Why AI pilots stall before production

Adoption is not production

By most measures, AI adoption is no longer the question. McKinsey's 2025 global survey finds that 88% of organisations use AI in at least one business function. Only 39% report any impact on earnings at the enterprise level, and about 6% qualify as high performers, attributing 5% or more of EBIT to AI.¹

The Gulf follows the same curve. McKinsey's survey of GCC executives and board directors, published in November 2025, finds that 84% of organisations have adopted AI, 31% are scaling it, and 11% are "value realizers" that attribute at least 5% of earnings to it.² More than two-thirds are not yet scaling it.

The attrition happens between the demonstration and the operation. In a survey of more than 1,000 organisations in North America and Europe, S&P Global Market Intelligence reports that the share of companies abandoning most of their AI initiatives before production rose from 17% to 42% in a year, and that the average organisation scrapped 46% of its proofs of concept before broad adoption.³

The region's own data points to execution, not intent. Among GCC organisations that are not yet realising value, 72% report strong strategic alignment on AI. Far fewer report strong foundations where the work gets done: 43% for talent and operating model, 41% for change management and 37% for technology and data.² The GCC is not behind on AI adoption. It is behind on AI production.

Six layers around the model

When analysts name the reasons projects die, the model rarely appears. Gartner predicted that at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025, "due to poor data quality, inadequate risk controls, escalating costs or unclear business value".⁴ RAND's interviews with 65 data scientists and engineers found models optimised for the wrong metrics, or that do not fit the business workflow, among the root causes of failure.⁶ BCG's rule for AI leaders puts 10% of resources into algorithms, 20% into technology and data, and 70% into people and processes.⁵

Astra Via reads this as six layers around the model. Each is a condition for production, and each is owned by someone other than whoever built the model.

• Integration. The workflow reads from and writes to the systems the team already uses: ERP, CRM, email, shared drives, the spreadsheet that really runs the process.
• Data. Inputs arrive as PDFs, email threads and half-filled fields. Someone has to turn them into records the workflow can rely on, including the worst ten percent.
• Approvals. Somebody decides which steps a person signs off, who that person is, and when the gate can come off.
• Governance. Access, logging, residency and the model endpoint have to pass the organisation's security and legal review.
• Ownership. A named business owner is accountable for a number that has a baseline.
• Economics. The cost of each run is known and compared with the value of each run. Gartner warns that generative AI costs are less predictable than those of other technologies.⁴

Where a pilot actually stalls: one workflow, six gates

Take a workflow Astra Via is running with a finance team: following up overdue receivables. In a demo, the model reads the list of open invoices and drafts a polite, accurate reminder in a few seconds. The pilot works. Production is a different matter, and the model is not the reason.

• Integration. The workflow needs read access to the accounting system and write-back to the CRM so the finance team sees what was sent. Access sits in an IT queue, and the CRM has fields nobody fills in.
• Data. The contact on file has left the customer, or was never the person who pays. Disputed invoices sit in the same list as forgotten ones. Names appear in Arabic and in two or three Latin spellings.
• Approvals. No one in finance will let an AI-written message reach a customer unread. The design question is who approves, what they can change, and on what evidence the gate comes off.
• Governance. Customer names, amounts and contact details are personal and commercial data. Security asks where the model runs, where logs are kept and who can see them.
• Ownership. Someone owns the overdue book and the number that measures it. If that number was not recorded before the pilot started, nobody can say afterwards whether it moved.
• Economics. Each run costs model calls and review time. Set against cash recovered and hours saved, it may well pay back, but only a modelled number survives the budget review.

None of these is a model question. Each one is manageable when it is planned in the first week, and expensive when it is discovered at the end. The same pattern appears outside finance. In a cover-generation system Astra Via built for a marketing team, the first obstacle was not image quality. It was that brand rules had to be re-explained every session, and nobody recorded why a creative was rejected. The fix was a rules document read at the start of every run and a log of every decision, both owned by the client's team.

The MENA overlay

A pilot that would clear these gates in London can still stall in Riyadh or Dubai. Three regional factors change the governance and data layers in particular.

Data rules are real, and in places still settling. The UAE's federal data protection law, Federal Decree-Law No. 45 of 2021, has applied since January 2022, but practitioner guides note that its implementing regulations had still not been issued in 2026.⁷ In the absence of detail, legal and security teams tend to default to "wait". Inside the DIFC, Regulation 10 of the Data Protection Regulations adds specific requirements for autonomous and semi-autonomous systems, including notices and a register of the AI systems in use.⁸ For licensed financial institutions, the UAE Central Bank's February 2026 guidance note expects documented governance, an inventory of AI models and human oversight, including the customer's ability to request human review of an AI decision.⁹ In Saudi Arabia, the Personal Data Protection Law has been in force since September 2023, with its one-year grace period ending in September 2024; transferring personal data outside the Kingdom requires adequacy or approved safeguards.¹⁰

In-region compute is arriving in stages. Microsoft has operated cloud regions in the UAE since 2019.¹¹ Google opened regions in Doha and Dammam in 2023.¹²¹³ Microsoft's Saudi Arabia East region opens to customers in November 2026, and AWS's first Saudi region is due in December 2026.¹⁴¹⁵ For a workflow that handles Saudi personal data, the choice of in-country hosting widens considerably from the end of 2026, although which models each region offers still has to be checked case by case. Pilots that stalled on residency may become deployable in 2027.

