Beginner · About 41 hours · 3 projects · Free · Updated Nov 4, 2026
AI Roadmap for Leadership
In about 41 hours you can set an AI strategy on one page, govern its use with a policy you wrote, and decide one use case on its value and its risks, asking the questions that vendors and your own teams must answer.
0of 41 hours · 0%
Saved in this browser. No account, no email.
What you'll build
Go at your own pace. Stop at any milestone: each one leaves you with something to show.
- 1A one-page AI strategy for your organizationhour 15
Write the one page your board would read: where AI will be used, what each use should gain, who owns it, and the first 90 days.
- 2An AI acceptable-use policyhour 26
Write the policy your staff will actually follow: allowed tools, what data goes in, when a person must review, and who decides.
- 3A decision memo on one use casehour 41
Take one use case through value, cost, risk and vendor, and write a memo the board can say yes or no to in one meeting.
Skills you'll learn
- Use case selection
- Measuring AI value
- Build vs buy
- AI maturity
- Planning
- AI policy
- Data rules
- Decision rights
- Human review
- Disclosure
- Risk
- Business cases
- Total cost
- Risk controls
- Vendor scorecards
- Stop rules
Prerequisites
- A chatbot account you can use with non-confidential text.
- One real use case in your company to carry through the plan.
- Nothing technical.
Program outline
3 milestones · 8 sections · 40 lessons · 3 projects · Every course and source is free
Milestone 1 · Hours 1 to 15 · 3 sections · 15 lessons
See it clearly, then set the direction
Understand what AI is and does, then decide where your company should use it.
Hours 1 to 50/15
By the end you can explain to your board, in plain words, the difference between AI, machine learning and generative AI, and point to five places AI already runs in your business.
In the Encyclopedia: What is AI?, Artificial Intelligence (AI), Generative AI
AI in one hour: the map before the detail55 min
- WatchWhat Is Artificial Intelligence? · Crash Course AI #1 · CrashCourse
- ReadIBM What is AI? · IBM
- DoWrite a five-line definition of AI in your own words, with one example from your own company on each line. Keep it; later you will test it against the version you write then.
Four words vendors mix up: AI, machine learning, deep learning, generative AI65 min
- WatchAI, Machine Learning, Deep Learning and Generative AI Explained · IBM Technology
- Read
- ReadIBM AI Academy · IBM
- DoList five places AI already runs in your business (fraud checks, demand forecasts, site search, spam filters, recommendations). For each, write which of the four words applies and who owns it. From IBM AI Academy, watch only the episode on generative AI for business.
The state of AI in numbers: the Stanford AI Index60 min
- ReadStanford HAI AI Index Report 2026 (free) · hai.stanford.edu
- DoRead the top takeaways and the economy chapter only. Pick five numbers you would quote to your board. For each, write the number, the chapter it came from, and the question it raises for your company.
A university course in an hour: Elements of AI, chapter 165 min
- CourseElements of AI · Free Course by University of Helsinki · elementsofai.com
- ReadArtificial intelligence is not conscious – Ted Chiang · Hacker News
- DoDo chapter 1 of Elements of AI, then the Ted Chiang thread. Write the 'what AI is not' list for your teams: not conscious, not a database, not always right, not free to run. Add one line on why each matters to your business.
The board paragraph: what AI is for us55 min
- ReadA basic misunderstanding of what an LLM does · Benedict Evans
- Course
- DoPick one short OpenAI Academy session for business users and try the chatbot on a real piece of your own writing. Then write the one-paragraph board explainer of what AI is for your company, ask the chatbot to critique it, and note what the critique got wrong. Compare with your first five lines.
Hours 6 to 100/16
By the end you can say how a language model produces an answer, why it can be confidently wrong, what an agent adds, and which approval step you would require before an agent acts for your company.
