# Lawted on McKinsey II: AI Is Not a New Board Agenda Item / 劳泰德锐评麦肯锡②：AI 不是董事会的新议程

> Published 2026-08-27 · By lawted (https://x.com/lawted2) · Published on HA7CH (https://ha7ch.com)
> Canonical: https://ha7ch.com/writing/mckinsey-ai-is-not-a-board-agenda

## English

**Before reading: start with McKinsey’s original essay**

This essay is not a summary of McKinsey, and it cannot replace the original.

In “The AI Reckoning: How Boards Can Evolve,” McKinsey lays out four possible AI postures for a company and six actions a board should take. It explains why boards must engage with AI, how a company should choose its posture, and how governance changes with that choice.

The argument below extends that framework. The reading order matters: read McKinsey first, then return here. Original: https://www.mckinsey.com/capabilities/mckinsey-technology/our-insights/the-ai-reckoning-how-boards-can-evolve

In the first installment of “Lawted on McKinsey,” I argued that AI is not an HR remake. This time I am not disagreeing for the sake of a critique. The essay is directionally right and, among traditional consulting firms’ writing on AI, relatively advanced.

It recognizes an important shift: AI is no longer merely an issue for the CIO, CTO, or digital team. It is now an enterprise issue that the board must face directly.

But it still does not carry the argument to its conclusion.

McKinsey treats AI as a core new item on the board’s agenda. What we see in Ha7ch’s fieldwork is that AI will not remain one agenda item. It will become the company’s new operating system.

Those two statements sound close. They lead to very different companies.

1. The conclusion first: this is an essay boards should read carefully

McKinsey reports that more than 88% of organizations use AI in at least one business function, while board governance lags far behind. Only 39% of Fortune 100 companies disclose some form of board-level AI oversight; 66% of surveyed directors say their boards lack AI knowledge and experience; and nearly one-third say AI is not even on the board agenda.

These figures are not directly comparable. An employee using AI does not mean the enterprise has transformed, and a company that does not publicly disclose an AI committee may still govern AI internally. Together, however, the numbers reveal the same gap: AI is spreading through companies faster than management and boards can understand it.

Employees are already experimenting with AI tools. Business units are launching local trials. Vendors are selling new Agents. Yet many boards still interpret all of this as a conventional IT program. Management sees budgets, procurement, pilots, and ROI; people on the front line feel their work boundaries, collaboration patterns, and professional value changing.

McKinsey’s contribution is to put that mismatch in front of the board.

It does not reduce AI governance to risk, compliance, and ethics. It asks boards to define the company’s AI posture and connect it to strategy, competition, business models, and capital allocation. That is the right starting point.

Without a shared view of what AI means for the company, budgets, talent, organization, vendors, and governance will pull in different directions. Business teams chase short-term efficiency, IT demands standardization and security, innovation teams produce demos, and the board approves a collection of projects that cannot be compared.

The essay is worth reading because it elevates AI from “a new tool the technology department should study” to “a strategic choice the highest governing body must make.”

2. What McKinsey gets right

McKinsey defines a company’s AI posture along two dimensions.

The first is the source of value: does AI primarily optimize the existing business, or does it create new products, markets, and revenue?

The second is breadth of adoption: is AI limited to a few proven use cases, or embedded across the organization?

That creates four postures:

• Internal transformation: AI enters operations broadly and becomes a foundation for redesigning the operating model.

• Business expansion: AI drives new products, services, and growth, redefining competitive advantage.

• Functional reinvention: AI enters selected workflows with clear returns and improves critical functions step by step.

• Measured adoption: the company waits for capabilities and market value to be validated, then follows selectively.

This framework is useful for companies still asking whether they should “do AI.” It forces the board to move beyond the tool layer. Is AI merely an efficiency tool, a portfolio of investments, a new product capability, or a reconstruction of the business and operating model?

I especially agree with McKinsey’s description of internal transformation. Once AI enters planning, supply chains, maintenance, and other cross-functional workflows, the board cannot look only at the accuracy of one tool. It has to understand system dependencies, enterprise architecture, interoperability, resilience, observability, and explainability.

