What is an AI Commercial Brain?

An AI Commercial Brain is CSM’s name for a connected way of using company knowledge, business systems and AI agents to get work done. It combines reliable information, agreed rules, coordinated workflows and a workspace where people can inspect, correct and approve the work.

The term describes an approach, rather than a model that magically understands the whole company. It does not require one enormous database or unrestricted access to every document. A useful first version supports one important process, uses the information that process needs and makes responsibility clear.

For a leader, the test is practical: can the next authorised person pick up the work, understand the evidence and move it forward without finding the colleague who remembers how everything works?

Why can individual AI success create problems for the business?

An employee may save time drafting proposals or analysing spreadsheets while the surrounding process becomes harder to maintain. The useful instructions can remain in a personal chat. A home-built application may connect to live records without an agreed owner. Different departments may teach different assistants conflicting definitions of a customer, a sale or an approved price.

The initiative is worth preserving. The next step is to make the valuable parts reusable and accountable. Ask which experiments now influence a customer commitment, a financial figure or a shared record. Those are the places where a personal productivity tool starts to become business infrastructure.

CSM looks at four recurring problems: security exposure, unclear authority, disconnected information and dependence on key people. An application working in a demonstration does not establish that it is secure, recoverable or suitable for daily operations.

What should leaders do about AI tools already in use?

Start with a practical inventory, involving the people using the tools. Record the task, business owner, account owner, information uploaded, systems connected, actions permitted and the person responsible for support. Include spreadsheets with AI features, custom applications and automated workflows, as well as obvious chatbots.

Then assess each use according to its consequences. Drafting an internal outline needs different controls from changing customer records or sending a commercial proposal. Give staff an accessible route to ask questions and get useful experiments reviewed; an inventory built through blame is likely to miss the very systems leadership needs to understand.

The NIST AI Risk Management Framework includes maintaining an AI system inventory and defining responsibilities. It provides a useful reference for this work. An inventory alone is not a security assessment or a guarantee of compliance.

How does CSM decide where to start?

Discovery follows a real piece of work from its first request to its finished result. For an enquiry-to-order process, we would examine how requirements arrive, who clarifies them, where prices come from, who approves exceptions and what delivery receives once a customer agrees.

Bring representative records and the people who do the work. A leadership description of the process can differ from what happens when a document is missing, a customer changes the scope or the usual approver is away. Those exceptions reveal the decisions and knowledge a dependable system must support.

The output should make the next decision easier: the current bottleneck, the proposed improvement, the information required, the accountable owner and the evidence that would demonstrate success. It should also identify what can be improved through existing software or a simpler process change.

How does the five-part opportunity scorecard work?

CSM uses five lenses to make the discussion explicit. Commercial impact asks whether the work affects revenue, margin or cash. Time and capacity asks what useful capacity remains after review and correction. Dependence on key people asks what stops when a particular colleague is unavailable. Risk of doing nothing considers the consequences of leaving the process as it is. Readiness examines information quality, ownership, effort, costs, team support and the controls needed to act safely.

Scoring each area from one to five makes assumptions and disagreements visible. It is a discussion aid, not a validated prediction of return or a universal formula. Agree what the scale means, record the evidence and avoid treating a small numerical difference as more precise than the underlying judgement.

A high-value quoting process may need pricing ownership resolved before implementation. A simpler reporting task may be ready to pilot immediately. A serious access-control weakness may require attention regardless of its time-saving potential. Readiness and unacceptable risks should influence the decision, rather than disappearing inside an average score.

What does “data first” mean in practice?

It means agreeing what information can be trusted for the work. Identify which system owns each record, how records match across systems, what key terms mean, who updates the information and how outdated versions are retired. For a quotation, that might include the customer record, current requirements, approved rates and the applicable terms.

You can begin with the information needed for the first workflow. A business does not have to clean every historical file before trying AI. Equally, an agent cannot resolve an internal disagreement about which price list is authoritative simply by reading both copies.

A warehouse can support reporting across structured records, while approved documents and procedures provide explanatory context. Some information can stay in its existing system and be retrieved when needed. The architecture should follow the use case, freshness requirements and permissions. See how to connect business data for AI.

Does shared knowledge mean everyone can see everything?

