What companies ask us about AI, sorted by role
Managing directors ask whether AI pays off, finance what it costs, IT where it runs and the works council what gets logged. We have sorted the questions we hear by role. Each has a short answer and a link to the page that goes into detail.
For managing directors and owners
Whether AI pays off, where to start and whom to build it with.
Is AI just hype, or do we fall behind without it?
AI is in everyday use: in Bitkom's 2026 survey, 57% of companies with 20 or more employees use it. Whether you fall behind matters less than whether it pays off in one of your processes, and you can measure that on your own cases before you commit to more.
What concrete value does AI bring to a company like ours?
Mostly fewer hours per case in routine work on documents, requests and orders, and faster answers to customers and staff. It can also take on work that stays undone today because you lack the people. Which of these applies depends on your processes, and the use case pages show what changes in each function.
Is AI worth it for a mid-sized company, and when does it pay off?
It pays off when a process runs often, costs measurable hours today and keeps its quality with AI. Work it out for one process: today's cost per case, the build, run and use costs, the review effort and the threshold the result must meet. If the numbers do not add up, stop before anything is built.
What holds companies back, and how do we check whether we are ready for AI?
In Bitkom's 2026 survey, companies using AI named data protection (66%), legal uncertainty (56%) and hard-to-estimate costs (54%) as their main barriers. To check your own readiness, take one real process and look at skills, data, systems, rules and people for that process, instead of filling in a general maturity score. Some chambers of commerce (IHK) offer free checks, and our 30-minute first call is free as well.
Where do we start with AI, and what is the right first step?
With one workflow that has a number attached, such as hours spent or cases handled, and a clear test of success. Rank the candidates by volume, by how quickly a person can check the result and by whether the data can be reached. Your strategy then grows out of the first two or three.
Do we need an AI strategy or a roadmap before we start?
A short one: which processes in which order, which data may go where, who owns each system and what each must deliver. It should lead to a system running on your data. Ask any partner whether you will get a PDF at the end or something that runs.
How do we introduce AI in the company step by step, and should we start with a proof of concept?
Choose one process, measure it today, build a pilot on your own cases with acceptance criteria, connect it to the real systems and go live with a named owner. A proof of concept on clean sample data proves little. A pilot on real cases, with the people who will later check the results, tells you whether to invest further.
Should we buy an AI product or build our own?
Buy when a product covers the workflow and your data rules. Build when the work runs through your own systems or no product meets your data requirements.
We have no AI specialists. Agency, consultancy or our own team?
You do not need a data scientist to start. You need someone who owns the process, someone who will run the system and engineers who have run AI in production. A partner who builds with your people and hands over code, tests and runbooks lets you move to your own team later.
How do we choose the right AI partner and spot a dubious one?
Ask for evidence: a system they run in production, how they measure quality on your cases, who owns the code afterwards and who else pays them, such as tool vendors. Be wary of anyone who promises results before seeing your data or cannot say how they would stop a failing project.
How long does it take to implement an AI project?
It depends less on the model than on access to data and systems, on how quickly approvals come and on how many systems the workflow touches. We agree the scope and a fixed price for each step in writing, so you decide after each step whether to continue.
Who is liable when the AI makes a mistake?
The company stays responsible for what it does with AI. How liability is split in a contract is a question for your lawyers, and this is not legal advice. What can be designed is control: the agent prepares, a person approves payments, postings and anything that reaches a customer, and every step is logged so a mistake can be traced and corrected.
Will AI replace jobs in our company?
Management decides that. AI takes over tasks, and you decide whether the freed hours absorb more volume, clear a backlog, go to other work or lead to fewer posts. Decide it before the rollout, tell the team and the works council early, and report results only at team level.
For finance and procurement
What AI costs and returns, where it helps in accounting and purchasing, and how to buy it without lock-in.
AI costs are rising and nobody can show the value. What do we do?
Measure cost per accepted result, not per token, and tie each tool and team to the work it does. Pause only the initiatives that have no baseline or no owner. Our free one-page usage review is a first step.
What can AI automate in accounting, and where is control needed?
The checking: matching invoice lines with orders and goods receipts, comparing prices with contracts, finding duplicates and suggesting the account assignment. Payment release, changed bank details, deviations above your tolerance and tax questions stay with a person. E-invoicing removes the reading step, but the checking stays.
How much does AI realistically save in purchasing?
