Switching software or connecting AI to a company's systems looks like a technology decision. The outcome, however, depends on three things that no tool brings with it: a clear process, reliable data, and rules for how that data is handled. This holds for a company of 15 people and for a group of 5,000.
The question that usually comes first is the wrong one
When files multiply, information is entered twice and nobody knows exactly where a request stands, the natural reaction is to look for a better tool. With AI the temptation is the same, only faster: an assistant, an agent, an integration.
A tool speeds up what already exists. If the process is clear and the data is reliable, it speeds up good work. If not, it speeds up the confusion, now with more volume and more apparent confidence.
Instead ofWhich tool should we buy?
AskWhich decision or task do we want to improve, with what data, and who is accountable for that data?
The problem is rarely the tool
BCG surveyed 1,000 executives in 2024 and separated the companies already getting value from AI from the rest. The leaders split their resources by a simple rule: 10% for algorithms, 20% for technology and data, 70% for people and processes.
It is a principle of resource allocation observed in the study's leading companies, not a universal rule. It shows where most of the work lies.
View the data as a table
| Component | Share of resources |
|---|---|
| Algorithms | 10% |
| Technology and data | 20% |
| People and processes | 70% |
The same logic applies to a change of ERP, CRM or project management tool. The licence and the set-up are the visible part. The work that decides the outcome lies in defining the process, cleaning and organising the data, and preparing the people who will use the tool.
IBM finds the same pattern on the CEO side: half acknowledge that the pace of investment left the company with disconnected, fragmented technology, and 68% consider an integrated, company-wide data architecture critical.
In the age of AI, context is the asset
An AI model answers based on what it receives. Without context, it produces a generic, plausible answer. With the wrong context, it produces a wrong, convincing answer. What sets one company apart from another is not the model, which is available to everyone, but the context it can give it: its data, its definitions, its rules.
That context is organised in layers. Each layer only works if the one below it is resolved.
-
Check question: which concrete decision changes if the tool works?
Symptom when it fails: the project moves forward with no success criterion and nobody can say whether it went well.
-
Check question: does the tool read the reference data or a copy?
Symptom when it fails: the new tool coexists with the old spreadsheets, and nobody knows which one is right.
-
Check question: do two people describe the process the same way?
Symptom when it fails: work sits idle waiting for one person, and the tool only shows the delay with a notification.
-
Check question: does "monthly sales" include orders not yet invoiced? And returns?
Symptom when it fails: two reports show two different values and the meeting argues about the number instead of the decision.
-
Check question: for each piece of data, where is the reference version and who maintains it?
Symptom when it fails: the same customer address exists in three places, with three values.
Gartner's definition of "AI-ready data" points the same way: data representative of the specific use case, including errors, exceptions and unexpected situations. There is no such thing as ready data in the abstract. Data is ready, or not, for a specific use.
Trust in data is falling
The annual survey by Precisely and Drexel University (LeBow College of Business) of more than 565 data professionals shows an unfavourable trend between 2023 and 2024 on three indicators.
- 2023
- 2024
View the data as a table
| Indicator | 2023 | 2024 |
|---|---|---|
| Data quality is the main data integrity challenge | 50% | 64% |
| Rate the quality of their data as average or worse | 66% | 77% |
| Do not fully trust the data used for decisions | 55% | 67% |
In the same study, only 12% say their data has enough quality and accessibility for effective use of AI. On the Gartner side, 63% of organisations do not have, or do not know whether they have, the data management practices suited to AI.
One possible reading: the more companies try to use data to decide or to feed AI, the more they discover its limits. Quality has not necessarily worsened; it has become visible.
Data is already leaving the company, with or without a strategy
The question of how data is handled does not wait for the decision to adopt AI. Employees already use tools on their own initiative, and company information flows through them.
View the data as a table
| Indicator | Value | Study and population |
|---|---|---|
| AI users who bring their own tools to work | 78% (80% in SMEs) | Microsoft and LinkedIn, 2024. 31,000 people in 31 countries |
| Entered non-public company information into generative AI | 48% | Cisco, 2024. 2,600 privacy and security professionals, 12 countries |
| Entered information about employees | 45% | Cisco, 2024. Same population |
| Organisations without an AI governance policy | 63% | IBM, 2025. 600 organisations that suffered a data breach |
| AI users who received training from their company | 39% | Microsoft and LinkedIn, 2024 |
The cost has also been measured. In its 2025 data breach report, IBM estimates that the use of unapproved AI tools added $670,000 to the average cost of a breach. Among the organisations that had an AI-related security incident, 97% lacked adequate access controls.
Banning is one possible response: 27% of the organisations in the Cisco study banned generative AI, at least temporarily. A ban does not remove the need that led to the use. Without an approved alternative and clear rules, the risk tends to move rather than disappear.
A minimal data map
Before migrating data, connecting a tool or giving an AI assistant access, a simple table answers most of the questions. The example below uses generic categories.
