiter, ask why. The answer will be something like: we can’t get through the CVs, we can’t interview fast enough, and we’re missing the hiring target. Fine. Run a two-week experiment with agents on exactly that problem. We’d bet you increase the team’s bandwidth without the hire.

2. Survey where the time goes

Ask people how they spend their week. You’ll find a long list of work that can be delegated to agents today, and those people will move to work that matters more.

3. Put the best AI on every desk

Install an AI tool on every employee’s computer, whether that’s Claude Code, Codex, Cursor, or ChatGPT, the same way you’d install email, and teach them to use it for everything they do now. The training is easy, because the interface is English. People start working faster, then they start automating pieces of their own jobs, and the effect compounds across the company.

Two rules make this work. First, you’re only as good as your tools. Buy the best the market has. If you buy weak models, people won’t use them. Second, meet people where they are. Don’t tell the team that Excel is gone as of Monday. Choose tools that work inside Word, Excel, and PowerPoint, and let workflows change at the pace people can absorb. This is the CIO’s job: pick the tool that lets the rest of the company keep working while it gets faster.

How do you get employees to actually use AI agents?

Two ways: turn on agents that work for people before they ask, and then let people build agents of their own.

The first is about making agents the default options for how people work. For example, turn on a personal AI assistant for every employee that sends a short brief before each meeting with the relevant company context. Have another one that watches the team’s shared documents and code and sends a digest of what changed and why it matters. Nobody has to opt in or ask the agents for anything. The work is delivered to them.

The second is about letting everyone build their own tools. Once people trust agents, they want their own: a marketer wants an agent that drafts campaign briefs from the CRM, a salesperson wants one that preps account research before a call, a finance analyst wants one that reconciles invoices. With today’s tools, domain experts can build no-code agents that engineers can ship by describing the job in plain language or by vibe coding a small app, without waiting for engineering.

What happens to your AI strategy when the models get better?

Nothing if the strategy was any good. If a model improvement forces you to redo your work, you had a bad strategy. It’s like an employee getting better at their job and you having no higher-value work to give them. That’s just…insane.

What you want, as a leader, is for every person and every agent to keep moving up: more judgment, more scope, more value. The infrastructure should make that automatic. Models will keep improving, and the moment they do, you should be able to click a button, or not even click a button, and have the improvement applied everywhere.

This is the real reason the four top-down decisions matter. Compute you control, data you own, governance that enables, and models you can swap: that’s a foundation that gets better every time the industry does, instead of one you rebuild every time.

If a model improvement forces you to redo your strategy, you had a bad strategy.

Where to go from here

Pick the top-down decision you’re furthest behind on and make it. For most companies, that’s compute. If you run your own data center or colocation, ask your VP of Infrastructure what GPU capacity, power, cooling, and networking you have today and what it would take to deploy open-weight models on it. If you don’t, have them get quotes from your existing cloud provider and at least one GPU cloud for dedicated capacity, pricing, and availability. Either way, you’ll have a real number in two weeks instead of a slide.

Then pick one department and run the agent-before-headcount experiment for two weeks. You’ll learn more from that than from another quarter of pilots.

If you want help running agents in your own environment, on your own GPUs or your own cloud, with the governance already built, that’s what we do.