That is close to what Ha7ch has consistently emphasized. An FDE must understand more than RAG, model tuning, or MCP integration. The core question is how AI enters a company and what Harness the company needs to receive it.

A company that expects to use Agents broadly needs its own Context, Skills, Gateway, permissions, audit records, and feedback mechanisms. Models supply intelligence. The company must build the architecture that receives, constrains, and accumulates that intelligence.

McKinsey has therefore recognized something important: AI transformation eventually becomes an enterprise-architecture question, not a procurement question.

3. It still treats AI as a portfolio of projects to govern

The governance playbook in the second half remains recognizably traditional: map the AI portfolio, evaluate pilots, calculate ROI, manage vendors, define risk thresholds, and scale successful projects.

None of that is wrong. Companies should stop projects that create no value and know where the budget goes. But the playbook assumes AI remains a class of software operated by humans.

That assumption changes once AI can understand work, call systems, allocate tasks, and act on a person’s behalf.

Traditional software defines functional permissions: after logging in, an employee may view a table, edit a field, or submit an approval. An Agent needs action permissions. It can read information across systems, understand a goal, plan steps, call tools, and continue executing.

A sales Agent may touch customer records, historical quotes, contract templates, and collections status. A finance Agent may read regulations, past project documents, and operating data. A manager’s Agent may synthesize team progress, identify risk, assign work, and follow up automatically.

At that point, the object of governance is no longer whether “an AI project” launches. It is how the right to know, judge, call, and act is redistributed inside the enterprise.

McKinsey focuses on what the board should review, which risks should escalate, and which investments need oversight. Ha7ch focuses on how those principles become part of daily operations. Without systematic permission checks, call logs, accountability, and exception escalation, even a complete AI policy remains a document on a shelf.

The disagreement is therefore not whether AI matters. It is the level at which we observe it.

McKinsey sees AI mainly as part of enterprise strategy and the investment portfolio. ANC goes one layer deeper and treats AI as the company’s new runtime.

4. The four AI postures are better understood as an evolution path

McKinsey presents business expansion, internal transformation, functional reinvention, and measured adoption as four strategic postures. That classification helps boards align, but real companies rarely fit into one box.

A large enterprise may pursue internal transformation in production, functional reinvention in customer service, business expansion in a new unit, and measured adoption in high-risk legal or financial work. Different business units can occupy different stages at the same time.

For most traditional companies, the four postures are less like fixed identities and more like a path of evolution.

The path usually begins with one concrete business point whose value can be verified. Once it works, the team gains more Context, discovers human judgments and exceptions, and turns a one-off delivery into a reusable capability. Only as those capabilities expand along the workflow can the company reconstruct operations and eventually create new products or revenue.

That is why we proposed Lawted’s 48 theory.

**48 hours: find one point inside a broader surface**

Forty-eight hours does not complete an enterprise transformation or promise an entire platform in two days. It identifies a small entry point with clear enough value to test in the real business.

In manufacturing, that point may turn resignation forms, inspection sheets, or workshop records into structured data and give a supervisor immediate statistics. In accounting, it may convert policy documents, bids, and project archives into summaries, fields, and verifiable spreadsheets. In a fleet or project organization, it may let an Agent read scattered records and complete one real task before anyone builds a platform nobody uses.

The first stage validates the original processing time, AI processing time, field usability, required human corrections, and whether the business owner wants to keep using it.

**48 days: turn the result into enterprise capability**

A successful demo does not mean the company owns AI capability. The decisive question is whether project Context, judgment rules, failure cases, and human corrections keep accumulating.

Over 48 days, scattered material becomes knowledge, Skills, and reusable workflows. AI moves from a one-off demonstration into stable work. The company begins tracking usage frequency, task volume, correction rates, feedback cycles, the number of Skills, and whether errors fall over time.

Many pilots fail to scale not because the model is weak, but because every project starts from zero. Data, Context, and human corrections do not accumulate. When the vendor leaves, the capability leaves too. The company runs many pilots without becoming more intelligent.

