The CFO’s AI readiness report: Part 3.

Most finance teams start with sensible AI pilots. They flag invoice exceptions, suggest coding, and save time in reviews. Confidence grows quickly, then someone asks the harder question: Can this same AI support approvals, policy checks, or journal entry suggestions at scale while still holding up under audit? That’s where many finance teams start to slow down and where two major frustrations bubble up.

The first: “We have a lot of AI activity, but nothing scales into core workflows.” The second: “We’ve had the governance conversations, but they never seem to convert into deployed capability.”

These frustrations point to different problems in different types of organisations. Until you can tell them apart, it’s easy to keep investing in the wrong fix.

The first two reports in this AI readiness series established the groundwork. Report one showed that AI maturity in finance is structurally uneven, shaped by industry, company size, and context. Report two showed that scaling depends on five key operating conditions: execution capability, minimum governance rules, skills, budget, and data readiness. It also showed that, even among advanced adopters, those conditions are rarely present at the same time.

This report goes one step further. Among finance teams that already score as AI leaders, why do some scale while others stall?

AI leaders don’t form one group. They sit in different operating postures, with different strengths, different gaps, and different blockers to scale. That matters because the next step is not the same for everyone. Some teams need clearer rules. Some need stronger data foundations. Some need to turn existing readiness into operational rollout. For CFOs, the key decision is knowing which condition is actually holding a live workflow back.

Leaders aren't one group

For this report, we dig into an analysis of the 405 respondents who scored seven to ten on AI maturity and completed the governance block of the survey. Each of the five scaling conditions is measured on a one-to-seven agreement scale. Throughout this report, "strongly in place" means a score of six or seven — the highest two points on the scale — indicating strong agreement that the condition is met. . Segment assignments are fixed for reporting consistency.

Figure 4 shows how leaders distribute across six operating postures.

Scaled adopters (26.9%) — the posture most closely aligned with full-stack readiness — score strongly across all five conditions simultaneously. They have execution capability, minimum governance rules, the skills, the budget, and data foundations that can support reliable outputs. One in four leaders has the full operating stack in place. That number matters because it proves scalable finance AI isn't hypothetical — it exists today in meaningful volume. It also tells you something about how hard the stack is to assemble.

Incremental improvers (17.5%) are making real progress, but unevenly. Some conditions are strong, others lag. AI is moving forward but not compounding across the whole operating model.

Execution-led implementers (16.0%) are shipping.100% strongly agree execution is in place, and 96.9% strongly agree on skills. But 0% strongly agree that minimum governance rules are in place. . These teams know how to build and deploy, but the control layer hasn't kept pace with the work.

Agent-first, control-later (14.1%) shows appetite for AI and genuine experimentation, but limited operating discipline. Again, 0% strongly agree that minimum rules are in place. Only 24.6% strongly agree on execution, and 35.1% on data readiness. AI is active in these organisations. It isn't built on a stable base.

Governance-forward scalers (13.8%) are the most instructive posture in the data, because they challenge the most common assumption about what readiness looks like. Execution scores 92.9%, minimum rules hit 100%, skills reach 92.9%. Data readiness falls to 30.4%. These organisations have done many of the right things. What limits them isn't governance — it's the data underneath the workflow.

Control-first planners (11.6%) have skills, budget, and data in relatively solid shape, but execution measures aren't in place. The capability exists. It hasn't become deployment.

Konstantin Dzhengozov, CFO at Payhawk, describes:

Advanced AI adoption can mean very different things in practice. In finance, one team may be ready to scale because it has the controls, the data, and the operating discipline. Another may look just as active from the outside, but still be missing one condition that stops it from moving further.

The standard maturity model assumes a single direction of travel: More mature means more advanced, and every organisation is somewhere on the same ladder. Finance doesn't work like that. Scale requires several things at once, ie the ability to implement, the ability to govern, the ability to fund, and data that can actually support the decisions being automated. When one piece is missing, the others can't compensate.

Each posture reflects what an organisation currently has and what it's optimising for.

• Execution-led implementers optimise for shipping — their constraint is governance.
• Governance-forward scalers optimise for defensibility — their constraint is data.
• Control-first planners have built readiness — their constraint is converting it into execution.

None of these positions is wrong, however each has a predictable bottleneck. Organisations don't usually choose these constraints; they inherit them from their systems, risk posture, and operating history.