In the Encyclopedia: Large Language Models (LLMs), AI Hallucinations, AI Agents
What a language model actually does55 min
- WatchLarge Language Models explained briefly · 3Blue1Brown
- ReadHow does a large language model actually work? · Dan Hollick
- DoPaste your own meeting notes (nothing confidential) into a chatbot and ask for a summary. Mark every sentence that is wrong or invented. Write two lines on what that tells you about where the tool can and cannot be trusted.
Karpathy's hour: the one lecture worth your time75 min
- WatchAndrej Karpathy · Intro to Large Language Models (1hr) · Andrej Karpathy
- DoWrite five questions for your CTO from the talk: which model we use, who trained it on what data, what it costs us per month, what it is not allowed to do, and how we would know if it failed. Send them.
Hallucination: why confident is not correct55 min
- WatchWhy Large Language Models Hallucinate · IBM Technology
- ReadWhy language models hallucinate · OpenAI
- ReadLawyer cites fake cases invented by ChatGPT, judge is not amused · Hacker News discussion
- DoWrite your trust rule in five lines: which AI outputs must be checked by a named person before they leave the company (customer replies, legal text, numbers in a report), who signs, and what happens if the check is skipped.
Agents: software that takes steps on its own60 min
- WatchWhat are AI Agents? · IBM Technology
- ReadAnthropic's Building Effective Agents guide · Anthropic
- DoList three multi-step tasks in your company an agent could run (refund handling, supplier follow-up, report assembly). For each, write the one approval step you would require and the one thing the agent must never do.
How much autonomy, and who signs60 min
- Read
- ReadAI Agents Are Here. What Now? · Hugging Face
- DoDraft a four-rung autonomy ladder for your company: suggest, draft, act with approval, act alone. Give one example of what you would allow on each rung today and who can move a task up a rung.
Hours 11 to 150/17
By the end you have a draft one-page AI strategy: three use cases with the measure each moves, what you will build, buy and stop, and your maturity stage with the evidence for it.
In the Encyclopedia: AI Strategy, AI Maturity Models, Build, Buy or Partner
Where the opportunities are60 min
- WatchAndrew Ng: Opportunities in AI - 2023 · Stanford Online
- ReadMaking AI Work: Leadership, Lab, and Crowd · Ethan Mollick
- DoWrite three candidate use cases for your company. For each: the task, who does it today, how often, and the number it would move. Mark which of Mollick's three (leadership, lab, crowd) each one needs first.
What AI already pays for in your industry65 min
- ReadAI in Customer Service · IBM Think
- ReadWhat Is AI in Supply Chain? · IBM Think
- ReadState of AI in financial services · NVIDIA
- DoRead closely the one that matches your industry (support, supply chain, finance) and skim the other two. Rewrite your three use cases so each names the measure it moves (handle time, forecast error, fraud loss) and the baseline today.
The transformation playbook, and the business value module65 min
- CourseTransform your business with AI · Microsoft Learn
- DoFrom the Microsoft path, do only module 2, Create business value with AI (31 minutes). Then fill the playbook's five steps for your company in one line each: pilots, in-house team, training, strategy, communications.
Where you stand: the maturity stage55 min
- ReadWhat's your company's AI maturity level? · MIT Sloan
- Read
- DoScore your company on MIT CISR's four stages with one piece of evidence per stage. Write the single move that takes you up one stage and the name of the person who would own it.
Build, buy or partner, then write the page65 min
- ReadBuy, boost, or build? Choose your path to generative AI (MIT Sloan) · mitsloan.mit.edu
- ReadThe state of AI (McKinsey Global Survey) · mckinsey.com
- Read
- DoWrite the one-page AI strategy draft: three use cases, the measure for each, buy, boost or build, what you will stop funding, your maturity stage, the owner, and the first 90 days. This is the first milestone project; take extra time if you need it.
Milestone 1 project · about 4 hours
A one-page AI strategy for your organization
Write the one page your board would read: where AI will be used, what each use should gain, who owns it, and the first 90 days.
- Use case selection
- Measuring AI value
- Build vs buy
- AI maturity
- Planning
Courses that teach this
- Elements of AI
University of Helsinki · about 30 hours
What AI can and cannot do, with no math or code, and a free certificate.
