AI for IT leaders: approved AI your own team can run

IT is asked for an approved way to use AI on company data that is secure, affordable and something the team can run. In Flexera's 2025 survey, 95% of German IT decision-makers say they must deliver innovation faster while proving ROI, and 94% are integrating AI into existing systems.

Meanwhile staff do not wait. In the IW Köln study of 2026, 29.1% of employees who use AI at work use tools their employer did not provide. The authors' conclusion: “Wer fördert, ohne bereitzustellen, macht die Nutzung unkontrollierbar”, whoever encourages AI without providing it makes its use uncontrollable. In Bitkom's 2025 survey only 26% of companies gave staff access to generative AI. An admin summed up the result in a 2026 forum thread: “Ob der MA da Kundendaten reinschüttet, weiß natürlich niemand”, nobody knows whether the employee pours customer data into it.

• An approved assistant for all staff, on models you control, so private tools are no longer needed.
• Answers from company knowledge in SharePoint, file shares, wikis and tickets, with each user's permissions applied.
• Agents connected to ERP, CRM and ticket systems with narrow rights and approvals.
• One point of control for access, cost and logs across all models and teams.
• Operation that works without heroics: monitoring, updates, model changes and runbooks.

These come from management, the data protection officer, staff and IT peers in forums. Most of them are answered by the architecture, so settle the architecture first.

• From management: “What are we doing with AI?” and “What is already in production, and what is still a pilot or a playground?”
• From IT peers: “Have you officially introduced it, or is it a no-go because of data protection and compliance?”
• From the data protection officer: “Where is our data processed?”
• From staff: “Why may I not use ChatGPT for this?”
• From yourself: “What happens when a model gets more expensive, slower or worse?” and “Who maintains this once the project team is gone?”

Hosting comes before tools, and permissions come before agents. Each decision below narrows the next one.

• First, an inventory: which AI tools are in use, by whom and with which data. Licence lists, proxy logs and expense reports are usually enough.
• Second, where models run. Your own cloud account, with Azure OpenAI or Amazon Bedrock in an EU region, fits when you already run there and want to scale quickly. Your own servers with open-weight models, whose weights you run yourself, fit when data may not leave the building at all. Many companies mix both by data class.
• Third, one gateway: a single controlled access point to all models, with keys, budgets and logs, connected to your identity provider for single sign-on and group-based access.
• Fourth, data and permissions: which sources come first, such as SharePoint, file shares, the ERP or the ticket system, and how their permissions are applied at search time so nobody sees an answer from a document they cannot open.
• Fifth, agent rights: read first, write only through narrow tools that each do one business action, under service accounts with least privilege and with approvals where it matters. MCP, a standard way to give an agent access to a system with its own permissions, is one way to build those tools.
• Sixth, who operates it: your team, Cloudsail, or shared, with monitoring, an update and model change process, and runbooks.
• Seventh, build or buy for each use. Microsoft 365 Copilot covers work inside Microsoft 365 for licensed users. An own assistant fits when the data lives outside Microsoft 365, when data residency or permissions rule out the SaaS route, or when per-seat licences for all staff do not pay. An admin noted in 2026 that a self-hosted front end on pay-per-use models was “deutlich günstiger als personalisierte Zugänge”, clearly cheaper than personal licences.

One of them is dependence. According to the DIHK digitalisation survey 2026, companies see themselves as largely or fully dependent on non-EU providers for AI (66%). For each risk below there is a technical control.

• Data leaving the company. Models in your own cloud account in an EU region or on your own servers, routing rules in the gateway by data class, and logs in your own storage.
• Shadow AI. An approved tool that is good enough to use, reached through single sign-on, while outside AI services stay blocked by policy as before.
• Agents with too many rights. As an admin put it in 2026, access rights should apply to an agent too. Service accounts with least privilege, one business action per tool, approvals for changes and a log of every call.
• Models changing under you. Model versions are pinned, the tests run again before any switch, and the gateway can fall back to another model.
• No capacity to run it. Bitkom reported in 2026 that 79000 IT specialists are missing and 97% of companies have trouble filling IT posts. So the setup stays small, is documented in runbooks, and can be operated by Cloudsail until your team takes it over.
• Legacy systems. Lünendonk's 2026 study names legacy IT without integration layers and poor data connectivity as the main barriers to scaling agents. We start with the interfaces your systems already have, and read before we write.
• Tools built by people outside IT. Give teams a light, approved path through the gateway, so their experiments do not turn into unofficial production systems.

Security teams see AI from two sides. In the BSI and TÜV-Verband AI security study of 2026, reported by ZfK, 17% of companies report confirmed or suspected AI-assisted attacks or fraud. On the inside, only 11% of AI-using or planning companies have processes for AI-specific security incidents, 25% have no rules, 52% test AI applications for security risks before use, 40% log or monitor AI use and 64% restrict access rights.

• Attack surface. Prompt injection, meaning instructions hidden in documents, e-mails or web pages that try to make an agent act, is tested before go-live, alongside tool permissions, secrets handling and what an output can leak.
• Incident process. A written definition of what counts as an AI incident, a switch to turn off each agent or tool, keys that can be revoked in the gateway, and logs forwarded to your existing monitoring.
• NIS2 and audits. Where NIS2 or an audit applies to your company, the architecture, access rules, test reports and logs are the documents the assessment works with. Whether and how NIS2 applies is for your security and legal people to decide.
• Certification. 51% of AI-using or planning companies see certification by independent bodies as an important selection criterion (BSI and TÜV, 2026). Ask every provider which certifications it holds and for which scope, and ask for the architecture and test reports as well.

In the Akima study reported by Computerwoche in 2026, German IT decision-makers name visible in-house experts, verifiable references and certifications among the signals that make them trust a vendor. Beyond that, ask for the following.

• A data-flow diagram: where prompts, documents, outputs and logs are processed and stored, for how long, and who can access them.
• The access model, including the service accounts agents use and what each may read and write.
• Permission tests: proof that a user cannot get an answer from a document they may not open.
• An acceptance test report on your own cases, and the same tests re-run after every model or configuration change.
• Runbooks, monitoring and a handover your team has walked through, not only read.
• Engineers you can talk to, who build the system themselves.

Start with a free 30-minute call with one of our engineers. It needs no access to your systems or data. Bring your current setup, such as Microsoft 365, the cloud you use, the main systems and what is blocked today, and leave with an outline of hosting, gateway and permissions.

If licence or usage exports exist, the free AI usage review turns them into one page on what is used, by whom and at what cost. It doubles as the start of your AI inventory.