From AI pilots to systems in daily use: a guide for Heads of Digital and AI officers

Operational results from an AI strategy that already exists. In KPMG's 2026 survey of 480 decision-makers in German companies, 98% have an initial AI strategy, yet only 39% say top management actively steers it and 37% have clearly defined responsibilities and governance. The mandate has moved from writing the strategy to showing systems that people use every day.

The gap is the step from pilot to operation. In Lünendonk's 2026 study of 180 CIOs, IT heads and business unit managers in the DACH region, reported by CIO.de, 58% of companies are piloting AI agents, 19% use them productively in individual areas and 1% end to end, and 66% say fewer than a quarter of their piloted agents leave the test lab. The study's author summed it up as "Was fehlt, ist die operative Konsequenz": what is missing is operational follow-through.

• A short list of use cases, each with a business owner, a measured baseline and an expected effect, instead of a long list of ideas.
• Pilots that either go into production or stop on a criterion agreed at the start.
• Foundations the next use case can reuse: data access with permissions, one gateway in front of all models, tests and monitoring.
• Rules people follow because an approved tool makes it easy.
• A view management can read: what runs, what it costs per case and how often it is right.

The AI officer's work starts with knowing which AI is in use. The AI Act names no mandatory AI officer comparable to the data protection officer, as the training provider skill-sprinters pointed out in 2026. Its Article 4 asks companies to take measures for adequate AI literacy among the people who work with AI, and after the Digital Omnibus it remains a duty to take such measures, as the law firm Lewis Silkin summarised in July 2026. Many companies name someone anyway: in the BSI and TÜV-Verband AI security study of 2026, 63% of AI-using companies have a designated AI responsibility and 59% have binding internal policies, while 71% feel poorly informed about the AI Act's requirements. How your company meets these duties is for your company to decide, advised by its lawyers. We cover the technical side.

Shadow AI is where the inventory usually begins. In IW Köln's 2026 survey, 29.1% of employees who use AI at work use tools their employer did not provide, rising to 44.5% among staff whose employer strongly promotes AI skills. The institute's conclusion: "Wer fördert, ohne bereitzustellen, macht die Nutzung unkontrollierbar", encourage without providing and use becomes uncontrollable. In Bitkom's 2025 survey, 23% of companies had rules for AI use, up from 15%, and 31% were planning them.

• Inventory: which tools, models and agents are in use, in which teams, with which data, and at what cost. Our free AI usage review starts it from your billing and usage exports, aggregated by team.
• Classification: which uses could fall under the AI Act's high-risk list, such as CV screening and ranking of applicants or credit scoring. These are high-risk uses under Annex III, with extra duties for the deployer from 2 December 2027. People make those decisions, and we do not automate them.
• Literacy measures: a short, documented introduction per team to the tools that team uses, covering what each tool does, where it fails and when to check. For every system we build, we write that description with you.
• Rules the platform enforces: approved models behind one gateway, data classes that may not go to external models, and logging agreed with the works council, so the policy is more than a document.
• Transparency: where an assistant talks to customers, a notice that they are dealing with AI. According to Lewis Silkin's 2026 summary, the AI Act's Article 50 duties have applied since 2 August 2026.

They come from management, the CFO, IT and the business units, and they turn up in this wording in trade press, surveys and practitioner forums:

• "What is already in production, and what is still pilot or playground?"
• "What goal did you start with, and what actually came of it?"
• "Why do AI projects fail despite good tools?"
• "By which criteria do you prioritise?" when the list of AI ideas is longer than the budget
• "Is management on board, or are you fighting alone?"
• "Which AI tools are already in use here, including privately by staff?", the AI officer's first question

Each of those questions needs an answer you can measure, so the order starts with the process and its baseline. The tool comes later.

• Which process first. Choose by volume, today's cost per case and how often the work repeats, and check whether it needs AI at all or whether rules, a process change or better data would do. Our guide to choosing a first workflow has a scoring method.
• Buy, build or both. Where a standard product already covers the step, such as the assistant in Microsoft 365 or the AI features of the ticket, CRM or document system you already run, use it. Build where the work crosses systems such as SAP, SharePoint and ServiceNow, where data must stay on your own servers, or where no product fits the process.
• Where it runs. A SaaS tool, your own cloud account or your own servers, decided per data class together with the data protection officer.
• How quality is judged. Acceptance criteria and test cases from your own work, agreed with the business owner before anything is built, so a measurement decides the go-live.
• Who owns it after go-live. A named owner in the business, an operator in IT or at Cloudsail, a budget for running costs and the stop criteria.
• What the second use case reuses. Gateway, connectors, permissions and the test setup stay, so the next system does not start from zero.

Most companies lack exactly these foundations. In ServiceNow's Enterprise AI Maturity Index 2026, only 16% of German companies have established test, audit and risk processes for AI, and 72% name data accuracy, data access and data management as their biggest hurdles. In the Lünendonk study of 2026, companies put data quality and integration (98%), orchestration platforms and infrastructure (94%), training and change (87%) and AI compliance (87%) at the top of their investment plans for the next two years.

We build those foundations while delivering the first use case: connectors that carry permissions from SharePoint, file shares and your ERP, one gateway with keys, budgets and logs per team, and a test suite from your own cases that runs again after every change to models, prompts or data. In your own cloud account or on your own servers, depending on the data.

• A demo that works and never goes further. Acceptance criteria, a business owner and a go or stop rule are agreed before the pilot starts.
• Too many parallel initiatives without a business case. Keep one portfolio in which every use case has a baseline, an expected effect and a stop criterion, and review it with management.
• Data that is not ready. Take stock of the sources for the one use case at hand instead of starting a company-wide data project.
• Staff do not use the tool. We build it into the work people already do, the team writes test cases with us, and use is measured per team, never per person.
• Shadow AI and spend nobody owns. An approved platform behind one gateway, budgets per team and the usage review bring both under control.
• Providers changing or retiring models. Regression tests from your own cases run before every model version change, and the gateway lets you switch models without rewriting applications.
• Surprises from the AI Act or the works council. Name high-risk uses early, involve the works council before a pilot with real employees, and design logging so a works agreement can be kept.

Ask for evidence that holds up in a management review, from us or from anyone else:

• A measured baseline of the process before the project, and the same measure after it.
• Acceptance criteria and a pass rate on your own cases, with the test set handed over to you.
• An architecture that shows where data flows and is stored, and how permissions are enforced for assistants and agents.
• A cost per handled case, split into build, operation and model consumption.
• Who runs it after go-live, with runbooks your team can follow without the provider.
• An exit path: code, configuration and tests in your repositories, and models you can switch behind one gateway.
• If a provider has no reference for your situation, a small test on your own data and the method behind it, instead of a slide.

Start with what already exists. If staff use ChatGPT, Copilot or other paid AI tools, the free AI usage review turns your usage and billing exports into one page: where the spend goes, the three changes we would make first and what to measure next. For the AI officer, it is the first version of the inventory.

If a pilot is stuck, bring it to a free 30-minute call with an engineer. We look at what it would need to pass an acceptance test and run in production. Neither the call nor the review needs access to your systems or data. If you go ahead, each step gets a fixed price, agreed in writing after the first call.