Most AI projects in small and mid-sized companies do not fail on the model but on a simpler question: how do we get the data out of the ERP, the accounting package or the industry software? This use case is the unglamorous first step. Clarify what each vendor system allows (export, API, database read access), set up secure scheduled extractions with tools the company already has or can self-host (Excel/Power Query, Power Automate, n8n), and document owners and refresh rates. Typical benefit: AI pilots start with real, current data instead of stale manual copies.
Problem & value
- Today: data sits in ERP, DATEV, CRM, ticketing, e-commerce and a 15-year-old industry application. Access is "ask the vendor", a monthly CSV someone exports by hand, or a screenshot. Nobody knows which fields can be extracted, whether the licence allows API use, or what the vendor charges for it.
- Why it matters for AI: assistants, RAG and forecasts are only as good as the data feed. Manual exports go stale, lose their definitions and create shadow copies on personal drives (see PREP-003).
- Where AI helps (a little): small LLMs can draft field mappings, explain cryptic column names, and write transformation snippets; the main value is organisational and technical groundwork, not the model. No reliable cross-company savings figure exists; measure your own manual-export hours as baseline.
Variants
- SaaS-heavy SMB (M365, HubSpot, Shopify): documented REST APIs. Legacy/industry software: read-only ODBC replica or scheduled file drops. Public sector: specialist procedures with restrictive vendor contracts.
How it works
- system inventory
- interface check per system
- access & contract clearance
- scheduled extraction (export / API / ODBC)
- staging area
- quality check
- hand-over to the AI use case
- Inventory the systems and name a data owner per system (PREP-001, PREP-004).
- Interface check: what does the vendor offer, in which edition, at what price? Rate: manual export, scheduled export, REST API, direct read-only database access.
- Clearance: vendor permission, licence terms, service account with minimal rights, AVV where personal data is moved.
- Extraction: a workflow tool calls the API or picks up the export on a schedule and writes to a staging area (file share, Nextcloud, small PostgreSQL).
- Check and document: row counts, date ranges, field dictionary, refresh schedule.
- Human in the loop: data owners approve the field scope; IT reviews credentials and failures; a person decides whether personal data may leave the source system (PREP-025).
AI components are optional and small: an LLM drafts field dictionaries or mapping tables; humans verify them.
Data preparation
- Where the data lives: ERP/merchandise system, DATEV, CRM, e-commerce, HR system, machine/MES data, Excel sheets, mailboxes.
- Typical gaps: exports without headers or in odd encodings; German decimal commas and date formats; vendor "reports" that are PDFs; API access only in higher editions; no read access to the database for contractual reasons; personal credentials used for automations.
- Steps: (1) access matrix in a spreadsheet; (2) test export with 100 real records per system; (3) compare against the source screen; (4) schedule; (5) monitor.
- Related: PREP-001 inventory, PREP-002 data mapping, PREP-009 file-share structure, PREP-011 tidy tables, PREP-022 pseudonymisation. See GUIDE-003 for the data readiness check.
Implementation paths
Which path for whom
- SMB: C — a self-hosted n8n instance (runs on a small VM or mini-PC, HW1) keeps customer and finance data in your own environment and the same instance later serves many other automation use cases (Baukasten effect). Buying a managed connector product (A) is fine when the data is not sensitive and only one cloud-to-cloud sync is needed.
- Enterprise: B — a managed integration platform or data-ingestion service with enterprise connectors is cheaper than custom operations.
- Developer: C — open-source ingestion tools and plain scripts under your control.
- Public: C — self-hosted or sovereign-cloud tools, because specialist-procedure data is sensitive and procurement rules favour sovereignty.
Path A — Buy (off-the-shelf)
- Built into the vendor product: DATEV offers vendor-supported data services and interfaces (DATEV Datenservice / DATEVconnect); most ERP vendors provide export modules, often at extra cost.
- Microsoft 365: Power Query in Excel and Power Automate connectors for SharePoint, Dataverse, SQL Server; Gateway for on-premises data. Check tenant data location (EU Data Boundary).
- Google Workspace: Apps Script, Sheets connectors, BigQuery.
- iPaaS: Make (EU data centres available), Zapier, Workato (enterprise). Check AVV and region; per-operation pricing grows fast.
- EU-hosted option: n8n Cloud (EU region) or a German hosting partner; Airbyte Cloud region options.
Path B — Build on cloud APIs
Write extraction jobs against vendor REST APIs and ingest into a cloud database in an EU region; use an EU-region LLM endpoint (for example Mistral La Plateforme, or hyperscaler EU regions) only to draft mappings from field metadata, never to send raw customer records unless the AVV allows it. Needs a developer or a service partner.
Path C — Self-host (open source)
- n8n (self-hosted community edition under its fair-code licence; check the licence for commercial use) for scheduled API pulls, file pickups and notifications.
- Airbyte (open-source) or Meltano/dlt for many-source ingestion; PostgreSQL as staging; Nextcloud or a file share as drop folder; Paperless-ngx where the "export" is a PDF.