The data is bilingual, and so are the channels. In Astra Via's and Acquisit's work, the everyday inputs are Arabic and English invoices, contracts with mixed-language clauses, customer names transliterated several ways, and customers who reply on WhatsApp rather than email. None of this is exotic. It is simply work that a model tested on clean English samples has never seen, and it belongs in the data and integration design from the first week.

The region's executives already name these risks. Among GCC respondents, 68% cite cybersecurity as a top generative AI risk, 53% inaccuracy and 47% personal privacy.² A better model reduces some of these risks; the governance, data and approval layers are what contain them.

What the organisations that reach production do differently

The evidence on what works is consistent across sources, and none of it is about choosing a better model.

• They redesign the workflow instead of adding a tool. Of 25 attributes McKinsey tested, the redesign of workflows had the biggest effect on whether organisations saw EBIT impact from generative AI. At the time, only 21% had fundamentally redesigned even some of their workflows.¹⁶
• They design human validation in. High performers are more likely to have defined processes for when and how model outputs need human validation.¹ In UAE financial services, this is now also a regulatory expectation.⁹
• They give each use case an owner, a baseline and a stop rule. A chief AI officer quoted in the GCC report puts it plainly:

"Every use case must have a clear definition of success… If it's successful, it moves to the business team for ownership. If not, we stop and move on."Chief AI officer, quoted in McKinsey and GCC Board Directors Institute, November 2025²

• They centralise expertise and embed delivery. McKinsey research on financial institutions, cited in the GCC report, found that 70% of those with centralised generative AI operating models had moved pilots into production, against about 30% of those with decentralised approaches. Proximity to the business through cross-functional teams remained critical.²

Why deployment is moving inside the client

The market has reached the same conclusion. Job postings for forward-deployed engineers, who work inside a customer's team to take AI into production, rose more than 1,000% in the first eight months of 2026 compared with the same period a year earlier, according to Lightcast data reported by Fortune.¹⁷ In May 2026, OpenAI launched the OpenAI Deployment Company, a standalone unit backed by more than US$4 billion of initial investment, to embed such engineers in client organisations.¹⁸

When a model maker commits billions to people who sit in the client's office, it is a clear signal about where the constraint lies. It also describes how Astra Via works. The team is embedded, inspired by the forward-deployed model, and shaped to the need: a strategist to scope and own the result, engineers to build in the client's own tools, and Acquisit's data and marketing specialists where the use case calls for them. The work moves one workflow at a time, and every result is read against a baseline.

Before building, seven questions

Most stalled pilots could have been diagnosed in the first week. Seven questions, answered before anything is built, cover the six layers and add the one most projects skip: when to stop.

1. Who owns the number this workflow should move, and what is that number today?
2. Which systems will it read and write, and who grants that access?
3. What does the real input look like, including the worst ten percent?
4. Which steps need a person's approval, who is that person, and what would let the gate come off?
5. Where will the data and the model calls run, and which rules apply there?
6. What does one run cost, against the value of one run?
7. What result, by what date, stops the project?

A pilot proves that a model can do the task. Production proves that the organisation can.

Sources

1. McKinsey & Company, "The state of AI in 2025: Agents, innovation, and transformation", November 2025 (1,993 respondents). mckinsey.com
2. McKinsey & Company and GCC Board Directors Institute, "The state of AI in GCC countries: In pursuit of scale and value", November 2025 (139 executives and board directors). gccbdi.org
3. S&P Global Market Intelligence, "AI experiences rapid adoption, but with mixed outcomes: Highlights from VotE: AI & Machine Learning", 2025. spglobal.com
4. Gartner, "Gartner Predicts 30% of Generative AI Projects Will Be Abandoned After Proof of Concept By End of 2025", press release, 29 July 2024. gartner.com
5. Boston Consulting Group, "AI Adoption in 2024: 74% of Companies Struggle to Achieve and Scale Value", press release, 24 October 2024. bcg.com
6. RAND Corporation, "The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed", RR-A2680-1, 2024. rand.org
7. Chambers and Partners, "Data Protection & Privacy 2026: UAE, Trends and Developments". chambers.com
8. DataGuidance, "Dubai International Financial Centre" jurisdiction overview, including the DIFC Data Protection Regulations and Regulation 10. dataguidance.com
9. Central Bank of the UAE, "Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.", February 2026. rulebook.centralbank.ae
10. DLA Piper, "Data Protection Laws of the World: Saudi Arabia". dlapiperdataprotection.com
11. Microsoft Azure Blog, "First Microsoft cloud regions in Middle East now available", June 2019. azure.microsoft.com
12. Google Cloud Blog, "New Google Cloud region now open in Qatar", 2023. cloud.google.com
13. Google Cloud Blog, "Google Cloud expands services in Saudi Arabia, delivering enhanced data sovereignty and AI capabilities". cloud.google.com
14. Microsoft Source EMEA, "Microsoft Announces That Saudi Arabia East Datacenter Region Will Be Available in November 2026", August 2026. news.microsoft.com
15. Amazon, "AWS to launch first cloud infrastructure region in the Kingdom of Saudi Arabia by December 2026". aboutamazon.com
16. McKinsey & Company, "The state of AI: How organizations are rewiring to capture value", March 2025. mckinsey.com
17. Fortune, "One of the fastest-growing jobs in Silicon Valley sends engineers straight to customers' offices to get AI up and running", 3 September 2026. fortune.com
18. OpenAI, "OpenAI launches the OpenAI Deployment Company to help businesses build around intelligence", May 2026. openai.com