Here's what actually strikes me talking to firms about AI: most of them aren't doing anything. No pilot, no copilot rolled out to a team, not one workflow quietly rebuilt, just a vague sense that they should probably look into it sometime. It isn't the technology; that's a login away. It's that they run into two walls. The first: they don't really control their own systems. The second, and the one that decides it: they don't have the agency to push through the first. So they hit "too hard, not now" once, and stop.
Two walls
Start by ruling out the technology. The tools are plentiful and a login away. I counted fifty-seven of them on a single conference floor in New York recently, most making the same promise, and they get easier to reach every month. Most firms still don't touch them. When something is that available and nothing happens anyway, whatever's in the way isn't the thing you can download.
The first wall is control of your own systems. A lot of firms simply don't have it: the levers sit with an outsourcer, a parent company in another country, or a change-approval committee. So the obvious first move, just trying something small, runs into someone else's process. There's nowhere a curious person is allowed to experiment, nothing they can safely poke at and learn from. The people who'd happily run with an idea have no room to run it, and the firm never gets out of first gear.
The second wall is the one that really decides it: the agency to get through the first. Hitting a wall is normal; what matters is whether anyone has the standing, the energy and the cover to push past it. Most don't, so the first "too hard, not now" is where the effort quietly dies. Not for lack of wanting, but because busting through would cost more than any one person can reasonably spend. That's what I mean by agency, stripped of the jargon: the power to act when the system would rather you didn't. Not the agentic kind everyone's marketing right now, but the older kind.
Where agency leaks out
These walls go up for reasons that made sense at the time: an outsourcing deal, a parent's IT standard, a risk policy nobody wants to be the one to break. Three patterns I see a lot:
- The outsourced small business. Years ago it handed IT to a managed service provider, the right call at the time. But now every change is a ticket to a third party whose job is to keep the lights on, not to reinvent the work. The ability to act got contracted out along with the servers.
- The subsidiary. The people doing the work can see exactly where AI would help. What they don't have is the authority to change their own systems. That sits with a parent, often in another country, on a global roadmap the local reality has to wait for. This is the hard one: the constraint is real and it's nobody's fault. The knowledge and the permission simply live in different places.
- The matrixed corporate. Plenty of skill, budget and intent, and accountability spread so wide that no single person can say yes. A change that touches risk, IT, ops and legal needs all of them to agree. Not dysfunction, just the governance doing its job. Unless someone senior carries it personally, it waits.
The owner-operator's quiet advantage
Then there's the opposite. The owner-operator sees the problem on Monday, tries something on Tuesday, keeps it or kills it by Friday. No parent, no committee, no ticket, and no wall to bust through: they control their own systems, and they're free to just try things. It's tempting to put that down to nerve or talent, but it's mostly structural. The distance between noticing something and acting on it is short, sometimes a single conversation, and right now that distance is close to the whole game.
What AI can do changes monthly, and the only reliable way to learn what it's good for in your business is to put it in front of real work and watch. That rewards short loops and punishes long ones. A firm that can run ten small experiments while another is still booking the steering-committee meeting doesn't just move faster. It learns faster, and the distance between them widens. The owner-operator isn't winning because they picked a better model. They're winning because nothing sits between them and trying.
Why regulated firms feel this most
Which is awkward, because the firms we like to work with sit at the structured end by design. A New Zealand insurer owned by an Australian group, a bank with a real risk committee, a broker that outsourced its systems a decade ago: these are the firms with the most reasons to move carefully, most of them good ones. Nobody wants a bank where anyone can just do stuff.
But for these firms the missing ingredient usually isn't the one people reach for. Less often than you'd think, it's permission or skill. More often, it's safety. In a regulated firm the downside of an AI mistake feels unbounded: a complaint, a breach, a regulator asking a question you can't answer, a consequence with your name on it. Faced with that, waiting is the rational individual choice, even when acting is the right choice for the firm. CoFI, APRA's CPS 230 and the incoming Contracts of Insurance Act don't ban AI, but they raise the cost of being wrong, and a higher cost of being wrong quietly suppresses the willingness to act. The agency doesn't vanish because people are timid. It vanishes because nobody will carry an unbounded risk on their own back.
You don't have to become an owner-operator
The usual advice at this point, "be more like a startup," is useless to a supervised subsidiary. You can't restructure your way out of having a parent or a regulator, and you shouldn't try. The good news is you don't need company-wide agency. You need a pocket of it: one place safe enough to actually experiment.
Take one process. Give it a clear mandate and someone empowered to act on it, draw a boundary around what they're allowed to change, and then make the work provable, so that experimenting inside that boundary isn't a personal bet. A lot of the fear eases the moment you can show what the AI did, how it was checked and who signed off. When being wrong is recoverable and evidenced rather than unbounded and invisible, people try things. And one real experiment tends to do what no business case can: it shows everyone a glimpse of what's actually possible, and that glimpse is what builds the appetite for the next step. That's agency you can manufacture deliberately, inside a structure built for caution rather than speed.
So when you look at why the AI era seems to reward the small and the founder-led, it isn't really about size, and it certainly isn't about technology. It's about the distance between seeing and doing, and who controls enough of their own destiny to close it. The firms that win won't usually be the most capable or the best funded. They'll be the ones that gave their people room to act, and in a regulated business that's a design choice, not an accident of the org chart.
I have an obvious stake in arguing this, so weigh it accordingly. But strip the stake away and the point still holds: change is a login away, and agency is the part you have to build for. The advantage is moving to the firms that do. Building AI you can prove, not just trust isn't only about satisfying a regulator. It's how a careful firm gives its own people permission to move. If that's a conversation worth having, hello@airclerk.ai reaches me directly.