
AI strategy
A chatbot is not an AI strategy
Most companies now have a chatbot. Few can show it changed their results. Here is what separates an AI feature from an AI capability.
By Kesho Partners
8 minute read
A chatbot is a feature. An AI strategy is a decision about where AI will change how your business makes money, serves customers, or manages risk, and what you will build so that change lasts. Chatbots are now the most widely scaled AI tool, yet in McKinsey's 2026 survey only 37% of respondents reported any effect on operating profit from AI. The difference is rarely the tool. It is whether leaders redesign the work around it, connect it to their own data and systems, and give it a clear owner.
Why every company now has a chatbot
Chatbots are easy to buy, quick to launch, and easy to show a board. That makes them the natural first move. In McKinsey's 2026 survey, 47% of respondents said their organization is scaling chatbots, more than any other AI tool.
The problem is that your competitors can buy the same tool tomorrow. McKinsey notes that spending on general-purpose tools like chatbots is increasingly managed as a cost of doing business. That is useful, but it is not an advantage. Nobody wins a market because they have email.
Meanwhile, the share of organizations reporting any operating profit impact from AI has not moved from the year before. Activity is up. Results are not.
Survey figures are self-reported by respondents and describe their organizations' experience, not audited financial results.
Sources: [1]
A feature is not a capability
A useful test is to ask what would be lost if the tool were switched off. If the answer is "some convenience", you have a feature. If the answer is "we would serve customers worse, decide more slowly, or cost more to run", you are building a capability.
| Question | A chatbot feature | An AI capability |
|---|---|---|
| What problem does it solve? | Answers general questions faster | Changes a specific decision or workflow that matters to revenue, cost, or risk |
| What data does it use? | Public model knowledge and a few documents | Your own data, with clear rights, quality checks, and access controls |
| Where does it live? | A separate window people may or may not open | Inside the systems where the work already happens |
| How is success measured? | Number of users and messages | Business outcomes such as resolution time, error rate, margin, or retention |
| Who owns it? | IT or the vendor | A named business leader accountable for results and risk |
| Can a competitor copy it? | Yes, by buying the same product | Not easily, because it depends on your data, process, and know-how |
Where the value actually comes from
BCG surveyed 1,000 senior executives in 2024 and found only 26% had the capabilities to move beyond pilots and generate real value. The leaders pursued about half as many AI opportunities as everyone else, and scaled about twice as many.
BCG also found that most of the effort sits outside the technology. Its rule of thumb is 10% on algorithms, 20% on technology and data, and 70% on people and processes. And 62% of the value came from core business functions, not from support tools on the side.
McKinsey's 2026 data points the same way. Nearly three-quarters of its AI high performers have fundamentally redesigned workflows, against about one-quarter of other organizations. They are also twice as likely to have senior leaders who visibly back the work and a defined way to measure its impact.
In plain terms: the companies getting results pick fewer bets, put them into the core of the business, and change how the work is done. A chatbot added on top of an unchanged process rarely does that.
The risks arrive with the chatbot, not after it
A customer-facing chatbot speaks for your company. The UK government's AI Playbook points to a Canadian case where an organization was held financially responsible for bad advice given by its chatbot. The playbook is clear that responsibility for AI outputs rests with the organization using them, not the vendor.
Chatbots can also be manipulated. A user can type instructions that make the system ignore its rules, known as prompt injection. The UK playbook states plainly that none of the current mitigations can guarantee such an attack will fail. OWASP ranks prompt injection as the top security risk for applications built on large language models.
None of this means you should not deploy one. It means you need the basics in place first. Our minimum viable AI governance pack and AI production release gate set out what that looks like in practice.
- Wrong answers
- The system can produce confident, plausible, and false information. Someone must decide which topics it is allowed to answer.
- Manipulation
- Users can try to override its instructions. Limit what it can see and do, especially actions that send, change, or delete things.
- Data exposure
- If it can search internal files, it may surface information people were never meant to see. Fix access permissions before connecting it.
- Accountability
- When it gets something wrong, your company carries the cost. Name an owner and a process for reporting and correcting errors.
Someone has to pay to run it
Pilots are cheap. Running AI at scale is not always. In McKinsey's 2026 survey, about one in five respondents said operating costs, including usage fees for AI models, are limiting how much they use AI.
The UK playbook makes the same point: AI needs ongoing investment to stay accurate, secure, and up to date. Before scaling, leaders should know the cost of each useful outcome, such as a resolved customer query, compared with the current way of doing it, and what happens to that cost if usage doubles.
Five questions to ask before the next AI purchase
These questions turn a tool decision into a business decision. If the team cannot answer them, the purchase is premature. Our AI readiness assessment framework goes into each area in more depth.
- Which decision or workflow will change?
- Name it, and name the person who owns it today. If nothing in the way work gets done changes, results are unlikely to change either.
- What do we have that others do not?
- Proprietary data, customer relationships, or process know-how. This is where a lasting advantage comes from, not the model.
- How will it connect to the work?
- List the systems it must read from and write to. A tool people must remember to open is easy to ignore.
- How will we know it is working?
- Agree a business measure and a baseline before launch. The UK playbook warns that good model scores do not guarantee the service is meeting user or business needs.
- Who owns it when it goes wrong?
- A named leader, a way for users to report problems, and a plan to fall back to the old process if needed.
When a chatbot is the right answer
Sometimes a chatbot is exactly the right tool. Internal knowledge search, first-draft writing, and narrow, low-stakes customer questions are all reasonable uses, provided the scope is clear and someone checks the results.
The UK playbook's sixth principle is to use the right tool for the job. It also reminds teams that AI is sometimes not the best solution, and that a problem may be solved more simply with established technology. A good strategy says no as often as it says yes.
Sources: [3]
What to do this quarter
Pick one workflow in the core of the business where better decisions or faster turnaround would show up in the numbers. Measure how it performs today. Then design the change around the people who do the work, the data they rely on, and the systems they use.
Before you build, check that the data can support it. Our article on AI due diligence and data lineage explains how to test where data comes from and whether you can rely on it. Most AI projects that stall do so because of data and process, not the model.
Finally, cut the tool list. Fewer, deeper investments with clear owners beat a long list of pilots. As McKinsey puts it, the aim is to avoid simply accumulating tools or pilots and instead build a repeatable capability.
Related service
AI product development
We help leadership teams choose the AI use case that matters, then build it into the core of the business with the data, integration, evaluation, and ownership it needs to deliver results.
Explore the service