**48 weeks: reconstruct the end-to-end workflow**

Once multiple business points become stable capabilities, AI can expand upstream and downstream. The object of change is no longer one job’s efficiency, but cross-functional information, task, approval, and accountability flows.

In McKinsey’s language, 48 hours resembles the beginning of functional reinvention; 48 days begins internal transformation; 48 weeks creates the conditions for real business expansion.

A company does not need to rush to label itself with one posture. It needs to know its current stage, which capabilities the next stage requires, and how to prevent every pilot from ending at zero.

5. What boards really have to govern is an Agent’s right to act

McKinsey proposes six actions: define the AI posture, allocate oversight, institutionalize governance, speak more often with frontline owners, connect investment to business value, and improve the board’s AI literacy.

All six are valid. The Agent era requires another, more operational layer.

The first layer is Context governance.

Meetings, customer conversations, operating records, business documents, and employee experience cannot become universally accessible merely because the company wants to “train AI.” The company must define which Context belongs to the organization, which roles may access it, what may enter an external model, and what must remain local, domestic, or in a dedicated environment.

The second layer is Skills governance.

Once business experience is packaged as a Skill, it changes from one person’s method into a rule the organization can execute repeatedly. Someone must own the authority to create, review, publish, modify, and retire Skills, with versions and change history preserved.

The third layer is Agent permission governance.

“AI allowed” and “AI forbidden” are not enough. Permissions must specify what an Agent may read, which systems it may call, the value or risk level of actions it may execute, and where human approval is mandatory.

The fourth layer is accountability.

Every critical AI workflow needs an explicit Owner and DRI. The board sets governance boundaries, management owns business results, the business Owner owns value, and the DRI owns implementation. AI can perform work; it cannot become an excuse for responsibility to disappear.

The fifth layer is exception and escalation governance.

High-risk calls, unauthorized behavior, sensitive-data leakage, sudden quality drops, and errors at scale must trigger explicit stop, rollback, and reporting mechanisms. Governance should not occur only in an annual review. It has to execute inside every real Agent action.

This is why ANC needs a permission system. Governance is not an AI ethics statement on the wall; it is a constraint enforced whenever the system retrieves, calls, executes, and publishes.

6. Companies need an AI operating layer, not more AI tools

If AI is treated as a project category, the natural response is to keep buying tools: one for sales, another for finance, another for HR, plus separate vendors for knowledge, service, meeting notes, and analytics.

That can launch quickly and create clear vendor accountability. Over time it creates a new fragmentation: each tool holds part of the data, each vendor encloses part of the business logic, each department maintains another knowledge base, and employees switch between a growing number of AI entry points.

ANC adds an enterprise AI operating layer beneath those tools:

• Tokens or models provide base intelligence.

• The Harness understands the task, organizes the steps, and calls capabilities.

• The Gateway connects Feishu, DingTalk, desktop clients, or an employee’s own Agent.

• Context preserves enterprise knowledge, field information, and organizational memory.

• Skills encode reusable business capabilities.

• Permissions and audit define what an Agent may see, do, and represent.

• Feedback writes every human correction back into organizational capability.

This operating layer does not require replacing every existing system or building everything in-house. It lets the enterprise retain its Context, process, permissions, and business judgment while models and vendors continue to change.

Build versus buy is therefore not binary. A company can buy models, tools, and industry capabilities, but it must own the critical business Context, Skills, permission boundaries, and accountability structure.

7. ROI alone understates the organizational change

McKinsey recommends tracking AI-project ROI, the share of AI-enabled business, human intervention, resilience, retraining, and compliance. Those metrics matter, but they mainly reveal whether a project produces visible returns.

AI-native transformation needs three additional groups of metrics.

The first measures capability accumulation: how long it takes to turn a business problem into a usable AI capability; how quickly frontline feedback becomes a Skill; whether a capability is reused across departments; and whether human corrections reduce the next execution’s error rate.

The second measures governance: whether critical workflows have an Owner and DRI; whether Agent permissions are traceable; whether high-risk behavior requires confirmation; whether exceptions can roll back; and whether core Context has explicit data boundaries.

