What is an AI roadmap, and how do you build one?

Most businesses do not have an AI problem. They have a sequencing problem: six good ideas, no agreed order, and a pilot that has been “nearly ready” since March. An AI roadmap is the document that fixes the order.

The short answer

An AI roadmap is a dated, sequenced plan of the AI projects a business will run, in what order, with an owner and a success measure attached to each. It sits between two other things. Above it is the strategy, which argues where AI should change the business and what that is worth. Below it are the individual builds. The roadmap is the schedule that turns the first into the second.

For a small or mid-sized Australian business it should fit on two pages, cover the next six to twelve months, and be written in detail only for the first ninety days. Everything else on it is a placeholder waiting for evidence.

Why most AI plans never become a roadmap

Two numbers frame the problem.

The first is adoption. The Australian Bureau of Statistics found that around 12 percent of Australian businesses used AI in 2024-25, and around 11 percent of small and micro businesses. The detail that matters is the split by behaviour: among small businesses that were already innovation-active, meaning they had deliberately introduced or improved a product, service or process, AI adoption was 19 percent. Among small businesses that had not, it was 4 percent. AI follows deliberate change. It does not create it.

The second is return. MIT’s NANDA initiative reported in 2025 that around 95 percent of the organisations it studied were seeing no measurable return from their generative AI pilots, despite heavy spending. The pilots did not fail because the models were weak. They stalled at the handover from experiment to daily operation: nobody owned the workflow, nobody had agreed what the pilot had to earn, and the tool was never wired into how work actually got done.

Put the two together and the pattern is plain. The businesses getting value treat AI as a sequence of ordinary projects with owners and numbers. The ones getting nothing treat it as a technology to try. A roadmap is the difference in writing.

What goes in an AI roadmap

Seven parts. Each is a heading on the two pages, and each can be a paragraph.

1. The baseline

What AI is already in use, approved or not. The National AI Centre’s guidance puts an AI register at the centre of this: a list of every AI system in the business, including AI features embedded in software bought for something else, like the assistant inside your accounting package or the summariser in your meeting tool. Most businesses doing this for the first time find tools nobody signed off. That is useful information, not a scandal. Our guide to shadow AI covers how to surface it without punishing the people who were trying to get work done.

The baseline also records the numbers the roadmap will be judged against: hours spent on the three or four repetitive processes you are likely to touch, response times, error rates, conversion rates. If you do not know a number today, measuring it is the first roadmap item.

2. The shortlist, ranked by payback

Every candidate project, with a one-line answer to three questions: what does it save or earn, how sure are we, and what could go wrong. Then a ranking. Most businesses land on two to four candidates worth doing in the next year, and a longer list that is honestly parked.

The ranking rule that works at small business scale is payback first, risk second, excitement nowhere. The National AI Centre’s foundations guidance makes the same distinction from the risk side: using AI to draft marketing emails is a different proposition from using it to assess job applications, even if the tool is identical. Early items on a roadmap should be the drafting kind.

3. Data and tools

For each shortlisted project, where the data lives, who can get at it, and what tool will do the work. This is where roadmaps built by vendors go wrong, because the tool is chosen before the problem. The right order is problem, data, then tool. Often the tool is one you already pay for and have not switched on.

The data question has a privacy edge. The Office of the Australian Information Commissioner’s guidance is that the Privacy Act applies to personal information put into an AI system and to any personal information in what comes back, and it recommends not entering personal information into publicly available AI tools at all. The roadmap should say, per project, which tier of tool is allowed: approved business accounts with training switched off for anything touching customer data, and nothing else.

4. Governance basics

Not a programme. The National AI Centre’s six essential practices, in their foundations version, map onto a handful of small-business actions: one named owner for AI overall, a short written policy, a register, a risk screen for each new use, a way for people to raise problems, and a human who can pause or switch off any system. If you already have a policy and a register from the baseline step, the governance section of the roadmap is mostly a date for reviewing them. If you do not, writing them is the roadmap’s second or third item, before the first build touches customer data.

5. People

Who learns what, and when. The foundations guidance asks organisations to train the people overseeing AI so they understand each system’s capabilities, limitations and failure points, and when to intervene. For a twelve-person business that is one afternoon for leadership before anything is chosen, and a short session for each team as their project arrives. The roadmap should name the sessions and put them ahead of the builds they support.