No. Shared means available to the right people and workflows under agreed conditions. Customer confidentiality, department access and project boundaries still apply. An assistant should not expose a document to someone who lacks permission to read it directly.

Useful knowledge also needs a review process. If an estimator corrects an exclusion or a finance colleague explains an exception, capture the context, have the responsible person approve it and specify where it applies. Do not silently turn every chat message into a company rule.

Making corrections reusable is managed knowledge maintenance. It does not necessarily mean retraining a model, and it should not imply that the system continuously learns correct business policy without supervision.

What does the orchestration layer actually do?

Orchestration coordinates the steps: what starts the workflow, which information is retrieved, what the agent prepares, which rules are checked and who approves the next action. It also defines what happens when a connection fails, evidence conflicts or a request falls outside the agreed scope.

Consider an illustrative customer enquiry. The system gathers the requirements and relevant customer history, flags missing details and prepares a draft scope. It obtains approved pricing from the designated source. A reviewer sees the evidence and exceptions before approving the quotation. Once agreed, the authorised scope and supporting records move to delivery and finance.

The model can help interpret language and draft an explanation. Controlled calculations and approval rules should determine prices and permitted actions where those rules are explicit. If a connection times out, the workflow should establish whether the action succeeded before retrying, so a recovery does not create a duplicate record or send the same message twice.

How do you give agents useful access without giving them too much authority?

Define permissions for the actual job. An agent preparing a proposal may need to read customer details and draft a document; it does not automatically need authority to alter prices, export the customer database or send the final offer. Keep the approval check in the system performing the action, rather than relying only on a prompt telling the model to ask first.

OWASP’s guidance on excessive agency recommends limiting functionality and permissions and requiring human approval for consequential actions. In practice, the reviewer needs to see what will happen, the supporting evidence and a meaningful way to reject or change it.

For custom or AI-assisted applications, review authentication, permissions, secrets, dependencies and failure handling before connecting live business systems. Establish logs, a support owner and a way to stop the workflow. These controls must be tested against realistic misuse and failure scenarios; a reassuring interface is insufficient evidence.

How do AI workspaces reduce dependence on key people?

A useful workspace brings instructions, evidence, drafts, approvals and unresolved exceptions together. The next authorised colleague should be able to see the state of a job and understand why a decision was made. Essential business knowledge should not exist only in one employee’s private conversations or personal account.

Continuity also depends on the operating arrangements. Agree ownership of accounts, source code and configuration where applicable, and document integrations, access permissions, maintenance tasks and recovery procedures. These points belong in the implementation scope and handover, alongside any ongoing support and third-party costs.

A practical acceptance test is to have a second trained colleague run the process using the documentation. Include an exception and a recovery task. If the original builder still has to explain each step, the capability is not yet sufficiently transferable.

How should the pilot be measured?

Establish a baseline before changing the workflow. Measure completed work, elapsed time, review effort, errors, rework and the commercial outcome the project is intended to improve. Logins and the number of agents built do not establish business value.

For example, an illustrative process handling 300 requests a month at 20 minutes each consumes 100 hours. If the new process takes eight minutes of handling and review per request, that is 40 hours. Allowing a further ten hours for maintenance and exceptions leaves an estimated 50 hours of net capacity released. This is an example calculation, not a CSM result or a guaranteed saving.

Include software and support costs, adoption and the value of the capacity returned. Time released is not automatically cash saved. Test ordinary cases, missing information, conflicting instructions, revoked access and failed connections. Agree acceptance criteria before rollout and expand only when the evidence supports it.

What does working with CSM involve?

CSM brings business-process discovery, software engineering, automation and AI expertise into the same engagement. The sequence is to map the work, prioritise the opportunity, establish the required data and knowledge, build the coordinated workflow and help the team use it through a controlled pilot and iteration.

The client still needs an accountable business owner, access to representative information and people who can define good work and make decisions. A fractional specialist team provides implementation capability; it does not remove leadership’s responsibility for priorities or approvals.

Start with one recurring process where people search, retype, wait or check. Bring an example to a digital discovery workshop, identify what a better result would look like and work backwards through the information and decisions required. For more detail, explore choosing workflows to automate and building trustworthy AI assistants.