Key takeaways
- Enterprise AI can stall when agents cannot reliably access trusted content under the right permissions.
- Better search alone will not make content AI-ready. Metadata, permissions, and governance also matter.
- Organisations can modernise gradually by starting with high-value workflows rather than replacing every legacy repository at once.
An AI pilot can work well in a demo and still struggle once it is put to use. Even a capable model will fall short if it cannot reliably find the information it needs or determine whether that information is current.
UK businesses are adopting AI quickly, but extensive use remains limited. The Office for National Statistics analysis found that around 35% of businesses with 10 or more employees were using AI by June 2026. Among businesses already using it, only 10% said they were doing so extensively.
Why content becomes the AI bottleneck
Box’s 2026 State of AI in the Enterprise report found that 96% of organisations consider access to company-specific content important for agents, yet only 36% have connected agents to trusted internal content across many use cases. A quarter cited fragmented data as a barrier and 24% pointed to integration difficulties. More than two-thirds said legacy or on-premises systems remained a moderate or major barrier to effective agent deployment.
Legacy content management systems were designed to store and protect documents over time. AI agents place different demands on that infrastructure because they need to retrieve information and use it within live workflows. Important content may also be spread across shared drives and cloud applications, making it difficult to identify the current version or determine who should have access.
Samantha Wessels, President of EMEA at Box, says warning signs often appear after a successful pilot. Teams may receive different answers to the same question or struggle to establish which source is current. Developers may find themselves building new connectors for each AI project.
“If the answer is ‘speculation,’ you do not have an AI problem. You have a content problem,” Wessels says.
Errors become harder to contain once AI moves from answering questions to taking action. An assistant that summarises an outdated document may waste an employee’s time. An agent that checks a contract against policy and updates another system can carry the mistake into a live process.
“The unit of governance is no longer just the model or the tool. It is the workflow,” Wessels says.
What AI-ready content looks like
Search alone does not make enterprise content ready for AI. Wessels says organisations also need to consider its quality and context, how it is classified and who has permission to use it. Governance needs to carry through as the content moves into AI-supported workflows.
Teams need to be able to identify the current version of a document quickly. Metadata can provide relevant context, including where and when a document applies. Sensitive information needs consistent classification, while access rules should carry over when applications or AI agents use the content. Retention requirements and audit records also need to remain attached.
In practice, a legal team might use this foundation to access the latest contract terms. UK law firm Travers Smith, for example, reports saving $4,000–$5,000 per legal case by using Box instead of legacy virtual data rooms. An HR employee could similarly use a shared content foundation to find the current policy for their region, while an AI agent would remain subject to the relevant permissions.
A unified content layer can make institutional knowledge available across workflows while preserving the controls around it. Organisations still need to verify the source and timeliness of information and control who can use it. Wessels calls this “institutional memory with provenance.”
Box’s Intelligent Content Management platform is designed around this model, providing a governed content layer for enterprise information and AI workflows. Box AI works with existing permissions and compliance policies. The platform also supports different AI models, so organisations do not need to rebuild content access each time their tools change.
Governance has to follow the content
Giving agents deeper access to company knowledge creates a security challenge. Box’s survey found that 49% of organisations had experienced an AI-related data exposure incident. Only 34% had formal standards governing how agents access company data, while 93% agreed that better governance would help them move faster over time.
For Wessels, controls need to apply as agents work. An agent should inherit the appropriate permissions of the person it represents instead of receiving blanket access. Sensitive content still needs appropriate classification, and organisations need a record of agent activity. The same policies should apply regardless of how the content is accessed.
Leaders should be able to trace an agent’s activity and establish who authorised its actions without spending weeks reconstructing the process.
Modernise around workflows, not repositories
Building this foundation does not have to mean replacing years of accumulated content infrastructure at once. Wessels recommends starting with a high-value workflow where poor access to trusted information is already creating friction, such as contract management or client onboarding.
Teams can clean, classify and connect the content supporting that workflow before moving to the next use case. Older systems can remain in place while organisations migrate work in stages.
UK facilities management company Mitie offers an example of the potential business benefits. By replacing its previous content management solution with Box, the company achieved six-figure annual cost savings. Its use of Box also supports automated employee onboarding and offboarding, with an audit trail of access permissions.
Leaders can prioritise workflows where better access to content would solve a clear operational problem. Content with significant compliance risk may warrant earlier attention too. Integration costs are another consideration when legacy repositories need a new connection for each AI tool.
Organisations can focus first on the content their most valuable workflows depend on, making it usable under the right controls before expanding to other areas.
Measure what reaches production
Production results offer a better measure of a content foundation’s value than the number of AI tools an organisation has bought or tested. Wessels recommends tracking how many pilots reach production and how quickly they deliver value. Organisations can then assess whether those workflows are producing measurable operational improvements.
Box’s research found a sizeable difference in reported returns across its maturity groups. Half of leading-edge organisations reported AI returns above 25%, compared with 11% of early-stage organisations. The survey does not establish a causal link between content maturity and those returns. However, organisations reporting stronger results were also further along in moving AI into production.
Make content strategy part of AI strategy
AI strategy and content strategy can no longer be treated as separate projects. A stronger model cannot compensate for unreliable content or information trapped in systems it cannot reach.
Enterprises that want to use AI in everyday work need a reliable way to give people and AI systems access to trusted content. Modernising the content foundation can help move AI projects into production while keeping permissions and governance in place.
Download Box’s State of AI in the Enterprise report to explore how organisations are moving from AI experimentation to agentic operations.
Key takeaways
An AI pilot can work well in a demo and still struggle once it is put to use. Even a capable model will fall short if it cannot reliably find the information it needs or determine whether that information is current.
UK businesses are adopting AI quickly, but extensive use remains limited. The Office for National Statistics analysis found that around 35% of businesses with 10 or more employees were using AI by June 2026. Among businesses already using it, only 10% said they were doing so extensively.