- Transform your business with AI
Microsoft Learn · about 2.5 hours
Four modules on where AI fits in a business and how to adopt it.
- Discovering Generative AI
Udacity · 45 minutes
Learn core generative AI concepts and how to use it at work.
Build it
List where AI could help, with the task, who does it now, and how often.
Pick three use cases and name the number each one should move, with today's baseline.
Choose build, buy or boost for each, and say what you will stop funding.
Score your maturity stage with evidence, and name one owner.
Write it on one page with the first 90 days, and have one peer challenge it.
You finish with
One page: three use cases with the number each moves, a buy, boost or build choice for each, the maturity stage with evidence, the owner, and the first 90 days.
Check your work
Each use case names one number, with today's baseline.
Each use case has a build, buy or boost choice.
One person owns it, by name.
It says what you will stop funding.
See how others did it
- AI strategies and compliance plan
gsa.gov
A real agency strategy: tiered use cases, named owners, barriers, investment tracking.
- Artificial Intelligence Strategy: Immigration, Refugees and Citizenship Canada
canada.ca
A real department strategy: priorities, named use cases, owner, governance, and volume numbers.
- Artificial Intelligence Playbook for the UK Government (HTML)
gov.uk
How to pick use cases, weigh off-the-shelf versus co-creating, and set governance.
Milestone 2 · Hours 16 to 26 · 2 sections · 10 lessons
Govern it: risk, law and the policy
Learn who decides, what the law says, and how to write rules people follow.
Hours 16 to 200/17
By the end you can say who in your company decides, owns and answers for each AI use, ask your teams the NIST four-function questions, and point to three real incidents in your industry with the control that would have caught each.
In the Encyclopedia: AI Governance, AI Risk Management, AI Incidents and Incident Databases
Governance: who decides, who answers55 min
- Read
- WatchWhy is AI Governance Important? · IBM Technology
- WatchWhy AI governance is about trust, not just technology · DeepLearningAI
- DoDraw your decision rights on one page: who approves a new AI use, who keeps the inventory of AI systems in use, who answers when one fails, and who can switch one off. Put a name in every box, not a department.
NIST's four verbs: govern, map, measure, manage50 min
- WatchMastering AI Risk: NIST's Risk Management Framework Explained · IBM Technology
- Read
- DoWrite eight questions for your risk owner, two per function. Example for measure: how do we know the accuracy today, and when was it last checked? Example for manage: who gets the call when it goes wrong at 2 a.m.?
Safety and risk: the words, and the catalog65 min
- ReadWhat Is AI Safety? | IBM · IBM
- ReadMIT AI Risk Repository · MIT
- WatchThe AI Risk Repository explainer video · MIT FutureTech
- DoOpen the MIT repository's domain taxonomy. Pick the three domains that most apply to your first use case and write one line each on the risk and the control you would require before launch.
Incidents: learn from other people's failures65 min
- ReadWelcome to the Artificial Intelligence Incident Database · incidentdatabase.ai
- ReadDefining an AI Incident (AI Incident Database) · incidentdatabase.ai
- ReadMoffatt v. Air Canada, 2024 BCCRT 149 (Civil Resolution Tribunal) · decisions.civilresolutionbc.ca
- DoSearch the AI Incident Database for three incidents in your industry. For each: what failed, who was harmed, which control would have caught it. Add the Air Canada lesson to your trust rule: the company is liable for what its chatbot says.
Responsible AI in practice: the Microsoft Learn module70 min
- CourseEmbrace Responsible AI Principles and Practices · Microsoft Learn
- DoWrite the responsible-AI paragraph for your board: six commitments in your own words (fairness, reliability, privacy, inclusion, transparency, accountability) and the five controls that make them real in your company.
Hours 21 to 260/20
By the end you have a draft AI acceptable-use policy, and you can say which laws touch your AI use (the EU AI Act's risk tiers, GDPR Article 22, copyright) and what each one asks of you.
