Create an AWS organization with a production account with running workloads

The AWS Organization management/payer account should not have any workloads on it. These should be separated into member accounts and OUs. With that being said the recommendation would be for you to create a new AWS Account and use that account as the management account for your AWS Organization. On the management account you can define your OU structure and them invite the existing accounts to join your organization. You can see additional information on how to do that here.

Also important to point out that when you invite accounts to join your organization, you do not automatically have full administrator control over the account, unlike accounts created directly in AWS Organizations. If you want the management account to have full administrative control over an invited member account, you must create the OrganizationAccountAccessRole IAM role in the member account and grant permission to the management account to assume the role.

Inviting accounts or removing them from your organization should not have any impact on workloads except if you have any SCPs enabled. If you are using SCPs these policies can block accounts from calling AWS APIs thus bringing down workloads running on the accounts. I would suggest you only leave the 'FullAWSAccess' policy attached to root. You can then create OUs with the SCPs attached that you think you will need. You can then move test accounts into these OUs to make sure you get the effect that you want. After that you can move production accounts into these OUs and change out the SCPs on root if you want. You can also use IAM policy simulator to view the effects of SCPs.