The 2027 IT budget: how to discuss technology that delivers business results

An IT budget rarely loses the board's support because of the numbers alone. More often, the CIO talks about servers, licences and schedules while the CEO is listening for an answer to one question: what will the company gain?

Planning for 2027 is a chance to change that conversation. Cost pressure remains, and AI, cybersecurity and operational resilience connect IT directly to business strategy. A credible budget makes that connection visible, with outcomes the business owns and assumptions finance can examine.

Start with the outcome

The board decides where the company is going. Every major IT investment should therefore start with a sentence: “This will let the business achieve X, improve it by Y, by date Z.” Technology follows as the means to reach that result.

The examples below are illustrative targets, not measured results or promises. Replace them with your company's baseline and evidence.

Each initiative should answer three questions:

1. Which strategic objective does it support?
2. Which business measure will change, and by how much?
3. Who in the business owns that measure alongside IT?

The third question often decides the conversation. An initiative with no business owner for its outcome is difficult to defend when cuts begin. Agree the result with the person who will be responsible for achieving it.

Three budget categories, three decision rules

A single total invites the question “How much can we cut?” Separating the budget into categories reveals that the money serves different purposes.

This shows how much the company spends on continuity and how much on change. If running the estate consumes most of the budget, the CIO should explain why and offer options for changing the balance. There is no universal ideal allocation.

Confirmed savings can help fund new initiatives. Show where they come from: licence consolidation, retiring duplicate applications, cloud optimisation or contract renegotiation. Then show which improvements or experiments they will fund. Separate savings already achieved from savings still planned, allowing for migration, decommissioning and contract notice periods.

Finance terms that make investments comparable

Finance needs to compare an IT investment with other uses of capital. A business case becomes easier to assess when it uses measures the company already understands.

• Total cost of ownership (TCO). Include integration, training, data migration and operation over an agreed life, for example three to five years, rather than presenting the licence price alone.
• Return on investment (ROI) and payback. State when the outlay is recovered and which benefits have a defensible monetary value.
• Cost of delay. Estimate what another month costs in forgone contribution, manual work or parallel operation of old and new systems.
• Cost of doing nothing. Explain expiring support, rising incident exposure or a customer requirement the company cannot meet.

ROI = (financial benefits − all costs) / all costs × 100%

Use the same time horizon for both benefits and costs. Do not deduct costs twice from benefits already described as net. Convert extra revenue into contribution after the costs of generating it. For a multiyear investment, show cash flows and agree with finance whether discounting is needed.

Three practices improve the credibility of the case:

1. Separate monetary and non-monetary benefits. Include confirmed savings and additional contribution in ROI. Report satisfaction and faster decisions separately unless their financial effect can be substantiated.
2. Use ranges. Conservative, base and optimistic assumptions reveal uncertainty more honestly than a forecast precise to the last pound or złoty.
3. Ask finance to co-author the assumptions. Agreement on costs and benefits matters more than the appearance of the spreadsheet.

AI in the 2027 budget

Gartner's forecast dated 19 May 2026 already covers 2027: worldwide AI spending is projected to rise from about USD 2.60 trillion in 2026 to USD 3.49 trillion in 2027. This includes vendors and infrastructure; it is not a recommended AI share of a company's budget^[1].

Some AI costs arrive through platforms the company already buys. Review where expenditure is a deliberate investment and where a higher licence price introduces capabilities with no agreed use case. A global forecast does not settle that choice for an individual business.

1. Discuss use cases and measures. “Reduce complaint-handling time from twelve to six minutes” is an illustrative target to validate, not a vendor guarantee.
2. Show the full cost: data preparation, integration, risk oversight, changes to working practices and usage charges that grow with scale.
3. Fund stages with exit criteria. For example, use a 90-day pilot with a measured baseline, a threshold for scaling and a threshold for stopping. The duration should fit the decision, not become a ritual.