Data map (example)| Data item | Reference version | Owner | Written definition? | Sensitivity | Can it go into an AI tool? |
|---|---|---|---|---|---|
| Customers (contacts, addresses) | CRM | Sales | Yes | Personal data (GDPR) | Only in an approved tool, with a data processing agreement |
| Orders and invoices | Invoicing software | Finance | Yes | Commercially confidential | Aggregated or anonymised |
| Margin per project | Shared spreadsheet | To be defined | No | Strategic | No, until there is an owner and a definition |
| Employee data | HR system | Human resources | Yes | Personal data, some of it sensitive | No, unless a case has been legally validated |
| Internal procedures | Shared folder | Operations | Partial | Internal | Yes, in an approved tool |
The rows with "to be defined" or "no" in the definition column are the first work to do. A new tool does not resolve them: it inherits them.
General information, not legal advice. Data protection rules and the obligations of the European AI regulation apply case by case. On the AI Act, see also what changed in 2026.
5 questions before switching tools or adopting AI
Each question matches a common sign that the problem lies in the context and not in the tool.
Do the people who run the process describe it the same way?
If two people describe different paths for the same request, a common rule is missing. For AI: an ambiguous process gives ambiguous instructions and inconsistent results.
Does each piece of data have a reference version?
The same information entered in several places ends up diverging. For AI: with three versions of the same data, the model uses the one it finds, not the correct one.
Do the indicators have a single, written definition?
Two values for the month's sales are usually two definitions, not a calculation error. For AI: without a definition, an automatic analysis rigorously calculates the wrong thing.
Is there an owner and a decision criterion?
When work waits for a person, what is missing is authority or information, not software. For AI: without someone to validate, nothing the tool prepares should leave the company.
Is there a success measure with a starting point?
"Modernise" is an intention. Response time, rework or reporting hours are objectives. For AI: without a measure beforehand, it is impossible to prove the gain afterwards.
Small, medium or large company: the scale changes, not the question
Size changes where the data is, who decides and which risks weigh most. It does not change the order of the work.
What changes with size, and what does not| Small (10 to 49) | Medium (50 to 249) | Large (250 or more) | |
|---|---|---|---|
| Where the data is | Spreadsheets, email, an invoicing program | Several systems per department, connected by hand | ERP, CRM and dozens of applications, with local copies |
| Typical risk | Knowledge concentrated in a few people | Data silos between departments | Parallel tools outside central control |
| Who decides | Management, directly | Management and area leads | Committees, IT, legal, data protection |
| Realistic first step | One process and one owner per data item | Shared definitions across areas | Data governance and approved alternatives |
| What does not change | Clear process, reference data, handling rules, success measure. In this order, before the tool. | ||
Readiness self-check
Pick a concrete process, for example handling a customer request or the monthly close, and answer the nine statements. The result is set by the weakest pillar: a tool does not make up for a foundation that fails. Nothing is saved or sent.
Five steps, in this order
-
1
Reconstruct a real case from start to finish Pick a recent request or close and record where it came in, which steps it went through, where there was waiting, doubt or repetition, and what information was missing at each moment.
-
2
Map the data that process uses Reference version, owner, definition and sensitivity of each data item, as in the map above. The gaps become tasks with an owner.
-
3
Agree definitions and handling rules What each indicator means, which data can go out to external tools, which tool is the approved alternative and who validates the result.
-
4
Test in a small scope, with measurement before and after One process, one team, a defined period. Compare time, rework, errors and acceptance against the starting point.
-
5
Decide: adopt, adjust or stop Only with the measured result does it make sense to choose the final tool or extend its use. Stopping is also a valid result, and it costs less early than late.
Conclusion
AI models and management tools are within reach of any company. What cannot be bought is context: a process everyone describes the same way, data with an owner and a definition, and clear rules on what can leave the company.
The useful question before any demo or subscription is this:
If the tool arrived tomorrow, would the company know what data to give it, under what rules, and to improve which decision?
Sources
- Gartner, "Lack of AI-Ready Data Puts AI Projects at Risk" (26 February 2025): forecast of 60% abandonment, 63% without suitable practices, definition of AI-ready data.
- BCG, "AI Adoption in 2024: 74% of Companies Struggle to Achieve and Scale Value" (24 October 2024) and the "Where's the Value in AI?" report: 74%, 10/20/70 principle.
- IBM Institute for Business Value, "CEOs Double Down on AI While Navigating Enterprise Hurdles" (6 May 2025): 2,000 CEOs, 25% with the expected return, 50% with fragmented technology, 68% on data architecture.
- Precisely and Drexel University LeBow College of Business, "Data Integrity Trends and Insights" (18 September 2024) and the full report.
- Microsoft and LinkedIn, 2024 Work Trend Index (8 May 2024) and "AI at Work Is Here. Now Comes the Hard Part": 78% and 80% in SMEs, 39% with training.
- Cisco, 2024 Data Privacy Benchmark Study (25 January 2024): 27%, 48% and 45%.
- IBM, "2025 Cost of a Data Breach Report: Navigating the AI rush without sidelining security" (30 July 2025), a Ponemon Institute study: $670,000, 97%, 63%.
Data checked on 6 October 2026. The studies cited use different samples and methods; their values should not be compared with each other.