There is no honest general figure, so measure yours. The saving is mostly buyer effort per offer and per order confirmation, plus deviations from orders that are no longer missed. Record both before and after on your own documents.
What costs come with AI, and what does it cost to get started?
Model fees are often the smaller part: in Bitkom's 2026 survey, companies named infrastructure (51%), data preparation (50%) and integration (41%) among their AI costs far more often than tokens (8%), and the people who review and correct the output come on top. Count all of it per accepted result. We give a fixed price for each step, agreed in writing after the first call.
How long until an AI project pays back, and how do we build the business case?
That follows from four values you measure: build cost, run cost, today's cost per case and the cost per case with AI, multiplied by your volume. A business case for AI also needs a quality threshold, the review effort and stop criteria, which general templates leave out.
How do we measure the ROI of AI when the value is diffuse, and which KPIs count?
Measure one process at a time: cost per handled case, hours per case, cases per person, error and correction rate, and the share of cases handled without rework, before and after on the same kind of cases. Licence counts and logins say little on their own.
Is AI consulting or an AI project subsidised?
Sometimes. Programmes change often, and some fund only consulting while others also fund the build. Your IHK can tell you which apply to your company today. Confirm the conditions before you plan around them.
Day rate or fixed price, and how do we compare offers for AI work?
We price project work as a fixed price for each step, agreed in writing after the first call. To compare offers, check that each one names the scope, the acceptance criteria, separate figures for build, operation and model usage, and who owns the code, tests and runbooks at the end.
How do we avoid lock-in, and can we switch provider later?
Keep the code, prompts, test sets and data in your own repositories, put a gateway between applications and models so the model can change, and write into the contract that your own team or another partner can take over. Plan the exit before you sign.
What should an AI pilot prove before we fund the next stage?
That the system meets agreed quality on real work, at a cost per accepted result you can live with, and that someone will own it after the pilot.
For business units, operations and digital leads
Which work AI takes on in your function and industry, and how a pilot becomes a system people use.
Which processes are suitable for automation with AI, and which come first?
Frequent work with a clear correct outcome that a person can check quickly: incoming invoices, order confirmations, customer emails, internal questions about policies or manuals. Rare cases, unclear outcomes and irreversible actions come later or stay with people.
What is the difference between a chatbot and an AI agent, and should we use agents yet?
A chatbot answers questions. An agent carries out steps in your systems, such as reading an order and preparing the booking, and presents the result for approval. In Bitkom's 2026 survey, 29% of companies plan to use agents and 31% are discussing it. Start where the steps are clear and a person approves before anything is booked or sent.
How do we get knowledge management working with AI, including what experienced colleagues know?
Start with the questions people ask every day, before anyone plans a new wiki. Connect the few sources that answer them, such as SharePoint, file shares and tickets, with their permissions, and show the source with every answer. The questions the assistant cannot answer become the interview list for your experts.
How do we automate incoming mail and documents with AI?
Sort, read, then check: the system classifies each document, extracts the fields that type needs, validates them against your master data and passes clean ones to SAP or your ERP. Uncertain ones go to a review queue. The same approach prepares contract reviews against your own playbook, with your lawyer deciding.
From what company size is AI in customer service worthwhile?
Volume and repetition matter more than size. It pays off when many requests repeat and documented knowledge answers them: the assistant drafts replies from approved sources, sorts tickets and hands over to a person where it matters. Check the numbers on a sample of your own tickets before you build.
How do we use AI in B2B sales?
Mostly to get quotes out faster and to enter emailed orders without retyping. The assistant drafts from ERP prices, product data and past quotes, every price comes straight from the ERP, and a person approves above the thresholds you set.
Is predictive maintenance possible on older machines?
That depends on the sensors and data the machines produce, and it is a specialist field we do not build. What we build is the knowledge side: technicians get answers from manuals, service reports and parts data with the source page, and the service report is drafted for them.
Which HR tasks can AI take over, and what are the risks?
Answering recurring questions from approved policies and works agreements, guiding new colleagues through onboarding and drafting standard documents for HR to check. The risks are discrimination, monitoring of staff and outdated answers, so decisions about people stay with people, and we do not build systems that screen, rank or score applicants or employees.
When is AI worthwhile for machine and plant builders?
When a process repeats often, depends on documents and expert knowledge and is checked by a person anyway: quotes, order entry, service questions and documentation. Pilots make it into everyday use when the assistant works inside the ERP process, has an owner and has a measured pass rate. Design and pricing data can stay on your own servers.