In the Encyclopedia: AI Regulation & Governance, Data Protection Law and AI (GDPR and beyond), AI Policy and Acceptable Use
The EU AI Act, and why it reaches US companies60 min
- Read
- ReadAI Act | Shaping Europe’s digital future · European Commission
- ReadEU AI Act, Article 4: AI literacy · artificialintelligenceact.eu
- DoClassify your three use cases by the Act's risk tiers (prohibited, high, limited, minimal). Note whether you have EU customers or staff, and write what the Article 4 AI literacy duty means for your training plan.
US rules: executive orders, states and agencies60 min
- Read
- ReadWhite House Unveils America's AI Action Plan · whitehouse.gov
- DoWrite a half-page for your general counsel: which federal, state and sector rules you believe apply to your three use cases, and the three questions you cannot answer yet. Ask for a reply by a date.
Data protection: decisions about people65 min
- Read
- DoList every place your company makes or plans to make automated decisions about people (hiring, credit, pricing, support priority). Mark which have a human who can overturn the result, and which personal data goes into each.
Copyright, training data, and what you own65 min
- ReadCopyright and Artificial Intelligence (U.S. Copyright Office) · copyright.gov
- ReadUS Copyright Office: Generative AI Training [pdf] · Hacker News discussion
- Read
- DoRead the summary and conclusion of the Bartz order, not the whole thing. Write three questions for your counsel and three for every AI vendor: what data trained the model, who indemnifies us for its output, and whether our outputs can be protected.
Shadow AI, and the policy60 min
- WatchWhat is Shadow AI? The Dark Horse of Cybersecurity Threats · IBM Technology
- ReadWhat Is Shadow AI? · IBM Think
- ReadAcceptable use policy · Wikipedia
- DoDraft the acceptable-use policy on one page: allowed tools, data classes that may and may not go in, the human review rule, the disclosure rule, who approves exceptions, and what happens on a breach. This is the second milestone project.
Milestone 2 project · about 3 hours
An AI acceptable-use policy
Write the policy your staff will actually follow: allowed tools, what data goes in, when a person must review, and who decides.
- AI policy
- Data rules
- Decision rights
- Human review
- Disclosure
- Risk
Courses that teach this
- Embrace Responsible AI Principles and Practices
Microsoft Learn · 51 minutes
The six responsible AI principles and how a company applies them.
- AI Fluency: Framework and foundations
Anthropic · 4 hr
Apply Delegation, Description, Discernment and Diligence to collaborate with AI and check outputs.
Build it
List the AI tools already in use, including the ones nobody approved.
Decide what data may go in, what never does, and when a person must review the output.
Write the decision rights: who approves, who owns, who answers, with a name in every box.
Add disclosure, exceptions, and what happens on a breach.
Cut it to one page and send it to your counsel for review.
You finish with
A one-page acceptable-use policy plus a half-page decision-rights chart with a named owner in every box, ready for your counsel's review.
Check your work
A new employee can tell what is allowed in one read.
Every decision has a named owner.
It covers data, review, disclosure, exceptions and breach.
It is ready for your counsel to review.
See how others did it
- Generative Artificial Intelligence Policy
seattle.gov
A short city policy: approved tools, data limits, human review, attribution, exceptions, non-compliance.
- Templates & Resources
sanjoseca.gov
Editable AI policy, governance handbook and incident response plan from a government coalition.
- Accelerating Responsible Use of Artificial Intelligence at GSA
gsa.gov
See decision rights: who approves tools, who adjudicates use cases, who issues waivers.
Milestone 3 · Hours 27 to 41 · 3 sections · 15 lessons
Decide one use case on value, cost and risk
Learn to judge one use case on value, cost, vendor and people.
Hours 27 to 310/17
By the end you can state one use case's value in money or hours against its full cost (model, people, data, governance), read a productivity study without being fooled, and say which data it needs and whether you may use it.
