Every financial services boardroom is having the same conversation. AI is on the agenda, the budget is being found, and the question has shifted from whether to adopt to how fast. But the financial service organizations and credit unions that moving the fastest are not necessarily the ones best prepared … and the gap between ambition and readiness is starting to show up in the results.

Our research among senior technology and finance leaders found that 95% of generative AI initiatives are producing no measurable return, despite tens of billions invested. The reason is remarkably consistent: The operational foundation AI needs is missing. Intelligence, however capable, has to act on something. An AI that drafts a decision needs a workflow to route it. An AI that flags an exception needs a governed process to hand it to. Without that foundation, AI initiatives stall in pilots. They are impressive in demonstrations, but unable to touch the actual flow of work. It is telling that in the same research, 84% of CIOs and CFOs agreed that automating business processes is a necessary first step before implementing AI.

Regulators have reached a similar conclusion from a different direction. Rather than writing a new AI rulebook, supervisors across financial services are anchoring their expectations in frameworks institutions already know: third-party risk management, governance, safety and soundness, and operational resilience. The NCUA’s AI resources for credit unions, for example, point institutions toward established risk-management frameworks from NIST, COSO, and the Treasury – a clear signal that AI will be examined through the operational disciplines organizations are already accountable for. The message from both the market and the regulators is the same: AI transformation is an operational maturity question before it is a technology question.

Resilience lives in everyday processes

Operational resilience sounds abstract until you look at where it actually lives: in the routine processes that run hundreds of times a week. Five of these processes tell you almost everything about an organization’s readiness:

1. Change approvals. Every alteration to a system, policy, or procedure should pass through defined approval with an audit trail. In resilient organizations it does, automatically. In others, it depends on email chains that bottleneck under pressure, and get bypassed precisely when scrutiny matters most.
2. Purchase and spend approvals. Policy says every commitment needs the right authority. Practice, in too many organizations, says the request is sitting in an inbox. Where approvals stall, and why, should be visible in the moment, not reconstructed from email threads afterwards.
3. Employee onboarding and offboarding. How quickly a new hire becomes productive, and how completely a former employee’s access is removed, are resilience tests most organizations fail (often without anyone noticing). In a regulated institution, lingering access constitutes a formal compliance finding, not just an HR oversight.
4. Incident and request intake. When something goes wrong, does the report enter a governed flow – acknowledged, routed, escalated, tracked – or does its fate depend on who saw the email?
5. Regulatory and compliance approvals. The ultimate test: is your audit evidence a byproduct of daily work, or does it need to be reactively reconstructed for an examiner?

Not one of these processes is glamorous. But all of them are where resilience is won or lost, and every one of them is a process an AI agent will eventually touch. An organization that cannot run these consistently with people will not run them safely with AI.

What the foundation looks like in practice

The encouraging news is that building this foundation is neither exotic nor endless. It looks like Capital Group, one of the world’s largest investment managers. They built a business process management program that documents how work runs – creating the repeatable, scalable process knowledge that major projects and middle- and back-office teams depend on. Understanding your processes precedes improving them, and both precede automating them.

It looks like MMC Fund Administration, which replaced a handwritten client onboarding process – thousands of applications a month, difficult to track, heavy with risk – with an automated workflow. Throughput rose 50% in the first week, staff were freed for higher-value work, and training demands fell because the process itself now ensures the correct steps are followed.

And it looks like IQumulate Premium Funding, which automated more than 150 processes and reclaimed over 3,000 employee hours – capacity returned to client relationships rather than repetitive tasks.

Three different institutions, one pattern: they started with the processes, not the technology agenda. Each is now in a position most AI-ambitious organizations are not – able to introduce intelligence into work that is already visible, consistent, and governed.

Foundations first, then intelligence

This is the reframe worth taking to your next AI discussion: Operational resilience is not the cautious alternative to AI transformation. It is the enabling condition for it. Process management gives an organization an accurate, living picture of how work runs – the map that intelligence needs. Workflow automation makes execution consistent, auditable, and governable – the guardrails that intelligence requires. Institutions that build these capabilities are not delaying their AI journey; they are the only ones actually on it.

The work is incremental by nature. One high-friction process made visible, then consistent, then automated, each improvement returning value on its own while compounding toward readiness. That is a program any institution can start this quarter, on the systems it already runs.

See what an operational foundation for AI could look like in your organization – request a demo from Nintex.