Vaibhav Gujral works at Capgemini and is a 7x Microsoft MVP. He writes about cloud architecture, agentic AI, and technology leadership.
Every enterprise I talk to has an AI strategy. Far fewer have a cloud foundation that can actually support one.
Over the past few years, I’ve watched organizations across financial services, insurance and healthcare launch AI pilots with real enthusiasm and then quietly stall—not because the models underperformed but because nobody had asked the boring question first: Is our cloud environment actually ready for this?
AI exposes cloud debt you could ignore before.
For a decade, plenty of enterprises got away with “good enough” cloud architecture—fragmented data stores, inconsistent identity and access controls, and cost governance bolted on as an afterthought. None of it was pretty, but it didn’t actively break anything.
AI changes that. A large language model or agentic workflow doesn’t politely work around messy data the way a human analyst does. It ingests whatever it’s given, at scale, and produces confident answers regardless of whether the underlying data was ever trustworthy. Governance gaps that were compliance risks become operational ones. Access control gaps that were a security concern become a data-leakage concern the moment an AI agent has broader read access than any single employee ever did.
The pattern I see repeatedly is a pilot that works beautifully in a sandboxed environment with clean, hand-picked data and then falls apart the moment it touches production systems—because production is where the cloud debt actually lives.
Follow the data, not just the code.
My fellow Forbes Technology Council member Krishnaveni Palanivelu made a point that I think about constantly: Financial institutions that treat AI as just another service behind an API gateway are threat-modeling the wrong layer. Attackers no longer need to touch your code; they can quietly corrupt the data your model learns from, and the model will treat that corruption as ground truth.
I’d extend her point one layer further back. Before you can even threat-model your AI data pipeline, you need a cloud architecture where “the data” is a coherent, governed thing to begin with—not five inconsistent copies scattered across storage accounts and shadow databases with different access rules. You can’t secure a data life cycle that was never architected as one.
Cost governance was optional, but now it’s existential.
Traditional cloud spend was predictable enough for finance teams to manage with quarterly reviews. AI workloads don’t behave that way. Inference costs scale with usage in ways that are genuinely hard to forecast, and a single poorly scoped agent or uncapped fine-tuning job can turn a five-figure line item into a six-figure one within a billing cycle.
Handling this well doesn’t mean increasing your AI budget. The companies I see experiencing success already had real FinOps discipline built into their cloud practice before AI arrived. Cost governance stopped being a nice-to-have optimization exercise and became a prerequisite for being allowed to experiment.
Identity is the new AI battleground.
The most consequential decisions in any enterprise AI rollout right now aren’t happening in the data science team—they’re happening in identity and data platform teams, and most leadership hasn’t caught up to that yet.
This becomes even sharper as AI shifts from generating answers to taking actions. Palanivelu also makes a case I’d put right alongside the cloud argument: An autonomous agent has to be governed as a distinct, accountable identity with tightly scoped permissions, not treated as generic software running behind a gateway. That’s not a new security discipline but the identity and access management fundamentals that well-run cloud environments were already supposed to have, now applied with much less room for error. Because an agent doesn’t just expose data; it can also act on it.
Enterprises that treated identity and data architecture as cloud fundamentals—not afterthoughts—are the ones I see moving from pilot to production fastest. Everyone else is rebuilding those fundamentals under deadline pressure, with AI initiatives as the forcing function.
The real advantage is boring.
None of this is a new architectural pattern. Well-governed data, disciplined identity management and real cost accountability are what good cloud architecture has always meant. AI didn’t invent these requirements. It just removed the option to defer them.
If there’s one piece of advice I’d give any technology leader right now, it’s to resist the urge to evaluate your AI readiness by asking which models you’re using. Ask instead whether your cloud foundation—the unglamorous, already-built infrastructure—could support 10 times the AI workload you’re running today without anyone noticing a governance failure. For most organizations, the honest answer is no. And that gap, not the next model release, is the real strategic risk.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?