In the Encyclopedia: Measuring AI Value and ROI, Inference Cost & Token Economics, Data Strategy for AI
ROI and total cost of ownership55 min
- ReadHow to maximize AI ROI in 2026 · IBM Think
- ReadWhat Is Total Cost of Ownership (TCO)? · IBM Think
- DoBuild the value sheet for your first use case: today's baseline, the expected change, and every cost line (licenses or tokens, people, data work, governance, training). Leave a blank where you do not know; the blanks are your next questions.
The evidence: what measured gains look like60 min
- ReadChatGPT-4 significantly increased performance of business consultants · Hacker News discussion
- DoRead the abstract, the figures and the conclusion of the paper. Write the three conditions under which the gains appeared (less-experienced workers, bounded tasks, a tool fitted to the task) and whether each holds for your use case.
The J-curve and the pilot trap60 min
- WatchIs AI worth it? How to quantify its value and navigate the J-curve · Google Cloud Events
- ReadProductivity paradox · Wikipedia
- DoWrite the board paragraph on why gains lag spend, and set the two dates you will check: the first measurable change and break-even. Name the number you will look at on each date.
What it costs to run: tokens and energy60 min
- ReadCompare AI models: pricing and context · OpenRouter
- ReadI compiled LLM inference pricing across 7 providers: the caching · r/MachineLearning
- ReadHow much energy does ChatGPT use? · Epoch AI
- DoEstimate a month of use for your use case (requests per day times words in and words out). Price it with two models from the pricing page and write the number next to your value sheet. Note the energy figure for the board's sustainability question.
Data: the ceiling on every AI project65 min
- Watch
- ReadWhat Is Data Strategy? · IBM Think
- Read
- DoFor your use case, list the data it needs, where it lives, who owns access, and whether you have the right to use it. Mark each line green, amber or red. A red line is a question for the vendor or a reason to stop.
Hours 32 to 360/18
By the end you have a ten-question vendor scorecard, can tell a benchmark score from a result on your own data, and know the one security question every AI vendor must answer.
In the Encyclopedia: Evaluating AI Vendors and Procurement, LLM Evaluation & Benchmarks, Prompt Injection & Jailbreaking
Procurement basics: evidence, not demos55 min
- Read
- ReadWhat is Third-Party Risk Management (TPRM)? · IBM Think
- DoWrite the first ten questions for any AI vendor: data used, accuracy on our cases, failure handling, lock-in, exit terms, who is liable, who sees our data. Keep the list; it becomes the scorecard.
Transparency and standards you can demand60 min
- Paper
- ReadFoundation Model Transparency Index · Stanford
- DoAdd transparency rows to the scorecard: training data disclosed, evaluations published, incident process, notice before the model changes. Score one vendor you already use and note every row you cannot fill.
Benchmarks are not your results65 min
- WatchWhat are Large Language Model (LLM) Benchmarks? · IBM Technology
- ReadDefine success criteria and build evaluations · Anthropic
- DoWrite the 'show me on our data' clause: fifty of our real cases, a pass rate, who judged, and what counts as a failure. Note METR's lesson: the people in the study estimated a gain and were slower; ask how any claimed gain was measured.
Security: the question every vendor must answer60 min
- WatchWhat Is a Prompt Injection Attack? · IBM Technology
- ReadPrompt injection: what's the worst that can happen? · Simon Willison
- Read
- DoWrite four security questions for vendors and your security lead: what untrusted text reaches the model, what the system can do with our data and tools, how prompt injection is tested, and what is logged. Add them to the scorecard.
Build, buy, open or closed, and lock-in65 min
- Read
- WatchShould You Use Open Source Large Language Models? · IBM Technology
- DoFinish the scorecard with a weight per row and score two real options for your use case. Write one line on what it would take to switch away from each, and one line on what the surveys say most companies in your position did.
Hours 37 to 410/16
By the end you have the decision memo on one use case (value, cost, risks, owner, measure, stop rule) and a people plan: who is trained, what changes in the job, and what you will tell staff about roles.
