AI deployment requires decisions about infrastructure, governance, security and cross-border data flows.
Model selection is one part of that assessment.
Moody’s 2026 Global AI Outlook examines AI capabilities and the business risks associated with deployment.
The recommendations below are Kooch’s interpretation of the report for security and compliance teams.
Moody’s describes a market where model performance is still making major breakthroughs (better reasoning, multimodal inputs, more tool-use and “agentic” behavior). The key point isn’t which model is “best.”
The point is: competition is forcing rapid improvement, and open-source is closing gaps, especially from China and other ecosystems. That means “AI advantage” will be harder to defend purely through model choice.
Assess process design and governance alongside model performance.
Moody’s says adoption is expanding, but firm-level productivity gains are still patchy. AI helps most where work is routine, document-centric, customer-facing, or analytics-heavy — but complex workflows still create friction. Even if the model performs well in a demo, real value requires redesigning full processes, often on top of messy legacy systems.
A pilot may show limited operational value despite:
Our interpretation: data quality and operating processes affect whether a model delivers useful results.
Address fragmented data and unclear processes before expanding deployment.
Moody’s expects AI to widen gaps between leaders and laggards. They point out that large firms are already embedding AI across R&D, supply chain optimization, forecasting, fraud detection, and compliance — while smaller players struggle with cost, talent, and dependency on third parties.
They also list characteristics that increase disruption risk:
Mid-sized firms should assess where AI could improve a specific workflow.
Compare the expected benefit with the cost and capacity needed to maintain it.
The report also examines infrastructure capacity and costs.
Moody’s describes:
They also warn that demand will likely exceed supply through 2027/2028, giving pricing power to infrastructure owners — while long build cycles create a risk of overcapacity later if monetization doesn’t catch up.
Infrastructure constraints create two second-order risks:
Include a compute cost model in the deployment plan.
Moody’s argues geopolitical fragmentation is reshaping access to chips, compute, and data infrastructure. For enterprises, this can affect deployment:
Multinationals may be forced to run separate AI stacks across regions to comply with export controls, data transfer laws, and local technical standards.
They highlight regulatory divergence:
Budget for legal review and, where required, separate systems, monitoring, vendor management and incident response.
Before expanding into another jurisdiction, assess the applicable legal requirements and security controls.
When AI becomes agentic (able to use tools and take steps), the threat model changes.
Moody’s explicitly calls out:
They also note cyber insurers are trying to limit exposure to generative AI systemic incidents, including exclusions.
Apply access controls proportionate to an AI agent’s permissions. For privileged agents, assess the controls used for administrator accounts.
Use the following sequence to plan deployment:
Start with:
Be honest about what you can support:
Controls to assess:
If you operate across EU/US/Turkey/MENA/Asia:
Moody’s notes firms are improving measurement by tracking specific workflow improvements (accuracy, processing time, claims cycle time, etc.), but there’s no universal framework yet.
So build your own:
The report identifies risks from capital spending, infrastructure constraints, uneven returns, cyber exposure and differing regulatory requirements.
Assign responsibility for these risks before expanding AI deployment.
Source: Moody’s report, Artificial Intelligence Global 2026 Outlook — Risks are rising