6. Sequence in ninety-day blocks

The first block in detail: the project, the owner, the number it must move, the date the result is reviewed. The second block in outline. The third and fourth as a sentence each. Anything further out is not on the roadmap, it is on the parked list.

The block structure is the point. A roadmap that lists twelve projects for the year is a wish. One that commits to one project for ninety days, with a review date, is a plan that can fail cheaply and be corrected.

7. Measurement and review

How each project is scored, and when the roadmap itself is revisited. The scoring should use the baseline numbers from part one. The review should be quarterly, and its job is to move the next block into detail, kill anything the evidence no longer supports, and add anything the last ninety days taught you. A roadmap that is not edited every quarter has stopped being a roadmap.

How to build one in four weeks

A working version, without a consultant, looks like this.

Week one: look. Build the register. Ask every team which AI tools they use, with an explicit promise that nobody is in trouble for answering. Check expense statements for subscriptions. Pull the baseline numbers for the processes you suspect are candidates. If a number does not exist, note that.

Week two: shortlist. Run a two-hour session with the people who do the work, not just the people who manage it. List every candidate, score each against payback, confidence and risk, and rank. Be suspicious of any candidate that scores high on excitement and low on measurability.

Week three: check the top three. For each, confirm where the data is, who owns it, what tool would do the job, and what could go wrong. Run the National AI Centre’s risk screen on each. Drop anything that needs customer data before a policy exists.

Week four: write it. Two pages. Baseline, ranked shortlist, data and tools, governance, people, the first ninety-day block in detail, and the review date. Circulate it to the people named in it. Start the first block.

If you do this and the first ninety days produce a measured result, good or bad, you have done more than most of the businesses in the MIT study.

Roadmap, strategy, maturity assessment: which do you need?

Three documents are sold under overlapping names, and it helps to know which one you are buying.

• An AI strategy answers where and why. Which parts of the business should AI change, what is that worth, and what is deliberately out of scope. It is the argument the roadmap depends on. Our AI strategy consultant page sets out how we build one with build orders tied to revenue rather than a slide deck.
• An AI maturity assessment answers where you are now. It scores how capably the business adopts, governs and gets value from AI, and produces a ranked list of gaps. It is a useful input to the baseline section of a roadmap, and our guide to AI maturity assessments covers what a good one gives you.
• An AI roadmap answers what, in what order, by when, owned by whom. It is the only one of the three that has dates on it.

A business starting from nothing needs a light version of all three, in that order, and can do the first two in a day. The roadmap is the one that gets used every week.

The mistakes that leave it in a drawer

Starting with the tool. A roadmap organised around a vendor’s product list is the vendor’s roadmap. Organise around the processes you want to change.

Writing twelve months in detail. Quarterly detail, annual outline. The tools will change under you.

No number per item. If a project has no measure, it cannot fail, so it cannot be learned from. The MIT finding is largely a finding about pilots that were never given a number.

Skipping the baseline. Businesses that skip the register and the measurement step discover their shadow AI problem during a customer complaint rather than during planning.

Governance as a separate project. The policy, register and risk screen are a week of work and belong at the top of the roadmap, not at the bottom as a compliance item for later. The Australian Cyber Security Centre’s guidance for small business is explicit that staff need to know what data cannot be uploaded before they start, not after.

Nobody owns it. One person owns the roadmap and runs the quarterly review. Otherwise it is a shared document with a last-edited date from the week it was written.

Where help earns its place

The four-week version above is within reach of most owners. Help is worth paying for in three situations: when the business has already run pilots that went nowhere and needs an honest account of why, when the shortlist is long and the payback estimates are guesses, and when the roadmap has to be built by the person who will then build the systems on it, so the plan and the delivery are the same promise.

That last case is how we work. Our AI foundations work covers the baseline, the training and the ranking; the AI strategy consultant engagement produces the argument and the ordered build list; and every engagement starts with the free AI use-case audit, which returns the three places AI pays for itself in your business within two business days. That shortlist is the first page of a roadmap, and it costs nothing to get.