Which logistics processes can AI automate, and why do so many projects stall at the pilot?
Mostly those where text becomes a record: transport orders into the TMS, quote requests into offers, status questions into answers and carrier invoices into checked lines. Pilots stall when they run next to the TMS instead of inside the flow. Dispatchers trust suggestions they can trace to a source and overrule.
Is AI worthwhile for a small municipal utility?
Yes, if you start with one process that repeats often and is checked by a person anyway, such as the customer service inbox or meter-reading forms. Volume matters more than size. AI that works as a safety component in grid or plant control is high-risk under the AI Act. Assistants for customer service, billing documents and manuals do not fall under that provision.
How do insurers and banks use AI in claims and lending?
Mostly to prepare, not to decide: sorting incoming mail, extracting claim or application data, checking completeness and duplicates, and opening a pre-filled case. Credit scoring is a high-risk use under the AI Act, with duties for the deployer such as human oversight, so scoring, cover and credit decisions stay with your staff and your existing models.
Can law and tax firms use AI without putting professional secrecy at risk?
They can, if client data stays under the firm's control and the contract chain is right. The firm decides, advised by its own lawyers. Technically, the safest setup is your own servers, so no client data leaves the firm. Research, drafting and contract review then run on your own documents, and every citation is checked.
Is AI relevant for our industry at all?
In most industries the first gains come from the same kind of work: documents, customer requests, quotes and internal knowledge. Our industry pages cover manufacturing, energy and utilities, logistics, banks and insurers, and law, tax and audit firms. For other industries, start with the use case pages for your functions.
Our data is scattered and not always clean. Can we still start?
Yes. Connect the few sources the first use case needs, with their permissions, a named owner and working access. You do not need a data lake or a company-wide data project first. Check the sources of the first process on representative cases.
Who checks critical results, and should agents act on their own?
A person approves every action that changes data, spends money or reaches customers. Agents may read and prepare without approval. Loosen that per action only once tests and logged runs show the agent gets it right.
How do we know the AI system works before we accept it, and that its results are traceable?
Agree acceptance criteria in advance, test 100 to 200 cases from your own work, and accept the system on measured pass rates with a confidence interval. Traceability comes from the sources shown with each result and a log of every run.
Why do so many AI pilots never reach production?
Usually because nobody agreed what good enough means, who runs the system afterwards or how it connects to the systems where the work happens. Before go-live you need regression tests, versioning and rollback, monitoring, an owner and a handover, then a staged rollout.
Why do staff not use the AI tool we introduced, and how do we train them?
Usually because it does not fit their work, they fear for their jobs or their private tools are better. Involve the people who do the work from the start, say how freed hours will be used, and train on their own tasks with the tools they will use. Not everyone needs to become an AI expert. A few people need deeper knowledge to run the systems.
When do we stop an AI project rather than keep going?
Decide from measured quality and cost per case, against thresholds agreed at the start. If a project misses them, narrow the scope, switch to a simpler design or stop. Stopping on evidence is cheaper than a system nobody uses.
For IT leaders and IT security
Approved AI for staff, own servers or cloud, security and operation.
Staff use ChatGPT on their own. Ban it, or introduce AI officially?
Introduce an approved alternative, because a ban on its own moves use to private phones. According to IW Köln (2026), 29.1% of employees who use AI at work use tools their employer did not provide. An internal assistant with single sign-on, good models and company knowledge gives people a reason to switch, and the gateway shows usage by team, never by person.
Should our AI run on our own servers or in the cloud?
Own servers suit data that may not leave your network and high, steady usage. A cloud account you control suits a quick start and changing load. Many companies use both behind one gateway.
Is Microsoft 365 Copilot enough, or do we need our own AI assistant?
Copilot fits when the work and the data sit in Microsoft 365 and per-user licences pay off. Your own assistant fits when important data sits in SAP, a DMS or other systems, when it must run on your own servers, or when many occasional users make paying per use cheaper. In both cases, permissions come first.
What is an LLM gateway and do we need one?
A gateway gives every application one API in front of all models, with a key, budget and log per team. You need one as soon as several teams or tools use models.
Do we need an AI policy, and how do we make it stick?