The real blocker isn't more AI

Figure 5 maps the share of leaders in each posture who strongly agree each scaling condition is in place.

Here, two structural patterns emerge that explain most of the stalling in the leader group.

The first is a governance gap:

This is what happens when AI work moves faster than the minimum rules needed to support it.

Execution-led implementers show it in its clearest form: 100% on execution, 96.9% on skills, 0% on minimum governance rules. Agent-first, control-later shows the same gap from a different angle. We see strong interest, real experimentation, but the same missing control layer.

This matters specifically in finance because the work is built around accountability. Once AI touches approvals, spend classifications, invoice coding, vendor onboarding, or journal entries, the organisation has to be able to answer for what happened. What was the AI permitted to do? What triggered an escalation? Who owns the outcome? What's in the audit trail?

The pattern plays out like this: A finance team runs a successful pilot using AI to flag invoice exceptions or suggest coding. Results are good, confidence builds, and the business moves to extend it — auto-approving low-risk invoices, generating journal entry suggestions at scale. That's where the absence of governance becomes concrete. Not because the AI can't handle the task, but because the approval logic, escalation path, and audit records aren't well-defined enough to support broader use. The pilot worked. The rollout stalls. And the instinct is often to keep adding use cases or refining the model (neither of which addresses the actual gap).

The second is a data gap:

Governance-forward scalers illustrate it precisely. 100% strongly agree minimum rules are in place, 92.9% strongly agree on execution, 92.9% on skills — but only 30.4% strongly agree their data is ready for AI. These are organisations that are doing many of the right things. They have governance intent and implementation discipline. What limits them is whether the data their workflows depend on is reliable enough to scale on top of.

Finance AI goes deeper into operations when it's working with consistent master data, clean transaction histories, clear cost centre structures, policy metadata, and reconciliation logic that holds across entities and systems. When those foundations are fragmented, the team can still use AI for summaries and first-pass review, but it hesitates to let it drive anything where the output needs to be trusted. Governance exists, check. But reliable execution doesn't follow.

Konstantin explains:

The common mistake is thinking the next step is always more AI. In finance, the next step is often more discipline. You need to know whether your blocker is rules, data, or execution. If you misdiagnose it, you can spend a lot and still end up stuck.

The costly mistake in both cases is the same: Investing in the wrong fix. Teams with governance gaps keep adding use cases, more copilots, more pilots, more automation (on top of the same missing guardrails). Teams with data gaps invest in policy refinement and governance layers, even though the data still can't support reliable outputs.

Context determines which debt dominates

Both lenses matter together. Context, i.e., industry and company size, shapes the structural environment around a finance team. Posture describes the operating reality inside it. Combined, they explain why the same advice, the same product story, and the same best practice land so differently depending on where a team sits.

Figure 6 shows the distribution of postures across context segments, helping identify the dominant bottleneck in each one. Four segments carry a particularly clear constraint signature and explain most of the practical tension in finance AI scaling today. The remaining two — services firms at scale and core economy firms at scale — show a more mixed posture distribution, without a single dominant bottleneck. They are included in Figure 6 for completeness but are not discussed individually below.

1. Tech and services firms, 50–250 employees

Employees concentrate most heavily on the execution-led posture. These teams move fast, adopt tools readily, and have fewer organisational layers that slow decision-making. That same agility tends to come with lighter compliance infrastructure, smaller audit functions, and less formalised governance than larger enterprises. The result is predictable: adoption outpaces the controls needed to support it. Scaling tends to slow when auditors demand traceability, when the business needs consistent approval logic at scale, or when customers demand proof of process. The constraint here is governance mechanics rather than model capability.

2. Regulated and core economy firms, 50–250 employees

This is where one of the more counter-intuitive findings in the data sits. The dominant posture is Agent-first, control-later. It would be easy to assume that AI enthusiasm without guardrails belongs mainly to tech-forward, well-resourced organisations. The posture map shows something different: smaller operators in traditional and regulated sectors often have real AI ambition, but they lack the operating infrastructure to deploy it safely. Lean finance teams, heavy day-to-day workloads, limited capacity for policy design, and high sensitivity to errors all make safe scaling more difficult. AI scales in this segment when it arrives with predefined limits, built-in audit trails, and exception handling already in place. The governance burden has to be low enough that a small team can carry it without adding overhead.

