The gap between "AI can do this" and shipping it inside a regulated firm

Every private markets professional has now sat through the demo. A model reads a CIM in forty seconds, drafts the IC questions, builds the sensitivity table. The room nods. Someone says "we should be doing this." And then — in most firms — nothing much happens. Six months later the same team is still copying numbers out of PDFs by hand, and the demo has joined a long list of things that were technically impressive and organisationally dead on arrival.

This isn't a story about bad technology. The technology is, for a widening set of tasks, clearly good enough. It's a story about the distance between a capability existing and a capability being used, safely, by a real team, inside a real firm, on a Tuesday. That distance is consistently underestimated — by vendors, by consultants selling transformation decks, and by firms themselves.

01The adoption paradox, in numbers

Two findings, side by side, tell the whole story. The Bank of England and FCA's most recent joint survey found that 75% of UK financial services firms are already using AI, with another 10% planning to within three years^[1]. At the same time, MIT's NANDA initiative studied 300 enterprise AI deployments and concluded that roughly 95% of generative AI pilots deliver no measurable P&L impact at all^[2].

Read those together: nearly everyone is "doing AI", and almost no one is getting paid for it. Gartner expects the same pattern to repeat with the current wave of agentic projects, predicting that over 40% will be cancelled by the end of 2027 — escalating costs, unclear value, inadequate risk controls^[3]. Widespread experimentation. Very little transformation.

02Why the gap exists

Having sat on both sides of this — inside private markets firms, and now building for them — I think the gap comes down to four things, none of which appear in vendor demos.

The demo assumes tools you don't have. Regulated firms rarely get the latest and greatest. Some have a full agentic desktop setup; many are Copilot-only; most sit somewhere in between, with a security team that has — quite reasonably — locked down everything else. The MIT research found that employees at over 90% of the companies studied were quietly using personal AI tools anyway, while official corporate initiatives stalled^[2]. Microsoft's Work Trend Index puts a number on the same phenomenon: 78% of AI users bring their own tools to work^[4]. The demand is there. The sanctioned path isn't.

The process was never designed for AI. Running a language model over a workflow that grew organically over fifteen years mostly burns tokens. If the deal pipeline lives in one partner's inbox, no amount of AI fixes reporting. You redesign the workflow first, then automate it — in that order.

Governance arrives last, when it should arrive first. In most failed rollouts, controls were bolted on after the build — at which point compliance quite rightly killed the thing, or wrapped it in enough friction that nobody used it. Designing the guardrails, the audit trail, the "if it's not in the documents, say Not Found" rules alongside the tool is what makes it survivable. It's also, frankly, what makes it sellable internally.

Nobody owns the last mile. A working tool that nobody has embedded into the team's actual week is shelfware with better branding. This one matters enough that it gets its own post.

"The gap between a slick demo and a dependable product is a lot of grind — and that gap is where the actual work is."Paraphrasing Andrej Karpathy on partial autonomy, YC AI Startup School, 2025 [5]

03What "applied" actually means

The word I use for the alternative is applied, and it has a specific meaning: the work happens inside your environment, within your constraints, and it isn't finished until the team uses it without me in the room. In practice, the difference looks like this:

There's a useful frame I keep coming back to, because every firm now has access to broadly the same models: the edge is not the model. It comes from four things a firm actually controls — I think of them as the four C's. Context: the knowledge the AI works from — prior deals, IC history, how the firm operates. Connections: read and write access to the tools and data the team already uses. Capabilities: repeatable, reliable workflows anyone can pick up, not one-off prompts. Cadence: moving the right workflows onto a schedule so they run without being asked. None of the four is glamorous. All four are buildable inside a regulated environment, and together they compound into something a competitor can't download.

04The part the research agrees on

The encouraging thing in the MIT data is what the successful 5% did differently. They didn't have better models. They bought or partnered rather than building everything internally (external partnerships succeeded about twice as often as internal builds), they pushed adoption through line managers rather than a central AI lab, and they picked tools that could integrate into existing workflows and improve over time^[2]. BCG's framing of the same idea is the 10-20-70 rule: 10% of the effort is algorithms, 20% is technology and data, and 70% is people and process^[6].

That 70% — the workflow redesign, the governance, the training, the embedding — is precisely the part that doesn't demo well, which is why it's chronically undersold. It's also the part I've built a practice around. If your firm is somewhere in the 75%-adopting, 95%-not-yet-banking-it overlap, that's a fixable position — and fixing it doesn't start with new software. It starts with an honest look at the stack, constraints and workflows you already have.

That conversation is free, and I'm easy to find.