Yes. It says which tools are approved, which data may go where, who approves new tools and how use is logged. A policy on paper relies on everyone remembering it, while rules the platform enforces, such as approved models, blocked data classes and team budgets, still hold when people forget.
Does our data stay in the EU with Azure OpenAI or Amazon Bedrock?
It depends on the deployment type: global deployments may process requests outside the EU, while EU data zone deployments and EU inference profiles keep processing in the EU.
How do we deploy an LLM on-premise so data never leaves the company?
Serve an open-weight model with an engine such as vLLM on your own GPU servers, put a gateway in front for keys and logs, connect your documents with their permissions, and test the answers before go-live.
How many GPUs do we need for our users?
It depends on concurrent requests, input and answer length, model size and the answer times you need. Measure on rented or existing GPUs with your own prompts before buying.
We are asked to switch on Microsoft 365 Copilot, but permissions are a mess. What comes first?
The permissions. An assistant shows people everything they can already open, so overshared sites and folders become visible in answers. Find and close the open shares on the sources it will read, then test with real accounts that restricted documents stay hidden.
How do we test and monitor an AI system's security before it goes live?
Treat it like any system with access to your data, plus one new risk: documents and emails the model reads can carry instructions, known as prompt injection. Give each agent the narrowest permissions, require approval for actions that change data, keep endpoints off public networks and log every call. Add an incident process for AI: in a 2026 study by BSI and TÜV-Verband, only 11% of companies using or planning AI had one.
MCP servers have appeared in our infrastructure. How do we secure them?
Treat each one as an API with access to your systems: an owner, an inventory, authentication tied to the user, the narrowest permissions per tool, logs, and approval before any tool that changes data. Remove the ones nobody owns.
Is LiteLLM safe to run after the 2026 incidents?
Yes, with care: pin and verify images by digest, upgrade in stages with tests, keep admin and MCP endpoints off public networks and keep provider keys where they can be rotated quickly. LiteLLM had three incidents in 2026, all fixed.
How do we scale AI from one use case to the whole company?
Build the second system on the parts of the first: one platform with a gateway, approved models, identity and permissions, shared logging and the same test process. Each new use case then adds its data and workflow instead of a new stack, and spend stays visible per team.
Who maintains the AI system once the project is over?
Decide that before you build. Someone has to own model and version updates, the tests that run before each change, monitoring, costs and user questions. That can be your team with runbooks and a handover, or us under a retainer.
For data protection officers and works councils
GDPR, data leaving the company, the AI Act and what the works council sees.
Can we use AI in line with the GDPR, and must our data go to the cloud?
Technically yes, and the data does not have to go to the cloud. Decide per data class which models may see which data: general text in an EU region of a cloud service, confidential data in your own cloud account or on your own servers. Your data protection officer gets the technical description a DPIA needs. The company decides together with them and its lawyers, and this is not legal advice.
Can staff use ChatGPT at work without data protection problems?
Not with private accounts, which give the company no processing agreement and no control. Business tiers, your own cloud account and your own servers each keep more in the company. For each, ask where data is processed, how long it is kept, who at the provider can see it and whether it is used for training.
How does the EU AI Act affect us, and who supervises it in Germany?
A company that uses AI is a deployer under the AI Act: it must take AI literacy measures for staff and give transparency notices, and for high-risk uses such as CV screening or credit scoring it has further duties, including human oversight and keeping logs. In Germany the Bundesnetzagentur supervises the AI Act and runs a service desk for questions on risk classes. For financial firms, BaFin remains responsible. The Digital Omnibus moved several dates. Our checklist has the current ones, and your lawyers confirm what applies to you.
Can we use AI without sending data to a US cloud?
Yes: run open-weight models on your own servers or with an EU provider. An EU region of a US provider decides where data is processed, not which law applies to the provider.
Where do the models run, and are our prompts used for training?
Wherever you choose: on your own servers nothing goes to a model provider, and in your own cloud account Microsoft and AWS state that prompts in Azure OpenAI and Amazon Bedrock are not used for training. Where a provider processes personal data for you, you need a processing agreement, and you should check each provider's current terms.
Does the works council have to agree to an AI system?
In Germany, often yes: co-determination applies when a system is objectively suitable for monitoring performance or behaviour, which logs usually make it. Agree on what is logged and who sees it, and report by team rather than by person. This is not legal advice.
What belongs in a works agreement on AI, and when must we involve the works council?