3. Regulated industries, 251+ employees

Here we see a meaningful concentration of both scaled adopters and governance-forward scalers. This challenges the assumption that regulation is the main obstacle to AI progress. Regulated environments don't prevent scaling — they force it to be governed. These organisations tend to have stronger risk functions, clearer accountability structures, and more formalised policies, which support controlled deployment. But they also carry older system landscapes, fragmented data across entities, and complex reporting requirements. Governance removes one blocker and exposes another. The constraint that surfaces most clearly in this segment is data quality, even where operating discipline is strong.

4. Tech firms, 251+ employees

This group has the highest concentration of scaled adopters. Larger tech organisations are more likely to have the skills, budget, and integration capacity to bring the full stack together. But Figure 6 also shows that even in this segment, full-stack readiness isn't universal. Some teams outrun their governance. Others have the ingredients in place but haven't converted readiness into deployment. Context makes the full operating stack more achievable. It doesn't make it automatic.

The remaining two segments — services firms at scale (Services, 251+) and core economy firms at scale (Other industries, 251+) — do not show the same single-constraint concentration. Their posture distributions are more mixed, blending elements of rules debt, data debt, and incremental progress in roughly comparable proportions. This does not mean they face no bottleneck. It means the bottleneck is less uniform across leaders in these contexts, so the right fix will vary more from one organisation to the next. For these segments, the diagnostic in the next section becomes especially important.

The practical read across segments: in fast-moving contexts, the dominant constraint is governance. In smaller traditional contexts, the constraint is governance capacity — the ability to absorb and maintain controls without a dedicated function to manage them. In regulated-scale contexts, the constraint shifts to data, even when governance is solid. In large tech contexts, full-stack readiness is more common, but still depends on operating discipline to become actual scale.

This is why scaling finance AI is a sequencing problem. The wrong move is applying the same transformation playbook to every context. The right move is to identify the constraint that dominates your specific environment and address it first, before adding more capability on top of it.

What CFOs should prioritise now

Finance teams often stall when they keep investing around the real blocker instead of fixing it directly.

For CFOs, the more useful question is: which condition is preventing a real finance workflow from scaling right now? For some teams, governance will include approval corridors, escalation rules, and audit trails that allow AI to operate inside controlled processes. For others, it will be data, including master records, transaction histories, and entity structures that AI needs to produce outputs worth acting on.

The cost of getting that diagnosis wrong is real. Teams can spend budget on extra tools, more pilots, or more policy layers, while the workflow itself still fails to scale. That slows ROI, extends rollout timelines, and leaves finance carrying more activity without more control.

Finance AI creates the most value when it works inside approvals, policy enforcement, exception handling, and audit-ready workflows. That is where orchestration matters. It allows AI to move work forward while keeping the controls around that work intact.

Konstantin says:

For a CFO, this is a sequencing question. Value comes from identifying the one condition holding back a real finance workflow, fixing that first, and then expanding from there.

The label “AI leader” now covers more variation than it used to. Different leaders are held back by different conditions, and the path forward is not the same for everyone. The finance teams that scale furthest from here will be the ones that diagnose their specific constraint honestly and act on it early.

The next phase of finance AI will favour the teams that can identify what is holding scale back, fix that condition first, and move forward with control.

If you want to see how that works in practice, explore how Payhawk applies AI inside real finance workflows, with built-in controls, audit trails, and accountability throughout. You’ll see how finance teams can move from isolated AI activity to governed execution, while keeping approvals, policy enforcement, and audit readiness strong.

Methodology:

Using affirmative statements developed in close collaboration with finance and business leaders, IResearch conducted interviews across eight countries to reflect genuine operational realities and challenges. Respondents: 1,520.

Coverage included:

• Regions: DACH, Spain, France, Benelux, UK & Ireland, United States
• Seniority: C-suite, VPs, Directors, and senior individual contributors
• Functions: Finance, Accounting, Sales, HR, Procurement
• Industries: Services, Digital, Manufacturing, Healthcare, Education & Non-profit, B2C
• Company size: 50–100 FTE, 101–250 FTE, 251–500 FTE, 501–1,000 FTE, and 1,000+ FTE)

The five scaling requirements were each rated on a 1–7 agreement scale. "Strongly in place" refers to scores of 6–7 (the highest two points on the scale). This threshold is used consistently across all four reports in the series.