- Optional AI: Ollama with a small model (7-8B) on a CPU or modest GPU to explain columns and propose mappings (HW1 is enough for this, HW2 for faster drafting).
- Ops effort: one IT person, a few hours a month for updates, credential rotation, and monitoring.
Path D — Custom training
Not relevant; fine-tuning does not help with data access.
State of the art (2026)
- MCP (Model Context Protocol) servers and vendor-provided AI connectors increasingly expose business systems to assistants; useful, but they inherit the vendor's permission model and need review for prompt-injection and over-broad access (GUIDE-013).
- EU Data Act (Regulation (EU) 2023/2854, applicable since 12 September 2025) strengthens users' rights to data from connected products and contains rules for switching between cloud and SaaS data-processing services; it gives you a negotiating basis with vendors but does not replace a clean contract [3].
- Limits: AI-drafted mappings can be plausible but wrong; APIs change; rate limits and pagination cause silent partial exports. Always reconcile row counts and sums with the source.
Shared resources & combinations
- The same n8n + PostgreSQL + Nextcloud stack serves AUTO-001, PREP-011 and RAG ingestion. Downstream: PREP-002, PREP-022, PREP-025. Boundary: custom integrations are CODE-012; EDI mapping is DATA-022.
Effort, cost & KPIs
- Path A: hours to days per system for exports and standard connectors; costs are licence add-ons and per-operation fees; ask the vendor for a written price list for API/export access.
- Path B: one to three weeks of developer time per system.
- Path C: one to two days to set up n8n and staging; one to three days per system including testing and documentation; then monitoring. Hardware: a small VM, no GPU needed.
- KPIs: share of priority systems with documented access; share of feeds that are scheduled rather than manual; data freshness (age of last successful load); failed-run rate; hours of manual export saved (own baseline).
People & change
Involve early: IT (interfaces, accounts) and the data owner of each system (department lead). Management decides on vendor negotiation and budget. IT security reviews credentials and network paths; the DPO is involved whenever personal data (employees, customers) is extracted (GUIDE-005). Suppliers/vendors are stakeholders: contact them early, since licence and fee questions take longest.
Works council: depends. A pure technical extraction is usually not monitoring, but exports of HR, time-recording or user-activity data are objectively suited to monitor employees, which triggers §87(1) no. 6 BetrVG. §90(1) no. 3 requires timely information when work processes are planned with AI. Public bodies involve the Personalrat (GUIDE-004).
AI literacy: Art. 4 AI Act, as amended by Regulation (EU) 2026/1744, requires measures that support staff's AI literacy; a short briefing for data owners on what leaves their system and why is enough here (GUIDE-006).
Communication and pilot: pick one system with a motivated owner, show a working scheduled feed within two weeks, and name a champion (GUIDE-008, GUIDE-009). Typical concerns: "will our data go to an AI vendor?" (answer: staging stays in your environment), "who is responsible for the feed?" (named owner), "will the vendor cancel support?" (clarify in advance).
Humans in control: access scope is approved by the data owner; service accounts are read-only; no write-back by automations without explicit sign-off.
Risks, regulation & compliance
- EU AI Act: minimal risk; the data extraction itself is not an AI system. Downstream use cases may be higher-risk (Annex III duties apply from 2 December 2027); keep records of data origin to support that later (GUIDE-014).
- GDPR: moving personal data to a staging area is processing; check purpose and legal basis (PREP-025), minimise fields, pseudonymise where possible (PREP-022), conclude an AVV (Art. 28) with every processor, and assess a DPIA where profiling or special categories are involved.
- Contract and licence: reverse engineering or direct database access can breach vendor terms and void support; get permission in writing.
- Security: API tokens in workflows are crown jewels: store in a secret manager, rotate, use least privilege (GUIDE-013).
- Mitigations: access matrix, read-only service accounts, logging of runs, reconciliation checks.
Getting started
- Build the access matrix for your five most important systems: vendor, edition, export options, API yes/no, owner, personal data yes/no.
- Ask each vendor in writing: which interface, which edition, which cost, which limits.
- Run one test extraction (100 records) and reconcile it with the source system.
- Set up the staging area and one scheduled feed in n8n or Power Automate; document the refresh schedule.
- Hand the feed to the first AI use case via GUIDE-009 pilot planning; see GUIDE-002 for choosing your implementation path.
Sources
- Regulation (EU) 2023/2854 (Data Act) — https://eur-lex.europa.eu/eli/reg/2023/2854/oj
- Regulation (EU) 2016/679 (GDPR), Art. 20, 28, 35 — https://eur-lex.europa.eu/eli/reg/2016/679/oj
- European Commission — Data Act explained — https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained
- n8n documentation — hosting and credentials — https://docs.n8n.io/hosting/
- Airbyte documentation — https://docs.airbyte.com/
- Microsoft Learn — Power Automate connectors overview — https://learn.microsoft.com/connectors/connector-reference/
- DATEV — Developer portal (DATEVconnect, data services) — https://developer.datev.de/