Early, while you are still planning, because information shortly before the rollout usually comes too late. A works agreement describes the purpose, the logged fields, identification, access roles, aggregation level, retention, approval points and how changes are handled. When a project has stalled, it helps to show the works council the configuration itself.
Is AI in recruiting allowed, and how far may HR decisions be automated?
It is allowed, but regulated: systems that filter applications or evaluate candidates are high-risk under the AI Act, with deployer duties such as human oversight. Under Article 22 GDPR, rejections may not be fully automated, and the works council has co-determination rights. We do not build such systems: a person decides, and your lawyers advise on any product you consider.
Is an AI officer required by law, and who is responsible for AI internally?
The AI Act names no mandatory AI officer comparable to the data protection officer. Its Article 4 asks for measures that build AI literacy. Many companies name one anyway, sometimes the data protection officer, to keep the inventory, the approved tools and the training plan, and each AI system also needs its own owner. Your company decides, advised by its lawyers.
Do we need an AI inventory, and how do we find the AI already in use?
In practice yes, because AI literacy measures and notices have to cover the AI used in your business, approved or not. Licences and API accounts show up in billing and usage exports, which our free usage review reads, aggregated by team. Private tools on private devices do not, so ask the teams and offer an approved alternative.
Must we disclose that our chatbot is an AI?
For a chatbot that talks to customers directly, in most cases yes: Article 50 of the AI Act requires that people are told they are interacting with an AI system unless that is obvious. Build the notice into every channel where the assistant answers on its own. Whether drafts that a colleague checks and sends need one is a question for your lawyers.
Does the AI literacy duty apply to small firms, and do staff need a certificate?
The AI Act attaches duties to roles and uses, not to company size: Article 4 asks every deployer to take measures so that staff have sufficient AI literacy. It names no certificate, course or number of hours. What you can show is a record of who learned what about which tool, tied to their role and updated when the tools change.
Can the assistant show employees documents they are not allowed to see?
Not if permissions from the source systems are stored with each document and applied to every search, and that is tested before go-live.
For CTOs and engineering leads
AI in your products, coding agents, their cost and the quality of what they produce.
How do we build AI into our own products and services?
Treat it as product engineering: define the task and the pass criteria, build evals (repeatable tests on fixed cases) from real user cases, choose the model per task behind a gateway, and plan latency, cost per request and monitoring before launch. The feature then ships and changes like the rest of your code, with tests on every change.
How much faster are developers with AI, and how do we prove it?
Measure outcomes on comparable work rather than acceptance rates or self-reports: lead time, review effort, rework and defects for changes made with and without the tool, plus cost per merged change. Agree the metrics before the pilot, so the result can decide the rollout.
How do we roll out coding agents beyond a few enthusiasts?
With one shared setup, instructions and checks per repository, training on real tickets, and measurements of review effort and rework before and after.
Can we route Claude Code and other coding agents through our own gateway, with limits per team?
Claude Code and tools that accept your own endpoint can. Tools that route through their vendor's servers cannot reach an internal gateway, so check each tool. Behind the gateway you decide which models each team may use and set a budget per team.
Where does our source code go when a coding agent sends it to a model?
To whichever endpoint the tool is configured for, and some tools first pass through their vendor's servers. Check each tool's data and retention terms, and where the tool allows it, route it through your own gateway to a model in your cloud account.
Our coding agent bill keeps rising. Where does it go?
Break the spend down by team, tool, model and task, then by merged change. The usual drivers are expensive models on simple tasks, large contexts and retries.
How do we know whether a new coding agent setup is better than the old one?
Replay changes your team has already merged with the old and the new setup, and compare cost, review effort and rework on the same work.
How do we validate a model or prompt change before deploying it?
Keep a fixed set of real cases with agreed pass criteria, run it against the current and the new version, and only switch when the new one is not worse on the cases that matter. Run the same set on every change, like regression tests.
How do we measure whether our RAG assistant gives good answers?
Score retrieval and answers separately on real questions from your users: did search find the right passage, does the answer stay with that source and cite it, and did it hold back what the person may not see.
Talk to an engineer
Bring one piece of work you would like to improve. The call takes 30 minutes and needs no access to your systems or your data.
Booking runs on Google Calendar.
Prefer to write first? Leave your email and a few lines, and we reply with times.
Look for the draft in your email program
Send it from there, and an engineer replies in person with times for a 30-minute call. If no draft has opened, write to us at miki@cloudsail.com.