FORGENIX // PLAYBOOK

FIVE PHASES. ONE PROTOCOL.

SERVICES is what you buy. PLAYBOOK is how it lands on the calendar: every engagement starts with an audit, the audit leads to a design, the design to your first solution in production, and every quarter the measured results feed the next cycle: five phases, one loop, with the security and data decisions made at the start. Each phase is backed by evidence from The Enterprise AI Playbook: Lessons from 51 Successful Deployments (Stanford Digital Economy Lab, April 2026).

PROTOCOL FGX/ADOPT-5 · REV 2026.10.3 · EVIDENCE BASE: 51 DEPLOYMENTS / 41 ORGS / 9 INDUSTRIES

CONTINUAL IMPROVEMENT // THE LOOP

The protocol follows the plan-do-check-act cycle behind ITIL's continual service improvement. OPERATE measures, OPTIMIZE decides what to change, and the next workflow starts from measured results, not from scratch.

Continual improvement loop: Audit, Design, Implement, Operate, Optimize — and back to the startCSICONTINUAL SERVICEIMPROVEMENTPLAN · DO · CHECK · ACT01AUDITPLAN · WHERE ARE WE NOW?baseline, roadmap, risks02DESIGNPLAN · WHERE DO WE WANT TO BE?target, security, acceptance03IMPLEMENTDO · TAKE ACTIONfirst release, go / no-go04OPERATECHECK · DID WE GET THERE?monitor, support, secure05OPTIMIZEACT · KEEP THE MOMENTUMtune, expand, raise autonomy↺ NEXT CYCLEContinual improvement loop: Audit, Design, Implement, Operate, Optimize — and back to the startCSICONTINUAL SERVICEIMPROVEMENT01AUDIT02DESIGN03IMPLEMENT04OPERATE05OPTIMIZE↺ NEXT CYCLE
01–03 · PROJECTfixed scope, signed off at every gate04–05 · SERVICEmonthly operation, quarterly improvement
  1. 01

    AUDIT

    // RUN THE NUMBERS▲ SRV·01 · AI AUDIT & STRATEGY1–2 WEEKS

    WE DO

    • Every engagement starts here: a fixed-scope teardown of how the business runs today
    • Legal, risk, IT security and the data owner join at kickoff — staff functions are the usual blockers, so they sit in governance from day one
    • Map systems, processes, data and compliance obligations — and recommend the optimal solution, AI or not
    • Score every integration point by ROI and risk and record baseline metrics; classify the data and choose where each class may run: on-premise, private cloud, air-gapped or public

    YOU GET

    • Systems, process and data map with AI-potential scores
    • ROI model, prioritized roadmap and a deployment model per data class
    • Baseline metrics for the chosen workflows
    • Time & budget estimate per deployment

    SECURITY GATE// data classified, deployment model chosen per data class.

    DATA// In 77% of studied deployments the hardest problems were process, data and change management — not the model — and failed first attempts had usually automated a broken workflow. The most frequent blockers were staff functions, not end users; a seat in governance turns them into enablers. — Stanford Digital Economy Lab, 2026

  2. 02

    DESIGN

    // SECURE BY DESIGN▲ SRV·01 · AI AUDIT & STRATEGY▲ SRV·08 · SECURITY▲ SRV·04 · PRIVATE AI1–2 WEEKS

    WE DO

    • Detail the solution for the first workflow on the roadmap: target architecture, integrations and data flows
    • Design the security: threat model, access model for people and agents, and where each control sits — DLP, gateway, approvals, logging
    • Choose and size the environment: deployment per data class, and model and hardware for private deployments
    • Agree how success is judged with the business owner: KPIs, baseline, test set and acceptance thresholds
    • Scope the foundation work the audit flagged (data, process, systems) and fix the scope and price of the build

    YOU GET

    • Design package: architecture, security design and integration spec
    • KPI targets and acceptance criteria agreed before anything is built
    • Fixed-scope plan and quote for implementation, foundations included

    SECURITY GATE// threat model, access model and control placement signed off before build.