In the Encyclopedia: AI Adoption and Change Management, AI and the Future of Work, AI Center of Excellence and Operating Model
Why AI projects fail, and the change work65 min
- Watch
- DoScore your use case against RAND's five root causes of failure and write the fix for each one that applies. Then write the one change Mollick describes that your team would feel first.
The jagged frontier: where the tool helps and where it hurts60 min
- ReadCentaurs and Cyborgs on the Jagged Frontier · Ethan Mollick
- DoFor one team, list ten of its tasks and mark each inside or outside the frontier. Write the rule for how that team checks work on the outside tasks, and who checks the checkers.
Jobs: what the data says, and what you will tell staff65 min
- WatchEvery Generation Thinks This Time Is Different: The AI Job Myth · IBM Technology
- Read
- PaperThe Future of Jobs Report 2025 (World Economic Forum) · reports.weforum.org
- DoRead the key findings of the WEF report only. Write the paragraph you will say to staff about roles: what changes, what does not, what training you fund, and how you will measure it. No hedging, no hype.
Operating model: central, federated or hybrid65 min
- CourseTransform your business with AI · Microsoft Learn
- ReadWhat Is an AI Center of Excellence? · IBM Think
- DoFrom the Microsoft path, do only module 4, Scale AI in your organization (23 minutes). Decide your operating model for the next year and name the owner of standards, skills and governance. Write the three things the central team does and the three things the business units do.
The decision memo60 min
- PaperAI in the Enterprise: Lessons from seven frontier companies (OpenAI) · cdn.openai.com
- Read
- DoWrite the decision memo: the use case, your value sheet, your risks and controls, your vendor choice, the owner, the measure, the review date and the stop rule. Two pages at most. This is the third milestone project.
Milestone 3 project · about 5 hours
A decision memo on one use case
Take one use case through value, cost, risk and vendor, and write a memo the board can say yes or no to in one meeting.
- Business cases
- Total cost
- Risk controls
- Vendor scorecards
- Stop rules
Courses that teach this
- Transform your business with AI
Microsoft Learn · about 2.5 hours
Four modules on where AI fits in a business and how to adopt it.
Build it
Pick one use case from your strategy page and write today's baseline.
Build the value sheet: expected gain against the full cost, including people and governance.
List the risks and the control for each.
Score the vendors with your ten-question scorecard.
Name the owner, the measure, the review date and the rule that stops the project.
Write the two-page memo so the board can say yes or no in one meeting.
You finish with
A two-page decision memo with a value sheet, a scored vendor scorecard and a stop rule, written so the board can say yes or no in one meeting.
Check your work
Value is compared with the full cost, including people.
Every risk has a control.
The vendor score comes from your own questions.
A written rule says when the project stops.
See how others did it
- Microsoft 365 Copilot pilot: DBT evaluation report
gov.uk
A real pilot evaluation: diaries, observed tasks, control interviews, no proven productivity gain.
- Guidelines for AI procurement
gov.uk
Set go/no-go points, whole-of-life cost, and what evidence to demand from vendors.
- Templates & Resources
sanjoseca.gov
Use the AI FactSheet and Buyer's Guide to build your vendor scorecard.
Check yourself at the end
You can explain to your board what AI, machine learning and generative AI are, why a language model can be confidently wrong, and what an agent adds, without a slide from a vendor.
You have a one-page AI strategy with three use cases, the measure each moves, a build, buy or boost choice, and a maturity stage backed by evidence.
You have an acceptable-use policy and a decision-rights chart with a named owner for every AI use, and you can ask your risk team the NIST govern, map, measure and manage questions.
You can read a vendor's claim and separate a benchmark score from a result on your own data, and you know the security, data, liability and lock-in questions to ask before signing.
You can state a use case's value against its full cost, including people, data and governance, and you know why the gains lag the spend and when to check.
You have a two-page decision memo on one use case with its owner, measure, review date and stop rule, and a paragraph you can say to staff about what changes in their jobs.