The third measures organizational structure: whether AI reduces repetitive reporting and manual coordination; whether decisions move closer to the real field; whether management spans increase; and whether information that once depended on middle-layer relays can reach decision-makers under controlled conditions.

Traditional ROI asks whether a project makes or saves money. These metrics ask whether the company is developing the ability to keep evolving.

The first determines whether the project continues. The second determines whether the company remains competitive.

8. The board cannot demand transformation only from everyone else

McKinsey’s title asks how boards can evolve, but most of the essay discusses how boards should supervise management, review projects, and track risk.

The deeper question is what happens when AI changes the company’s information and decision structure. Boards, executives, and middle layers all enter the scope of reconstruction.

Boards traditionally understand the company through management reports. Management understands the front line through layers of aggregation. One of the middle layer’s central functions is to collect information, coordinate resources, monitor progress, and report upward. Much of the structure exists because information is scarce, delayed, and costly to coordinate.

With continuously updated Context, traceable task systems, and Agents that understand business state, information no longer needs to pass through five layers of slides before reaching a decision-maker. Coordination no longer always requires a human relay.

That does not mean every company should immediately remove middle management, or that boards should bypass executives and command the front line. It means structures created by opaque information and high coordination costs must be tested again for value.

Managers who create judgment, accept responsibility, develop people, and handle complex conflict become more valuable. Roles built mainly around relaying information, chasing progress, producing reports, and maintaining process will compress.

If a board asks employees to learn AI and business units to submit AI projects while declaring today’s hierarchy, approvals, and power structure untouchable, that is not AI transformation. It is an old company with more AI tools.

AI rewriting the rules means no role sits outside the rewrite, including the board itself.

Conclusion: McKinsey explains why; Ha7ch cares about how

Overall, I agree with roughly 70% of McKinsey’s argument.

It correctly raises AI from a technology-tool question to one of strategy, governance, and capital allocation at board level. It also recognizes the importance of enterprise architecture, cross-functional workflows, and business value. Companies that still think AI means chatbots, knowledge bases, or office plug-ins should read it.

But the essay stops mainly at governance principles and project portfolios. It does not continue into enterprise AI runtime architecture, Agent permissions, organizational accountability, and management redesign.

That is precisely what Ha7ch and ANC are trying to answer.

McKinsey tells boards why they must begin governing AI.

Ha7ch asks how Context accumulates, how Skills grow, how Agents receive permissions, how Owners and DRIs remain accountable, and how a company starts from one real business point and gradually becomes an AI Native Company over 48 hours, 48 days, and 48 weeks.

We are not rejecting McKinsey. We are following its conclusion one step further.

AI is not one more slide in the board’s quarterly deck, or one more topic at the annual strategy meeting.

It will become the company’s new operating system.

The board’s real evolution is recognizing that it must not only govern this system. It is also inside the system being rebuilt.

## 中文

前情提要：请先读麦肯锡原文

这篇文章不是对麦肯锡原文的摘要，也不能替代原文。

麦肯锡在《The AI Reckoning: How Boards Can Evolve（https://www.mckinsey.com/capabilities/mckinsey-technology/our-insights/the-ai-reckoning-how-boards-can-evolve）》中，提出了企业的四种AI定位，以及董事会应当采取的六项治理行动。它完整讨论了董事会为什么必须介入AI、企业应当如何明确AI定位，以及不同定位分别需要怎样的治理方式。

下面很多讨论，都是建立在麦肯锡这套框架之上的延伸。如果没有先读原文，很容易把这篇文章误解成对麦肯锡的简单反驳。

这篇文章的阅读顺序只有一个：必须先读完麦肯锡原文，再回来读这篇。中文读者可以先读麦肯锡中国发布的中文版本；没有中文版本时，可以直接阅读上面的英文官方原文。

上一篇“劳泰德锐评麦肯锡”，我谈的是：AI不是重做HR。这一次，我不准备为了“锐评”而故意唱反调。因为这篇文章的大方向没有错，而且在传统咨询机构关于AI的讨论里，甚至算得上比较先进。

