McKinsey, Deloitte, Accenture Sold the Same AI Strategy — It Wasn't Strategy
Three reports landed on my desk this quarter. Different boards, different industries, all three commissioned a Big Three firm to deliver an AI strategy — and all three got the same five-year roadmap. A roadmap tells you what to buy. A strategy tells you where you'll win. Most boards are approving the first while believing they bought the second.
The Promise
- The difference between a strategy and a roadmap is teachable in ninety seconds, and it sorts with three questions: does the document name what you will not do, does it price the path in your own numbers, and does it explain why this company wins rather than the next one.
- A roadmap inside a strategy is fine. The failure is the missing layer above it, and that layer can be added without throwing anything away.
- The fix at each tier is cheap. Executives run their own document through the filter before it leaves the desk; IT leaders audit funded initiatives against the source-of-advantage test; directors add the three questions to the AI section of every quarterly board pack. Management adjusts what it brings within one quarter.
The Risk
- PwC asked 610 companies why their AI deployments weren't generating measurable ROI. 87% of the answers came back to one root cause: the deployment was built around a vendor roadmap rather than a business question. The company knew which tool to roll out next. It did not know what problem the tool was meant to solve.
- Forrester found that of ten Fortune 500 CEOs who told the market AI was driving headcount reduction, nine had no internal AI capability mature enough to support the claim. The announcement was the strategy.
- Between 2010 and 2015 the same firms sold boards next-generation security strategies that were perimeter-vendor product roadmaps with a fresh cover page. Target 2013, Home Depot 2014, Equifax 2017. Several directors who approved those strategies faced shareholder derivative actions within eighteen months — and the actions cited the directors, not the vendor.
- The consulting firm signs the engagement letter and the board signs the approval. The firm walks away with the fee; the board walks away with the proxy disclosure. Only one of those two signatures carries personal liability.
The same deck, three times
Three reports landed on my desk this quarter. Different boards, different industries, all three commissioned a Big Three firm to deliver an AI strategy. All three got the same five-year roadmap.
Stage one, foundational AI literacy. Stage two, pilot use cases. Stage three, enterprise platform selection. Stage four, agentic adoption. Stage five, AI-native transformation.
You have seen the deck. Some of you have approved the deck.
Different logos, different industries, different cover pages, and the argument inside is interchangeable. Those are not strategies. They are vendor roadmaps in board-deck clothing.
Three research firms, one pattern
PwC asked 610 companies why their AI deployments were not generating measurable ROI. 87% of the answers came back to the same root cause: the deployment was built around a vendor roadmap rather than a business question. The company knew which AI tool to roll out next. It did not know what problem the tool was supposed to solve.
Forrester ran a separate study on AI layoff announcements through 2025 and early 2026. Of ten Fortune 500 CEOs who told the market AI was driving headcount reduction, nine had no internal AI capability mature enough to support the claim.
Gartner now forecasts that by 2027, half of the customer service organisations publicly justifying job cuts with AI will quietly rehire the cut roles. That forecast is not about capability. It’s about the gap between what was approved and what was actually built.
Vendor roadmaps are being delivered to boards as strategy because real strategy is harder, slower and politically expensive. A roadmap looks like progress. A strategy looks like a fight.
I have watched this exact movie before
After 25 years in cybersecurity, I can tell you when it last ran. Between 2010 and 2015 the same firms sold boards next-generation security strategies that were product roadmaps from the perimeter-security vendors of the era, with a fresh cover page and a logo swap. The boards approved them.
Target was breached in 2013, Home Depot in 2014, Equifax in 2017. The roadmaps did not survive the first real adversary. Several of the directors who approved those strategies faced shareholder derivative actions within eighteen months, and the actions did not cite the vendor’s roadmap. They cited the directors who approved it as strategy.
The pattern compresses with AI. The roadmap arrives faster. The breach equivalent — a failed deployment, a regulatory finding, an investor write-down, an EU AI Act inquiry — arrives faster too. So does the fiduciary question: did the board approve a strategy, or a procurement schedule that someone called a strategy?
The Decision-Maker Filter
A strategy and a roadmap are different objects. A strategy answers where do we win, and what are we giving up to win there? A roadmap answers what gets delivered, and in what order? A strategy can contain a roadmap. A roadmap cannot contain a strategy.
Three questions sort them.
The choice test. A strategy explicitly says what the company will not do — it names the opportunities being declined and why. A vendor roadmap pitches every use case as compatible. No explicit no-gos, no strategy.
The trade-off test. A strategy names the cost of the path chosen, in money, in capability, in opportunity. A vendor roadmap presents the path as all upside with implementation as the only friction. No real costs surfaced, no strategy.
The source-of-advantage test. A strategy explains why this company wins by doing this thing. A vendor roadmap explains what the vendor ships next year. If the document could be lifted onto a competitor’s letterhead and still read sensibly, it isn’t your strategy. It’s the vendor’s.
What the filter does at each tier
If you are an executive, the filter applies to your own document before it leaves your desk, and the choice test is the hard one. Naming what your company will not do with AI is politically expensive, because it tells parts of the organisation that their pet project just lost. In my experience, the executives who get this right pair every AI yes with a published AI no — one use case in, two adjacent ones explicitly declined. The board sees both, and the trade-off becomes legible.
If you are a CIO, CTO or chief data officer, your tier has a different failure mode: the roadmap can be technically correct and strategically empty. Three pilots that all prove the same thing. Five vendor evaluations that converged on the same shortlist. A multi-year platform commitment built on a six-month proof of concept. The IT tier owns the question of whether the roadmap delivers competitive advantage or merely operational completeness, and most deployments fail at the second.
If you are a board director, three questions land hardest. Show me what we decided not to do. Show me the cost of this path in our own numbers, not the vendor’s case study. Show me why this is our advantage rather than the next company’s. If management cannot answer those on the spot, the document in front of you is something other than a strategy.
Why 2026 and not 2023
The regulatory window has compressed. The EU AI Act became fully operational on 2 August. SEC AI-related enforcement is ramping. State attorneys general are filing AI-related actions in growing numbers. The boards that approved vendor roadmaps as strategy in the last 24 months are the boards whose minutes get subpoenaed first when something breaks.
Twenty years ago boards delegated cybersecurity understanding to the technical team. Then breaches started landing in proxy statements, then in fiduciary lawsuits, then in personal director liability. AI is following the same arc on a compressed timeline.
AI is real. The capability is real. The productivity opportunity is real. What is being delivered to most boards as AI strategy is consulting product — sold by the hour, billed by the deliverable, structured to make the engagement legible to procurement. Strategy is the opposite of legible. Strategy is the choice your competitor cannot easily copy. The two look identical from the outside, and they behave nothing alike inside the organisation or in a regulatory inquiry.
Bring one question to your next operating review. Show me what we decided not to do. Whatever comes back tells you whether you have a strategy or a procurement schedule.