    DATA// Only ~6% of deployments started with AI-ready data — winners built access layers over scattered systems instead of waiting for clean, centralized stores. — Stanford Digital Economy Lab, 2026

  3. 03

    IMPLEMENT

    // LIVE ON REAL DATA▲ SRV·04 · PRIVATE AI▲ SRV·05 · AI AGENTS & CX▲ SRV·06 · AI AUTOMATION▲ SRV·07 · AI SOFTWARE▲ SRV·09 · AI TRAINING5–10 WEEKS

    WE DO

    • Foundations first, if the design calls for them: data cleaned and structured for the workflow, process redesigned, blocking systems updated, environment stood up — SRV·02, SRV·03
    • First release straight onto real data and real users, in the environment the design chose — no interim PoC, no throwaway demos. It goes live within 2–4 weeks of the build starting. Where AI acts on its own, it starts in approval mode: a human confirms each action
    • Go / no-go on measured ROI against the audit projections
    • Wire CRM, telephony, billing and knowledge bases via APIs, RAG and MCP — each source's permissions enforced; admin UI, dashboards, reporting; train the people who run and use it

    YOU GET

    • Working solution in production, embedded in daily operations
    • Measured ROI vs audit projections and a go / no-go for the next workflow
    • Production integrations across your stack; trained users and operators + handover docs
    • Early life support after go-live: 30 days, 90 for custom platforms
    • Security evidence you can show a client or auditor

    SECURITY GATE// security review and adversarial test passed before each release; no go-live without trained operators.

    DATA// Every successful deployment in the study was iterative and started small, and the study counted only systems running in live workflows with real users. Its authors call the opposite pattern a “PoC factory”: pilot after pilot with no link to company strategy. — Stanford Digital Economy Lab, 2026

  4. 04

    OPERATE

    // KEEP IT RUNNING▲ SRV·10 · AI OPERATIONS & VALUE▲ SRV·09 · AI TRAININGMONTHLY

    WE DO

    • Monitor quality, cost per task, drift and security events; keep the AI inventory current — monthly retainer
    • Support users, fix issues, patch models and infrastructure, review access
    • Rehearse incident response with IT, security and the business: stop the agent, revoke access, isolate the system
    • Refresher training and onboarding for new joiners

    YOU GET

    • Ops dashboard with agreed KPIs
    • Systems that keep working after handover
    • Monthly service report: quality, cost, incidents

    SECURITY GATE// monitoring, patching, access reviews and incident drills on a schedule.

    DATA// Escalation-based operation, where AI handles the volume and humans review exceptions, delivered more than twice the productivity gain of approve-everything setups. The durable advantage came from the process and platform around the model. — Stanford Digital Economy Lab, 2026

  5. 05

    OPTIMIZE

    // TUNE, EXPAND, RAISE AUTONOMY▲ SRV·10 · AI OPERATIONS & VALUE▲ SRV·07 · AI SOFTWARE▲ SRV·09 · AI TRAINING▲ SRV·01 · AI AUDIT & STRATEGYEVERY QUARTER

    WE DO

    • Quarterly value and risk review: measured results against the KPIs agreed in DESIGN
    • Tune prompts, workflows, models and cost per task from an improvement backlog ranked by payback — every change re-evaluated before release
    • Raise autonomy stepwise: approval → escalation → agentic
    • Expand: replicate to adjacent departments on the shared foundation, or productize as a multi-tenant platform; set a sponsor cadence and name champions in each team
    • Refresh the roadmap with your fractional AI lead; the next cycle starts again at AUDIT

    YOU GET

    • Improvement backlog ranked by payback
    • Rollout across functions — or a tenant-ready platform
    • Quarterly value, model, cost and security review
    • A refreshed roadmap with the next cycle scoped

    SECURITY GATE// every change re-evaluated before release; data and access separated per department or tenant before each rollout.

    DATA// Every organization-wide transformation in the study tied AI adoption to corporate OKRs and incentives. Executive sponsorship was the accelerator cited most often, ahead of existing infrastructure and willing end users, and the sponsors who made a difference cleared blockers every week. — Stanford Digital Economy Lab, 2026

NOTE// custom platforms and SaaS go through the same five phases. IMPLEMENT simply runs longer, typically 2–6 months, and ships in increments; see SRV·07 // AI SOFTWARE DEVELOPMENT.

LOOP// OPTIMIZE closes the loop: the quarterly review refreshes the roadmap, and the next cycle starts again at AUDIT from the measured baseline. The protocol is a cycle, not a line.

NOTE// foundations first: when the audit finds that process, systems or data block AI, the design scopes the fix and implementation starts with it — see SRV·02 // PROCESS & SYSTEMS REDESIGN and SRV·03 // AI DATA & KNOWLEDGE READINESS. Sometimes the right answer is no AI at all.

SYS// phase gates are exit criteria, not dates.
GET FREE AI READINESS SCAN