它至少抓住了一个非常重要的变化：AI已经不再只是CIO、CTO或者数字化部门的问题，而是董事会必须直接面对的企业级问题。

但我认为，它还是没有把这件事情推到最后。

麦肯锡把AI当成了董事会必须增加的一项核心议程；我们在Ha7ch的企业实践中看到的则是，AI最终不会只成为董事会的新议程，而会成为公司未来的新运行系统。

这两种理解看起来只差一句话，最后会走向完全不同的企业。

一、先说结论：这是一篇值得董事会认真读的文章

麦肯锡在文章中指出，超过88%的企业已经在至少一项业务职能中使用AI，但董事会治理明显没有跟上。财富100强中，只有39%的企业披露了某种形式的董事会AI监督机制；66%的受访董事认为，自己所在的董事会缺少AI相关知识和经验；还有接近三分之一的人表示，AI甚至没有进入董事会议程。

这些数字不能被简单横向比较。员工使用过AI，不等于企业已经完成AI转型；企业没有公开披露AI专委会，也不代表内部完全没有治理。但是它们共同说明了一件事：AI在企业里的扩散速度，已经明显快于管理层和董事会理解它的速度。

很多企业的现状是，员工已经开始使用各种AI工具，业务部门已经出现大量自发试验，供应商也在不断推销新的智能体方案，但董事会仍然用传统信息化项目的方式理解这一切。管理层看到的是预算、采购、试点和ROI，一线员工感受到的却是工作边界、协作方式和岗位价值正在快速变化。

麦肯锡的价值，在于它把这个错位摆到了董事会面前。

它没有把AI治理简单写成风险、合规和伦理问题，而是要求董事会首先明确企业的AI定位，将AI与企业战略、竞争格局、业务模式和资本配置联系起来。这个起点是正确的。

如果一家企业连AI对自身意味着什么都没有形成共识，后面的预算、人才、组织、供应商和治理必然彼此冲突。业务部门会追逐短期效率，IT部门会强调统一与安全，创新部门会制造大量Demo，董事会则只能在一堆无法比较的项目之间做审批。

因此，这篇文章值得董事会认真读。它最大的意义，不是提供了一个完美答案，而是把AI从“技术部门应该研究的新工具”，提升成了“企业最高治理层必须做出的战略选择”。

二、麦肯锡说对了什么

麦肯锡首先提出，企业要从两个维度确定自己的AI定位。

第一个维度是价值来源。AI的价值主要来自优化现有业务，还是来自开拓新产品、新市场和新收入。

第二个维度是应用程度。AI只进入少数经过验证的业务场景，还是广泛嵌入整个组织。

由此形成四种典型定位：

• 内部转型：AI全面进入企业运营，成为重塑运营模式的基础能力；

• 业务开拓：AI推动新产品、新服务与业务增长，重新定义企业竞争力；

• 职能重塑：AI进入投资回报明确的特定流程，逐步提高关键职能效率；

• 稳健采用：企业等待能力和市场价值被验证后，再有选择地跟进。

这个框架对于仍在讨论“公司要不要做AI”的企业非常有用。它迫使董事会把问题从工具层提升到战略层：AI究竟只是提高效率的工具，是一批需要管理的投资项目，是新的产品能力，还是一次对业务模式和运营方式的整体重构。

我尤其认同文章对“内部转型”的描述。麦肯锡提到，当AI进入规划、供应链、维护和其他跨职能流程时，董事会不能只看单个工具的准确率，而必须理解系统之间的依赖关系、企业架构、互操作性、韧性、可观测性和可解释性。

这和Ha7ch一直强调的事情非常接近。FDE最需要理解的，不只是RAG怎么做、模型怎么调、MCP怎么接，而是AI究竟如何进入一家企业，以及这家企业要为AI准备怎样的Harness。

如果一家企业未来会广泛使用Agent，它就必须拥有自己的Context、Skills、Gateway、权限系统、审计记录和反馈机制。模型只是能力来源，企业真正需要建设的是承接、约束和积累这种能力的架构。

