AI Enablement Radar week 29: give every AI workflow an owner and a version

This week's strongest AI signal is about how the work is organized. MUFG combines broad access with mandatory training and departmental AI champions. Mistral is turning prompts and skills into versioned assets. GitHub now shows where coding agents are actually used at repository level. For a smaller organization, the lesson is concrete: an instruction that works should not remain in someone's chat history. It needs an owner, a version, and a place where colleagues can find it.

AI enablement means giving people the instructions, access, and working routines they need to use AI in real work. This week's updates point to a more managed approach, where the organization can improve its AI workflows without losing track of what ran or why.

Top signals this week

• MUFG is rolling out ChatGPT Enterprise to about 35,000 employees at Mitsubishi UFJ Bank. Everyone who received an account completed the training, and employees built more than 1,800 custom GPTs in four months. Selected research tasks reported a 20–30 percent lower workload. OpenAI describes the rollout.
• MAIRE has more than 200 engineers developing agents and is moving more than 100 agentic solutions toward enterprise deployment. It connects Microsoft Foundry and Copilot Studio to Autodesk data, so engineers can query models, issues, and documents from Microsoft Teams. Read Microsoft's customer story.
• GitHub has released daily repository-level metrics for Copilot coding agent and Copilot code review. The activity covers pull requests created and merged, reviews, and suggestion counts. It measures usage rather than code quality, but gives teams a place to start tracking adoption. See GitHub Changelog.
• Mistral Studio can now manage prompts and skills with immutable versions, named owners, comparisons, rollback, and audit logs. A useful instruction can become a maintained asset instead of a copied text fragment. See Mistral's product update.
• The European Commission's new action plan connects AI use with model evaluation, secure test environments, and existing rules including the AI Act, NIS2, the Cyber Resilience Act, and DORA. Organizations need to build capability and control together. Read the EU action plan.

What organizations are actually doing with AI

MUFG's numbers are interesting, but its operating model is more useful than its size. The bank made e-learning mandatory before access, appointed AI champions in departments, and supported employees as they built their own assistants. The central AI function set the frame. The business filled it with local workflows.

Source: MUFG aims to become AI-native with OpenAI

MAIRE uses the same basic idea in an engineering environment. Domain experts build agents close to the work and can query thousands of models, issues, and documents in natural language. An agentic workflow is one where AI can plan and carry out several steps using tools or data, within defined rules and review points. The person who understands the process needs to help design that workflow.

Source: MAIRE redefines global engineering with 100+ use cases in Microsoft AI and Autodesk

Commonwealth Bank shows how the pattern can work in customer service. The bank has built a central orchestration layer that chooses between specialized AI, information retrieval, regulated deterministic journeys, and human specialists. The platform handles more than two million voice and messaging conversations each month. In May 2026, 84.6 percent of self-service messaging interactions were resolved end to end in the messaging channel. When a person takes over, the context and summary move with the case.

Source: How Commonwealth Bank and Microsoft are reimagining the future of customer service

Across all three cases, more people can build because ownership and handoffs are visible. An organization does not need to imitate a large bank. It can take a recurring instruction that already saves time and make it a shared, testable working routine.

The tooling layer: platforms, agents, and workflows

Mistral names a problem many teams already have: nobody can say with confidence which prompt version produced a particular customer answer. Studio gives prompts and skills owners, histories, test and production labels, and traceability to the result. A domain expert can improve the instruction while the usual tests and approvals control what reaches production.

Source: Your Prompts and Skills need a system of record

Google Conductor similarly moves important context out of temporary chats and into versioned files such as spec.md and plan.md. Conductor is now a plugin that can package skills, rules, MCP servers, and hooks and work with Antigravity CLI, Claude, and other compatible tools. MCP, or Model Context Protocol, is a standard way for AI systems to discover and use external tools and data sources.

Source: Evolving Spec-Driven Development: Conductor Now Supports Antigravity

GitHub makes two other parts visible. Copilot code review now runs behind a configurable firewall by default and can use dedicated setup steps in .github/workflows/copilot-code-review.yml. Repository metrics show where the agent creates, merges, and reviews pull requests. The firewall does not yet cover self-hosted runners, and activity data should not be confused with quality or time saved.

Sources: Copilot code review: Customization and configurability improvements and Repository-level GitHub Copilot usage metrics generally available

For a smaller team, the tool can be a shared folder, Git, or a simple document register. The principle is the same: save the instruction, record who owns it, note which version is running, and connect changes to an actual result.

Governance and risk: what needs to be in place before scaling

The European Commission's action plan proposes more capacity to evaluate advanced models before market entry and a secure testing platform for sectors including energy, transport, health, finance, and public administration. The plan sets a direction rather than delivering a finished control package. It still matters to smaller suppliers because their AI workflows often connect to larger customers' data, systems, and requirements.

Source: EU Action Plan on Cybersecurity and Artificial Intelligence

ENISA's report on AI and cybersecurity recommends human-gated decisions, auditability, and faster incident response when AI is used for defense. The practical translation is to integrate with clear controls. Use scoped permissions, environment variables or a secret manager for credentials, approval before external messages or irreversible changes, and logs that show which instruction and access were used.

Source: ENISA's view on Cybersecurity in the Frontier AI Era

ENISA has also published a maturity model for smaller companies affected by the Cyber Resilience Act. It covers governance and documentation, risk management, vulnerability and patch management, the product life cycle, and skills. The model includes an Excel self-assessment and three profiles: basic, intermediate, and advanced. ENISA notes that a high score is not proof of legal compliance.

Source: SME Cyber Resilience Maturity Assessment Model

This week's practical Hammer test

Rescue one useful AI instruction from chat history and make it maintainable. The test takes about 40 minutes.

1. 0–10 minutes: Choose an instruction the team uses repeatedly, such as customer replies, meeting summaries, or first drafts. Write down its purpose, owner, and who may use it.
2. 10–20 minutes: Put the instruction in a shared file. Label it v1 and record which sources it may read, the required output format, and what it must not assume.
3. 20–30 minutes: Run v1 on real, representative material. Review factual accuracy, completeness, and usefulness. Save the changes as v2 instead of overwriting the history.
4. 30–40 minutes: Write a short operating rule: who approves external messages, system changes, money, or new permissions? If the workflow needs a credential, keep it in an environment variable or secret manager rather than the prompt. Log the version, reviewer, and result after each run.

After the test, the team should be able to answer four questions without searching: What does the instruction do? Who owns it? Which version is running? What requires human approval?

This is typical Tool Forge work: connecting a useful AI routine to the right data sources, permissions, review points, and logging. The team leaves with a workflow it can improve next week, with more value than a one-off successful chat.

Companies and tools to watch

• MUFG, for combining mandatory training, departmental AI champions, and employee-built assistants.
• Mistral Studio, for versioning and ownership of prompts and skills.
• GitHub Copilot, as control settings and repository metrics begin to meet in the same rollout.
• ENISA, for practical models that smaller European suppliers can use when AI connects to products and customer systems.

If the team has several useful prompts but lacks a shared way to own, test, and deploy them, spend the next hour on one recurring workflow. Make responsibility and access clear, then build from there.