At RSPA RetailNOW 2026 in Las Vegas, Kathy Durfee, founder and CEO of the managed service provider TechHouse, took the stage to tackle a problem she said nearly every VAR and ISV in the room was already living with: AI adoption doesn’t feel like other technology rollouts. It feels chaotic.
In a session titled “Built to Bend,” Durfee laid out why that chaos is structural rather than a sign that anyone is doing it wrong, and she offered a maturity model her team uses to bring order to it, both internally and with customers.
Why This Rollout Is Different
Most enterprise technology arrives the way IT departments expect it to: leadership makes a decision, a rollout plan gets built, and adoption follows a timeline. AI didn’t wait for that process. Durfee pointed to the pace of adoption as the reason: the internet took 16 years to reach 100 million users, Facebook took four and a half years, and ChatGPT took three and a half months. Employees, she said, aren’t asking permission to use AI. It’s already inside the organization, whether or not there’s a plan for it.
That leaves VARs and ISVs in an unusual position: their customers are asking for advice on a technology that’s already been deployed by default, with no rollout plan to audit and no clear starting line.
A Chef, Not a Recipe
To explain what makes AI different from the software VARs and ISVs have supported for decades, Durfee used a simple analogy: traditional software is a recipe. You write the instructions, and the computer executes them exactly, so when something breaks, it’s because the code didn’t do what you expected. AI, by contrast, behaves like a chef. It looks at what’s available, recognizes patterns, and decides what to make. Sometimes that’s a good decision. Sometimes it isn’t. Either way, it’s judgment, not execution.
That reframing led her to push back gently on a familiar term. She said she’s not comfortable calling AI errors “hallucinations”; she prefers to think of AI as always giving its best guess based on incomplete information, much the way a person does when asked a question outside their expertise. The implication for organizations, she argued, is that AI is making judgment calls everywhere it touches the business, which means the business itself needs to be ready for that, not just technically equipped for it. She compared it to the early days of remote work: companies often had the tools, such as email and shared files, long before they had the actual processes to make remote collaboration work.
Rules, Tools, and You
Durfee offered a second framework for helping teams reason about what’s fixed versus what’s negotiable when it comes to AI decisions: rules, tools, and judgment.
Rules are fixed and non-negotiable, full stop: revenue minus expense equals income. Tools are the guidelines and best practices that help you operate within those rules, such as how to grow revenue or how to cut costs. And then there’s judgment: what you actually value, which determines which tools matter to you in the first place.
She illustrated the distinction with a personal story. About 20 years ago, she nearly sold her company to a well-funded serial acquirer rolling up IT providers. She drove out to sign the deal, but while touring their impressive new office, she noticed there wasn’t a single network jack anywhere in the building, a sign the buyer hadn’t done the planning she’d expect from a company about to be worth trusting with hers. She walked away without signing. Her takeaway: the “rule” isn’t sell whenever someone offers a lot of money. The rule is sell when you genuinely expect a good outcome. Everything else is just a guideline, and it’s easy to mistake one for the other.
She drew a similar line around automation itself, invoking Henry Ford: automation in the 1970s and ’80s eliminated jobs by removing variability from repeatable tasks. AI does the opposite: it introduces variability rather than removing it. Treating AI as simply “more automation,” she argued, misses what’s actually changing.
The Human Role Becomes the Reviewer
If AI’s output varies, someone has to catch the cases where it’s wrong, and Durfee argued that role increasingly falls to a reviewer who combines subject-matter expertise with a willingness to ask hard questions. Every organization has someone like this already, she said, even if they’re better known as “the company cynic.”
She traced the instinct back to an expensive mistake from 15 to 20 years ago, when an employee at her company built a solution to a customer’s stated symptom instead of digging into the actual root cause. The fallout led her to train her entire team in root-cause questioning, so that even on an off day, someone else on the call could catch what got missed. That same discipline, she said, is exactly what AI oversight requires now, since most people don’t have the subject-matter depth to know when an AI-generated answer is subtly wrong, in the same way most people can’t evaluate a medical answer they got online.
The Maturity Model
The core of the talk was a five-stage maturity model Durfee uses with customers, each stage grounded in a concrete example:
- Protection and governance. Most companies have mature email security, including anti-malware and data loss prevention, but haven’t extended equivalent controls to AI tools. TechHouse runs a tool inside customer environments that shows leadership what’s actually being sent through which AI models, and Durfee said there’s a consistent gap between the written AI-use policy and what employees are actually doing.
- Awareness. Protection without training isn’t enough; phishing-simulation exercises complement rather than replace security controls. People need to understand what a probability-based answer actually means and how to validate one.
- Informed use. Before layering on new tools, understand the AI already embedded in the ones you use, such as QuickBooks and Microsoft 365 Copilot. Durfee described a frustrating AI-driven customer service call with DoorDash as an example of a company that deployed AI without designing for its own limitations.
- Systematized judgment. This is where organizations build their first internal-facing agents, which carry lower risk since nothing leaves the company. Examples include a “steward” agent that holds system-of-record information for a team, or one that assembles a recurring strategic report.
- Agent-to-agent and scale. This is the highest-risk stage, and one that Durfee said people are already rushing toward casually. She described someone who had built a dozen agents just from watching online videos, often without the security or awareness groundwork from earlier stages in place.
She also shared a case study from TechHouse’s own experience: roughly two and a half years ago, the company built an external-facing pre-sales agent meant to answer prospect questions using customer data. It underperformed because it only had access to CRM records, and a CRM never captures the full context of a customer relationship, including what a team member chose not to log and why. The lesson, she said, is that data completeness is often the real bottleneck, not the model.
Test the Framework
To make the model concrete, Durfee walked the audience through a workshop exercise she runs with customers. Imagine an employee wants an AI agent to draft an email to a customer about a price increase, assuming full protection and awareness measures are already in place, and the agent has access to exactly the same data as the employee, no more and no less.
The pros are real: the agent can synthesize far more account history than a person could in the moment. But the cons matter just as much: it can’t replicate context that never made it into any system, and even well-written output can make commitments the business wouldn’t actually stand behind. And then comes the harder question: if that email causes a problem, whose fault is it? The AI’s? The employee’s? Or leadership’s, for setting productivity expectations that pushed the employee to trust the draft more than they should have?
Meet Customers Where They Are
Durfee also shared three signals she listens for when gauging where a customer, or an internal team, actually sits on the maturity curve: their boundaries of risk (which range from AI-avoidant to overconfident); how they think about tool selection (which she tries to steer away from “which tool” and toward “who’s accountable for its outcomes”); and how they’re approaching workflows and scale (where she advises starting small, confirming feedback loops and controls actually work, and only then moving to multi-agent systems).
She framed SMBs, the core customer base for many VARs and ISVs, as speedboats: able to turn quickly in ways large enterprises can’t, but navigating open water without a map.
She closed by pointing to If Anyone Builds It, Everyone Dies, the 2025 book by Eliezer Yudkowsky and Nate Soares of the Machine Intelligence Research Institute, as further reading for anyone interested in the broader stakes of the AI buildout, a reminder that the conversation she’d just walked through, about governance and judgment inside a single company, sits inside a much bigger one.