从这个角度看，麦肯锡已经意识到：AI转型最终会碰到企业架构，而不仅是工具采购。这是这篇文章最有价值的部分。

三、它仍然把AI理解成一组需要治理的项目

文章后半部分给出的治理方式，仍然带有非常明显的传统数字化转型色彩：建立AI项目全景图、评估试点、计算ROI、管理供应商、设置风险阈值，再把成功项目规模化推广。

这套方法没有错。企业当然需要停止没有价值的项目，也需要知道预算花到了哪里。但是这套方法隐含了一个前提，即AI仍然是一类由人操作的软件系统。

当AI开始理解业务、调用系统、分配任务并代表人执行动作后，这个前提就发生了变化。

传统软件定义的是功能权限。员工登录系统以后，可以查看某张表、修改某个字段、提交某项审批。Agent定义的则是行动权限。它不仅能够读取信息，还能够跨系统理解目标、组织步骤、调用工具并持续执行。

一名销售的Agent可能同时接触客户信息、历史报价、合同模板和回款情况；一名财务人员的Agent可能读取政策文件、历史项目材料和经营数据；一名管理者的Agent可能汇总团队进展、识别风险、安排任务并主动催办。

这时，治理对象已经不再是“某个AI项目是否上线”，而是企业内部的知情权、判断权、调用权和执行权如何被重新分配。

麦肯锡主要从董事会视角讨论哪些事项需要审议、哪些风险需要上报、哪些投资需要监督。Ha7ch更关心的是，这些治理原则如何真正进入企业的日常运行。没有系统化的权限校验、调用记录、责任归属和异常升级，再完整的AI治理政策也很容易停留在文件里。

所以，真正的分歧并不是麦肯锡重不重视AI，而是双方观察AI的层级不同。

麦肯锡主要把AI看作企业战略和投资组合的一部分；ANC进一步把AI看作企业新的运行层。

四、四种AI定位，更像一条企业演进路径

麦肯锡将业务开拓、内部转型、职能重塑和稳健采用描述为四种AI定位。这种分类适合帮助董事会建立共识，但在真实企业里，四种定位很少泾渭分明。

一家大型企业可以在核心生产环节推动内部转型，在客户服务领域进行职能重塑，在新业务部门尝试业务开拓，同时在高风险的法务和财务场景保持稳健采用。不同业务单元甚至会在同一时间处于完全不同的阶段。

对大多数传统企业而言，这四种定位与其说是固定身份，不如说是一条逐渐演进的路径。

企业通常从一个真实、具体、能够验证价值的业务点开始。这个点跑通以后，团队才有机会获得更多Context，理解人工判断和业务例外，再将一次性交付沉淀成可以反复使用的能力。只有当这些能力沿着业务流程持续扩展，企业才可能真正重构运营模式，最终开拓新的产品与收入。

这也是我们提出“劳泰德48理论”的原因。

**48 小时：找到一个面里的一个点**

48小时不是完成企业转型，更不是承诺两天交付一整套系统。它的作用是在真实业务现场中，找到一个足够小、价值足够清晰、能够被快速验证的切入点。

在制造企业里，这个点可能是把离职单、巡检表或车间记录从图片转成结构化数据，并让主管直接看到统计结果。在财会企业里，这个点可能是把红头文件、标书和历史项目材料转成摘要、字段与可核验的Excel结果。在车队或项目型组织里，这个点可能是让Agent读取散落的资料和沟通记录，先完成一次真实任务，而不是搭一个看起来完整却没人使用的平台。

这一阶段验证的不是“AI先进不先进”，而是原流程耗时、AI处理耗时、字段可用率、人工修正项以及业务负责人是否愿意继续使用。

**48 天：把结果沉淀成企业能力**

一个Demo成功，并不代表企业拥有了AI能力。真正重要的是，项目过程中获得的Context、判断规则、失败案例和人工修正，能否持续沉淀。

48天阶段需要把零散材料逐步整理成知识、Skills和可复用流程，让AI从一次性演示进入稳定工作。企业开始关注使用频率、任务量、修正率、反馈周期、Skills数量和错误是否持续下降。

