
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Guide
This guide is for management boards that have their first successful AI projects behind them and are wondering who should lead this area from now on. We explain what an AI centre of excellence is, when it makes sense, and when one responsible person is enough. You also get a plan for the first 90 days and a list of the mistakes that most often make such teams disappear after a year.

After two or three successful pilots, organisational problems start. The sales department buys one tool, accounting buys another, and nobody knows what data is going to external services. An AI centre of excellence is created to bring order to this area without slowing the departments down.
The most common misunderstanding is that the management board imagines a department that will do all AI projects for the rest of the company. Such a department quickly becomes a bottleneck, and the other departments stop feeling responsible for the results. A well-built centre does less, but it does the things departments cannot do on their own.
Its typical tasks cover the four areas listed below. Everything else, including running specific projects, stays with the departments.
A centre of excellence is a fixed cost, so it should respond to a real need. A company that has one pilot and sets up a team of ten will spend money coordinating something that does not yet exist.
The signal that the time has come is usually several things happening at once. More departments want their own projects, questions arise about data security, and the management board wants to see one plan instead of several separate initiatives. The table below shows an indicative breakdown – it is our recommendation, not a standard.
In a company of 120 people, the first or second option is usually enough. A full centre with several dedicated posts makes more sense in organisations of several hundred people or in groups of several companies.
| Company situation | What is usually enough | Who makes decisions |
|---|---|---|
| First attempts, 1–2 projects | One person responsible for AI, a few hours a week, support from an external adviser | A board member who oversees the projects |
| 3–5 projects in several departments | A team of 2–4 people working part-time on AI, plus a steering committee | Steering committee, once a month |
| A dozen or more projects, several hundred people or several companies | A centre of excellence with dedicated posts and trained employees in the departments | Steering committee and an AI lead with a budget |

The first decision concerns where the people building AI solutions work. In a centralised model, they are all in one team, and departments commission work from it as they would from an external company. In a distributed model, the centre is small, and each department has a trained person who runs projects there.
In a mid-sized company, the distributed model usually works better. A departmental employee knows the process, the people and the exceptions, so they will find a sensible use more quickly. The centre makes sure everyone uses the same tools and follows the same rules.
The centralised model makes sense in two situations. The first is heavily regulated industries, where every project needs the same detailed review. The second is the very beginning, when there is not yet anyone in the departments who could run projects.
| Feature | Centralised model | Distributed model |
|---|---|---|
| Who builds solutions | The centre’s team, commissioned by departments | Trained departmental employees, supported by the centre |
| Advantage | Consistent tools and uniform quality | Faster decisions; the department is responsible for the result |
| Risk | A queue of requests and weak engagement from departments | Varying quality of solutions across departments |
| When it fits | Regulated industries, the very beginning | Most mid-sized companies after their first projects |
In a large organisation, each of the roles below is filled by a separate person. In a mid-sized company, one person often combines two roles, and an external partner takes on part of the work. What matters is that each responsibility has a specific owner, even if it is only part of their job.
The leader role is the hardest to fill. You need someone who understands both technology and business and can talk to the management board. A great programmer alone will usually not convince the committee, and a manager alone will not be able to judge whether an idea is technically feasible.

An AI centre of excellence is judged by how many well-functioning solutions the departments have, not by how many people work in it.
Without management support, a centre of excellence quickly becomes an adviser nobody has to listen to. The steering committee is a group of board members and department managers who approve the AI plan and settle disputes. It gives the centre a mandate for difficult decisions, such as rejecting a project or a supplier.
In a mid-sized company, the committee usually has four to six members. The full line-up is the CEO or COO, the CFO, the person responsible for IT, the AI lead and two managers of the departments that use AI most. A monthly meeting of about an hour and a half is enough.
It is worth writing down the committee’s remit straight away, so it does not have to be revisited with every dispute. A typical set covers the matters listed below.
Centres of excellence most often fail not because of technology, but because nobody agreed what they are responsible for. After a year, the management board asks about results, and the team has nothing to show. That is why three short documents need to be prepared in the first weeks.
The first is the scope, also called the charter: one page on what the centre does and what it does not do. The second half matters more, because it protects the team from a flood of requests along the lines of “give us AI for everything”.
The second document sets out the powers approved by the committee, for example the right to halt a project that has not passed a security review. The third lists the measures by which the management board will assess the team’s work. Sample measures are listed below – choose four to six and report them every quarter.
Ninety days is enough for the centre to start working, but not enough for it to show big results. The goal of this period is a working organisation: people, rules and the first procedures. The table below shows how to split the work over three months.
After 90 days, the committee reviews the first quarter and approves the plan for the next one. That is the time to check honestly which assumptions did not hold, and to adjust the scope.
| Period | What to do | Result at the end of the period |
|---|---|---|
| Days 1–30 | Set up the committee, choose an AI lead, list all AI tools and projects in the company, draft the scope | First committee meeting, AI lead approved and a list of current projects |
| Days 31–60 | Fill the key roles, choose shared tools, write the AI usage policy, run a trial review of 2–3 ongoing projects | Approved AI policy and project review procedure |
| Days 61–90 | Train the first group of departmental employees, review all new projects, report on the measures | First quarterly report to the committee and a plan for the next quarter |
The AI Act does not require you to set up a centre of excellence or keep a register of AI systems. It does, however, impose obligations that someone in the company has to keep track of, and the centre is the natural place for this.
The requirement to build employees’ knowledge of AI already applies, and the simplest way to meet it is through training and written rules. From 2 August 2026, a customer chatbot must tell people that they are talking to AI. If a company uses AI to assess candidates or employees, it will be covered by the obligations for high-risk systems from 2 December 2027.
The rules and risk person in the centre should know these deadlines and check every new project against them. A list of AI projects and tools is not mandatory, but without it, it is hard to judge which regulations the company must comply with.
The mistakes below recur in companies of all sizes. Each of them can be avoided by a decision taken in the first quarter.
If you recognise two or more of the symptoms listed below in your company, stop expanding the team and go back to the scope and the measures.
Salaries are the largest item, even if some people work in the centre only part-time. Departmental employees’ time also costs money, although it does not show up in the team’s budget.
On top of that come shared licences and tools, training and external support, especially in the first six months. When planning the budget, compare the cost of the centre with the total benefit of the projects it is meant to run. If that benefit is lower, the option with one responsible person is enough.
Related topics in the knowledge base
FAQ
Answers to the questions management boards ask when deciding how to organise AI.
About this page
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamIn a free consultation, we will assess which organisational option fits the number of projects you have, and help you prepare the scope and a plan for the first 90 days.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.