Where to start

How do you prepare a company for an AI rollout? data, people, rules, in that order

AI readiness is not a budget question and not a tool question. You check three layers: where your data sits and who owns it, who decides and who actually knows the process, and on what terms that data may be sent to a model. Below is a checklist for each layer, and a plain answer on which gap means you stop rather than start.

8 minutes read

3 layersdata, people and rules; a gap in any one of them stops the rollout rather than merely slowing it down
Art. 28 GDPRthe processing agreement with the model vendor, signed before the first record of personal data reaches them
2 February 2025the date Art. 4 of the AI Act applies from: you have to ensure AI literacy for the people operating AI on your behalf
EUR 3,500 netone week of process workshop, after which you know whether your data, your people and your rules will hold a rollout

Short answer

How do you prepare a company for an AI rollout?

Check the three layers on ONE process, not on the whole company. Data: which system holds it, whether the fields you need are filled in, and who has the right to approve access. People: who decides, who knows this process from the inside, and who will check what the model returns. Rules: on what legal basis you process this data, whether you have a contract with the model vendor, and what must never be sent to it.

The order is deliberate. Gaps in the data show up in the first week, gaps in the rules at the first audit, and gaps on the people side after three months, when it turns out the team is recounting everything by hand anyway. The third one costs the most, because it surfaces last.

Two gaps stop a start outright: no settled legal basis together with no processing agreement, and nobody who can approve access to the data. Everything else you close in parallel with the pilot.

What does it mean for a company to be ready for AI?

Readiness is not a list of tools or the size of a budget. It is three layers that have to stand before anyone connects a model to your systems. You can start a rollout without each of them. You can only finish one with them.

You check them on a single process. A company as a whole is never ready, because there is always one department running on a spreadsheet. The process you pick to start with has to be.

Data: you know which system holds it, whether it is complete, and who may release it
People: there is a decision maker, someone who knows the process from the inside, and someone who checks the output
Rules: you have a legal basis, a contract with the model vendor, and a list of data you never send
Scope: one process to start, with every place its data lives written down

Where does your data sit, and is it fit to use?

A model answers from what it is given. For the process you picked, write down every place its data lives: a system, a file, an inbox, one person's head. That last one comes up more often than the board assumes.

Against each place mark three things: whether it can be read automatically, whether the fields you need are filled in, and who says yes to releasing it. A missing owner stops a rollout more effectively than a missing API, because an export gets you round an API and nothing gets you round consent.

Where the data sits	What you check	When it stops the rollout
CRM (HubSpot, Pipedrive, Salesforce)	whether deals carry stages, dates and values	when half the records are empty, the model guesses instead of counting
Accounting and ERP (Xero, Sage, Microsoft Dynamics)	whether there is an API or an export, and who switches it on	when the data only ever leaves as a PDF once a month
Orders and sales (Shopify, WooCommerce, BaseLinker)	whether order statuses are used the way they are named	when „in progress” means five different things depending on who set it
A spreadsheet (Google Sheets, Excel) acting as a database	how many copies exist and whether every column keeps one format	when two people hold two versions and neither knows which one counts
A warehouse (BigQuery, an SQL database)	whether metric definitions are written down and shared	when two departments count the same metric differently and both are right

Fill this table in for ONE process. Filled in for the whole company it turns into a quarter-long project nobody finishes.

What do you do with the spreadsheet that runs as a database?

Almost every company has one: orders, stock levels, commissions, a client list half a department works off. You do not have to move it into a database right away. You have to get it into a state a machine can read without guessing. That is usually one day of work, and it pays for itself even if the rollout never happens.

One sheet, one source
Pick the version that counts and archive the rest. Copies on shared drives and in email attachments stop being edited the same day, otherwise they are back within a week.
One table, one header row
One tab with data, one header row, no merged cells and no subtotals inside the table. Move the charts to a separate tab.
One format per column
A date as a date, an amount as a number with no currency text in the cell, a customer id written the same way every time. A column carrying three formats at once will break the automation, usually quietly.
An owner with write access
Name the person who manages the sheet inside the sheet itself, and limit editing to them. Everyone else gets view access or a form. Without this the previous three steps come apart in two weeks.

Who has to be in place on your side before the build starts?

Rollouts are not stopped by technology. They are stopped by decisions nobody makes. You need four roles, not four full-time jobs: in a company of up to 50 people two of them usually cover all four. Every role needs a name, not a department.

The third one is the one most often missing. The written procedure says one thing, and the person who has done the work for four years does it differently, because that way is faster and the customer cannot tell. A model built on the procedure parts company with reality in the first week.

Decision maker: approves budget, access and process change, available once a week
Process owner: answers for the result and takes the change on themselves
The person who knows the process from the inside: shows the exceptions, the workarounds and the work done outside the system
The reviewer: for the first weeks checks the model's answers and reports what is wrong

How do you talk about the fear of losing a job?

That fear is the first reason a team will not show you the real process. Nobody describes in detail the task that looks like their only reason for being on the payroll. You get the official version, and you pay for it three months later.

An honest conversation has three parts: which tasks disappear, what you do not know yet, and what happens to the time that frees up. If you cannot guarantee that nobody loses their job, do not promise it. A promise that does not hold costs more than no promise at all.

There is also a duty some companies missed. Since 2 February 2025, Art. 4 of Regulation 2024/1689 (the AI Act) requires providers and deployers of AI systems to ensure a sufficient level of AI literacy among the people operating those systems on their behalf. That is not a certificate, it is training matched to the tools in use; on our side that is AI training for business.