许多AI试点无法规模化，并不是模型不够强，而是每一个项目都从头开始。数据没有沉淀，Context没有沉淀，人工修正没有沉淀，供应商一走，能力也跟着离开。项目做了很多，企业自身却没有变得更聪明。

**48 周：重构端到端流程**

当多个业务点已经形成稳定能力，AI才有条件沿着上下游流程展开。此时企业改造的对象不再是单个岗位的效率，而是跨部门的信息流、任务流、审批流和责任结构。

用麦肯锡的语言来说，48小时接近职能重塑的起点，48天逐渐进入内部转型，48周才有机会走向真正的业务开拓。

因此，企业没有必要急着给自己贴上某一种AI定位。更重要的是明确当前阶段、下一阶段需要积累的能力，以及如何避免每次试点结束后一切归零。

五、董事会真正要治理的，是Agent的行动权

麦肯锡提出了六项关键行动：明确AI定位、划分监督职责、制度化治理框架、增加与一线负责人的沟通、把投资与业务价值挂钩，以及提升董事会AI素养。

这些建议都成立，但Agent时代还需要补上一层更具体的治理机制。

第一层是Context治理。

企业的会议、客户交流、操作记录、业务文档和员工经验，不能因为“要训练AI”就默认全部开放。企业需要明确哪些Context属于组织资产，哪些只能由特定角色访问，哪些可以进入外部模型，哪些必须留在境内、本地或专属环境中。

第二层是Skills治理。

当一套业务经验被封装为Skill，它就从个人工作方法变成了可以被组织反复执行的规则。企业必须明确谁可以创建、审核、发布、修改和下线Skills，并保留版本与变更记录。

第三层是Agent权限治理。

企业不能只设置“允许使用AI”或“不允许使用AI”。权限必须细化到Agent能够读取哪些信息、调用哪些系统、执行多大金额或风险等级的动作，以及在哪些节点必须经过人工批准。

第四层是责任治理。

每一项关键AI流程都需要明确的Owner和DRI。董事会负责确定治理边界，管理层对经营结果负责，业务Owner对业务价值负责，DRI对具体推进和落地负责。AI可以承担工作，但不能成为责任消失的借口。

第五层是异常与升级治理。

高风险调用、越权行为、敏感数据泄露、输出质量骤降和大规模错误，必须触发明确的停止、回滚和上报机制。治理不应只在年度审查时发生，而应嵌入Agent每一次真实行动。

这也是ANC需要权限系统的原因。治理不是挂在墙上的AI伦理声明，而是系统在每次检索、调用、执行和发布时真正实施的约束。

六、企业需要的不是更多AI工具，而是一套AI运行层

如果把AI看成项目，企业最自然的做法就是不断采购工具。销售有销售AI，财务有财务AI，人力资源有HR AI，知识库、智能客服、会议纪要和数据分析分别由不同供应商提供。

短期看，这种方式上线快、责任清晰。长期看，企业很容易形成新的碎片化：每个工具都拥有一部分数据，每个供应商都封装一部分业务逻辑，每个部门都重新维护一套知识，员工则在越来越多的AI入口之间切换。

ANC希望补上的，是工具之下的一套企业AI运行层：

• Token或模型提供基础智能；

• Harness负责理解任务、组织步骤和调用能力；

• Gateway连接飞书、钉钉、桌面端或员工自己的Agent；

• Context保存企业知识、现场信息和组织记忆；

• Skills沉淀可以复用的业务能力；

• 权限与审计约束Agent可以看什么、做什么、代表谁行动；

• 反馈机制把每一次人工修正重新写回组织能力。

这套运行层不要求企业把所有系统推倒重来，也不要求所有能力都由自己研发。它真正解决的是企业能否保有自己的Context、流程、权限和业务判断，并在模型与供应商不断变化时维持战略主动权。