Without a baseline and a business owner, the result cannot be attributed or reviewed reliably. Define both before buying more capacity.

Security and compliance: make the obligation visible

Poland's amended national cybersecurity law, implementing NIS2, took effect on 3 April 2026^[2]. For organisations within its scope, planning must account for the relevant timetable:

• 3 October 2026: registration application deadline for entities meeting the criteria on commencement and not registered automatically. Check whether it applied and was met^[3].
• 3 April 2027: implementation deadline for entities meeting the criteria on commencement. Allocate the necessary work and resources^[2].
• 3 April 2028: first audit deadline for specified essential entities, subject to the exceptions described by the ministry^[2]. This is not an extra year to implement the requirements.

Scope depends on sector, size and status. Assess applicability with legal and compliance colleagues. These dates are described as of 6 October 2026; different deadlines may apply to entities meeting the criteria later.

Even identifying scope can be difficult. A release by the authors of “Cyberportret polskiego biznesu 2025” reported that 36% of surveyed cybersecurity specialists did not know whether their company was covered by NIS2^[4]. This is a 2025 survey finding, not a measure of current compliance.

Present four things to the board:

1. Scope: the processes and systems affected.
2. Gap: the current position against the requirements, supported by an independent review.
3. Cost: one-off and recurring expenditure needed to close the gap in 2027.
4. Residual risk: what remains after implementation and who in management accepts it.

Management should know the plan and its cost before an incident. Estimate the cost of inaction against your own processes and incident scenarios. A general claim that security always pays for itself is not an assessment. Mandatory work remains mandatory in every budget scenario.

Structure the board conversation

Start with the recommendation and put technical detail in the supporting material. The board needs a decision, reasons and consequences.

1. Summarise the company's 2027 goals in one sentence.
2. State the recommendation and amount: “We request X, with Y funded by confirmed operating savings.”
3. Show the three categories and how their allocation changes from 2026.
4. Present five to seven key initiatives, each with an outcome, business owner, payback where appropriate and milestones.
5. Explain risks and compliance work, including applicable NIS2 dates and the consequences of not acting.
6. Present conservative, base and expanded budget options, showing what the company gives up or gains in each.
7. State uncertainties: licence prices, exchange rates and hardware costs.
8. Specify the decisions requested and the review cadence, for example quarterly.

The scenarios matter because they turn a cut into a choice. If the budget falls by 10%, identify which initiative leaves, which measure changes and which risk rises. Avoid suggesting that every item can simply be reduced by the same percentage.

Include price pressures that may affect the year. Gartner's 27 July 2026 forecast highlights hardware and memory price pressure and supply constraints^[5]. Check supplier quotes, renewal dates and options for phasing replacement rather than applying a global market growth rate to every purchase.

Discuss assumptions with the CFO and business owners before the meeting. The boardroom should not be the first place they see numbers for which they will be accountable.

Common mistakes

• No account of last year's results. The CIO asks for trust for 2027 without showing what 2026 delivered. Start with what was promised, completed and achieved.
• One total. With no categories or initiatives, the board sees only an amount to reduce.
• No business co-owner. A result described only as an IT result is harder to defend.
• Inflated ROI. Unsupported monetary values for soft benefits weaken the whole case and damage other, well-prepared proposals.
• Fear as the main argument. Use a risk register and a reasoned estimate of the consequences of not acting.
• Too much technical detail. The board decides direction and funding; working sessions and appendices carry the implementation detail.

Before the board meeting

Start with the three largest items

A budget that delivers results begins with business goals. It separates spending with different decision rules, uses credible financial assumptions and makes the consequences of each option explicit.

For 2027, AI and applicable cybersecurity deadlines make that discipline particularly useful. A CIO who brings a clear recommendation, business co-owners and assumptions agreed with finance can help the board choose where the company should invest.

Take the three largest items in the IT budget. For each, write the business outcome and name its business co-owner. Any item you cannot explain this way needs a conversation before the board meeting.