How Mastercard encouraged AI adoption with training and data

Some companies that believe generative AI applications will unlock a productivity surge have tried to mandate their use, with mixed results. Mastercard's George Maddaloni, however, doesn't think it makes sense to enforce a one-size-fits-all strategy across wildly different job functions without a little help.

"I think [generative AI app adoption] is largely about change management and adoption." Maddaloni said in a recent interview with Runtime. "I think if you just throw it out there and expect people are going to be really using it effectively and being productive with it right away, you might not get the juice out of the squeeze."

"Change management" as defined here starts with mandatory training on the company's data policies, but around the end of last year Mastercard also conducted a review of the different workflows used by categories of employees across the 35,000-person payments giant. In some cases generative AI tools didn't really move the needle, but the company found that by helping other employees understand how to use the tools effectively as well as making sure those tools could access the data sources they needed, adoption grew.

"I think the thing that really drove adoption was helping people in the flow of work understand what some examples were of how people asked prompts correctly. It's a little bit of a different language and [there is] a learning curve."

"People needed to have a base level of [data] knowledge before they were granted access to the tool, but I think the thing that really drove adoption was helping people in the flow of work understand what some examples were of how people asked prompts correctly," Maddaloni said. "It's a little bit of a different language and [there is] a learning curve."

Like a lot of financial companies, Mastercard was no stranger to using AI both internally and externally for critical applications such as its fraud-detection system and other safety tools over the years. Last year the company released a product for banks called Decision Intelligence Pro that was built around a large-language model trained in-house that Maddaloni said was 20% better at detecting fraud with an 80% lower false-positive rate than the previous generation of the tool.

Internally, it has rolled out Microsoft's Office 365 Copilot technology to 16,000 employees, and Mastercard developers are also using AI coding tools such as GitHub Copilot to build software. Companies in regulated industries such as financial services and payments, however, can't just "vibe code" their way to the next version of their apps.

Before rolling out access to several coding assistants, including GitHub Copilot, last year Maddaloni led a pilot project with two small groups of developers to gather anecdotal information about what they liked and didn't like in a coding assistant. Mastercard developers are currently using AI assistants for coding and writing tests, but the company has yet to embrace the full agentic coding trend along with early adopters like Steve Yegge over concerns about security and stability.

Inside other parts of Mastercard, however, the company has rolled out agents to help consulting teams quickly find information about various parts of the company and to help train the next generation of management leaders, Maddaloni said. And at a time when every enterprise software company is desperately trying to establish themselves as the control platform for their customers' AI agents, he said Mastercard has found a lot of success building internally used AI agents on its own.

"I think MCP was a big unlock, opening up the door for us to have multiple capabilities that our teams could employ," Maddaloni said. Anthropic's MCP standard has been quickly embraced by AI developers who value its ability to quickly and easily link multiple data sources together to serve AI prompts, but well-founded concerns about security mean Mastercard is unlikely to use MCP for external, customer-facing agents any time soon.

After all, Mastercard maintains some of the most sensitive personal and corporate data about its customers of any company on the planet, and it must comply with a huge variety of rules around the world governing access to that data. The company built a large hybrid-cloud infrastructure network around the world to serve those customers in their local markets, and has continued to invest in that network to take out as much latency as possible to keep money moving.

"Making the network work and planting the network in key transit zones around the world was foundational for us," Maddaloni said. "And then setting up those hybrid cloud capabilities in a regulatory geography or landscape where we could operate either public cloud or private cloud as needed, or both as needed, was the journey we went on."