在这个框架下，采购和自研不再是非此即彼。企业可以采购模型、工具和行业能力，但最关键的业务Context、Skills、权限边界与责任结构必须由企业自己掌握。

七、只看ROI，会低估真正的组织变化

麦肯锡建议董事会关注AI项目ROI、AI赋能业务占比、人工干预率、系统韧性、员工再培训和合规情况。这些指标当然应该看，但它们主要反映项目有没有创造可见收益。

AI-native转型还需要另外三组指标。

第一组是能力积累指标，包括一个业务问题从被发现到形成可用AI能力需要多长时间，一线反馈转化为Skill需要多长时间，同一项能力能否跨部门复用，人工修正能否降低下一次执行的错误率。

第二组是治理指标，包括关键流程是否明确了Owner和DRI，Agent权限是否可追踪，高风险行为是否存在人工确认，异常是否可以回滚，核心Context是否具备清晰的数据边界。

第三组是组织结构指标，包括AI是否减少了重复汇报与人工协调，决策是否更接近真实业务现场，管理跨度是否扩大，原本依赖中层转发的信息是否能够在受控条件下直接到达决策者。

传统ROI衡量的是一个项目有没有赚钱或者省钱；这些指标衡量的是企业有没有形成持续进化的能力。

前者决定项目是否继续，后者决定公司未来是否仍然具备竞争力。

八、董事会不能只要求别人转型

麦肯锡的题目是“董事会如何自我进化”，但正文的大部分内容仍然聚焦董事会如何监督管理层、审查项目和追踪风险。

更进一步的问题在于，当AI改变企业的信息流与决策结构时，董事会、管理层和中层自身也会进入改造范围。

过去，董事会了解企业依赖管理层汇报，管理层了解一线依赖层层汇总。中层的重要功能之一，是收集信息、协调资源、监督进度和向上汇报。这样的组织结构，很大程度上是在解决信息稀缺、信息延迟和协作成本高的问题。

当企业逐渐拥有持续更新的Context、可追踪的任务系统和能够理解业务状态的Agent以后，很多信息不必再经过五层PPT才能到达决策者，很多协调也不必依靠人肉传话。

这不意味着所有企业都应该立即取消中层，也不意味着董事会可以绕过管理团队直接指挥一线。它意味着，原来因为信息不透明和协调成本而形成的管理结构，需要重新接受价值检验。

真正创造判断、承担责任、培养人才和处理复杂冲突的管理者，价值会进一步上升。只负责转发信息、追踪进度、制作汇报和维持流程的岗位，则会被Agent显著压缩。

如果董事会只要求员工学习AI、业务部门提交AI项目，却默认现有管理层级、审批关系和权力结构一律不动，这不叫AI转型，只是在旧公司里增加了一批AI工具。

AI改写规则，意味着没有任何岗位天然处于规则之外，包括董事会自己。

结语：麦肯锡回答了为什么，Ha7ch更关心怎么做

整体来说，我认可这篇文章大约70%的判断。

它正确地把AI从技术部门的工具问题，提升成董事会层面的战略、治理与资本配置问题；它也看到了企业架构、跨职能流程和业务价值的重要性。对于仍然把AI理解成聊天机器人、知识库和办公插件的企业，这篇文章非常值得读。

但它主要停留在治理原则和项目组合层面，没有继续进入企业AI运行架构、Agent权限、组织责任和管理结构重构。

这恰好是Ha7ch与ANC希望继续回答的问题。

麦肯锡告诉董事会，为什么必须开始治理AI。

Ha7ch更关心的是，AI进入企业以后，Context如何沉淀，Skills如何生长，Agent如何获得权限，Owner与DRI如何承担责任，一家公司又如何从一个真实业务点出发，在48小时、48天和48周里逐渐变成真正的AI Native Company。

所以，我们不是要反对麦肯锡，而是沿着它的结论再往前走一步。

AI不是董事会每个季度新增的一页PPT，也不只是年度战略会上的一个新议题。

它最终会成为企业的新运行系统。

而董事会真正的自我进化，是意识到自己不只要治理这套系统，也身处这套系统的改造之中。