Guides

AI projects rarely fail on the model. They fail on data, on missing buy-in or on legal steps taken too late. These guides cover the steps around every use case, in the order a project usually needs them.

  1. 1

    Finding and prioritising AI use cases in your company

    Run a short discovery process with the people who do the work, score candidates on value, feasibility, data readiness and risk, and start with two or three quick wins.

  2. 2

    Buy, cloud service or run it yourself: choosing the implementation path (TCO, lock-in, data sensitivity)

    Decide per use case whether to buy AI inside standard software, assemble it from a cloud model API, or run an open-weight model on your own hardware, based on data sensitivity, total cost of ownership and exit options.

  3. 3

    Data readiness check: is your data ready for AI?

    A structured check of data inventory, quality, access rights and preparation effort before you commit to an AI use case.

  4. 4

    Involving the works council: co-determination for AI

    How to involve the works council (Betriebsrat) early and properly when introducing AI, using §87(1) no. 6, §90, §80(3) and §95 BetrVG, and how to reach a framework works agreement on AI.

  5. 5

    Data protection for AI projects: legal basis, DPIA, data processing agreement, role of the DPO

    How to get an AI use case through GDPR/BDSG: map the personal data, pick a legal basis, decide on a DPIA, sign the AVV and involve the DPO early.

  6. 6

    AI literacy and training for staff (AI Act Art. 4 as amended by Regulation (EU) 2026/1744)

    Set up a proportionate, documented AI literacy programme that supports staff in using AI safely and well, and that you can show to an authority, the works council or a court.

  7. 7

    Company AI policy and acceptable use (approved tools, shadow AI, confidential data)

    Write a short, enforceable AI usage policy that names approved tools, stops shadow AI by offering a better alternative, and keeps confidential and personal data out of the wrong systems.

  8. 8

    Change management and acceptance: communicating with staff, AI champions, pilot groups, handling fears

    Bring employees, team leads and the works council into an AI project early so that people actually use the system, using clear communication, a network of AI champions, a representative pilot group and an honest way of handling fears.

  9. 9

    Running an AI pilot: from proof of concept to production (scope, KPIs, go/no-go)

    Plan a time-boxed AI pilot with a narrow scope, a measured baseline, agreed KPIs and a written go/no-go decision, so that a working demo either becomes a production system or is stopped cheaply.

  10. 10

    Choosing an AI vendor: EU hosting, AVV, security questionnaire, exit strategy, contract points

    Shortlist, check and contract an AI vendor so that data location, the data processing agreement (AVV), security evidence, exit rights and liability are settled before you sign, not after the first incident.

  11. 11

    Operating AI in production: monitoring quality, costs, model updates, incident handling

    How to run an AI system after go-live: who owns it, what to measure, how to control token costs, how to survive model updates and how to handle AI incidents.

  12. 12

    Funding for AI projects in Germany and the EU (federal, state and EU programmes, Mittelstand-Digital)

    Which public funding an SMB can actually use for AI projects in late 2026, what each programme pays for, and how to sequence free advice, subsidised consulting, loans and grants without losing eligibility.

  13. 13

    Security for AI systems: prompt injection, data leakage, access rights, BSI guidance

    Secure chatbots, RAG assistants and AI agents with the BSI/ANSSI principles: clean up access rights before rollout, treat every input as untrusted, give agents the least privilege possible and keep a human on critical actions.

  14. 14

    EU AI Act for deployers: what SMBs actually have to do (risk classes, transparency, high-risk duties, dates after the Digital Omnibus)

    Sort your AI systems into the AI Act risk classes, meet the transparency and literacy duties that already apply, and prepare for the high-risk deployer duties that start on 2 December 2027.

  15. 15

    Why AI projects fail and how to avoid it (failure studies, typical causes, cost and lock-in)

    Read the well-known AI failure figures for what they actually measure, recognise the nine typical failure reasons used in this catalog, and apply countermeasures, cost checks and exit planning before a project stalls.