Name the task that disappears, instead of saying „AI will support the team”
Show who checks the model's output: that is new work, not old work vanishing
Do not promise headcount will not change if you cannot guarantee it
Invite the person who runs the process to the workshop as the expert, not as the subject

Which rules do you write down before the first data goes to a model?

Three documents, one page each: the legal basis for processing in this process, the contract with the model vendor, and the list of data you never send. A twenty-page policy does not count as a rule, because nobody reads it. What applies in practice is whatever the first person pastes into a chat window.

If personal data goes to the model, the vendor processes it on your behalf: you are the controller, they are the processor. Art. 28 of Regulation 2016/679 (GDPR) then requires a processing agreement setting out the subject matter, duration, nature and purpose of the processing and the categories of data. Vendors have templates ready, but someone on your side has to sign one and know what they signed. More on that in the guide on AI and GDPR.

The second rule is about access. An AI agent sees exactly what the account it runs on sees, so decide who approves every new connection and where you record it. The configuration side is in the piece on AI security in business.

Personal data of customers and staff beyond what the task actually needs
Special category data: health, biometrics, trade union membership
Documents under professional privilege or a confidentiality agreement with a counterparty
Passwords, API keys, tokens and system credentials
Files a client gave you without consent for further processing

Which gap means you should hold off?

Not every gap stops a project. Some you close as you go, some turn a rollout into an expensive lesson. On the first two rows of the table below we do not start the build, we go back to the workshop.

We take at most two implementations at a time, so refusing to start is not a negotiating move. It is cheaper for both sides than a pilot that ends after six weeks with the conclusion that the data was wrong.

What is missing	What happens if you start anyway	What to do instead
A legal basis or a processing agreement	the rollout has to be switched off at the first audit or the first client question	settle the basis for this process, sign the agreement, then start
A data owner who can give consent	the project sits for weeks while the licences are already paid for	name a person before the start, not a department
A decision maker on the company side	every change of scope waits for a board meeting	one person with authority over operational decisions, available weekly
Complete data in the source system	the model answers confidently and wrongly, and the team stops trusting it	fill in the fields this process depends on, then connect the model
A reviewer at go-live	errors surface at your customer, not at your desk	name the reviewer and put it in their objectives for the first month

The first two rows are the only ones where we do not start. The other three get closed in parallel with the pilot, as long as someone owns them by name.

Common mistakes

Five mistakes that stop AI preparation from turning into a rollout

Preparing the whole company instead of one process
The data review stretches across a quarter, nobody finishes it, and the rollout never starts at all.
Judging the data from a description instead of an open system
„Our CRM is complete” usually means the fields nobody filters on are filled in. The model gets empty columns and guesses.
The data owner written down as a department, not a person
Consent for access circulates between departments for three weeks, the project stands still, and the tool subscriptions keep running.
Talking to the team only after the rollout has been decided
You get the official version of the process and automate something nobody actually does that way. The exceptions surface in production.
Signing the processing agreement after the pilot has started
Personal data reached the vendor with no basis for it. There is one way out: switch the rollout off and sort the paperwork.

Checklist

Readiness checklist before an AI rollout

The first three points are conditions for starting. A „no” on any of them means you hold off and go back to the workshop; the rest you close alongside the pilot.

Legal basis for processing settled, processing agreement with the model vendor signed (Art. 28 GDPR)
Owner of every data set named as a person, with the right to approve access
Decision maker available once a week, with authority over scope and budget
ONE process picked for the start, with every place its data sits written down
Critical fields checked in the open system, not in the team's description of it
The spreadsheet acting as a database reduced to one tab, one header row and fixed formats
The list of data you never send to a model written on one page and known to the team
Reviewer named, team training scheduled (Art. 4 AI Act)

Sources

Let us check your readiness

A workshop ends with a list of gaps, not a deck

On a free consultation, 30 minutes, we take one of your processes and walk the three layers with you: data, people, rules. If one of them is missing, we say so on the call. The process workshop costs EUR 3,500 net per week, 1 to 7 weeks depending on scope, and ends with a process map, a list of gaps and a plan you can execute without us.

Book a free consultation

Frequently asked questions

Where do you start preparing a company for AI?

With one process, not with the whole company. Write down where its data sits, who owns that data and who knows the process from the inside. Look at tools after that. A review of the whole organisation stretches across a quarter and usually never gets finished.

Do you need an IT department to roll out AI?

No. You need someone with the authority to grant access to systems, and someone who checks the model's answers in the first weeks. The second person does not have to code: it is enough that they know the data well enough to see that a number is off.

Is a spreadsheet good enough as a data source for AI?

It is, if it is tidy: one tab with data, one header row, a fixed format in every column and one owner with edit rights. A sheet with ten copies and subtotals inside the table needs that work done first, which is usually one day.

Do you need a contract with the model vendor?

If you send personal data, yes. The vendor processes it on your behalf, so Art. 28 GDPR requires a processing agreement setting out the subject matter, duration, nature and purpose of the processing and the categories of data. Vendors have templates, but someone on your side signs one and has to understand the scope.

What does the AI Act say about team skills?

Art. 4 of Regulation 2024/1689 requires providers and deployers of AI systems to ensure a sufficient level of AI literacy among the people who operate those systems on their behalf. The provision applies from 2 February 2025. In practice that means training matched to the tools in use, not a certificate.

How much does it cost to prepare a company for AI?

Readiness itself is mostly your own people's time: reviewing the data for one process, tidying the spreadsheet and writing the rules down takes a few days of work. The process workshop costs EUR 3,500 net per week. We quote the implementation after the workshop, because before it nobody knows how much work sits on the data side.

When is it better to hold off on an AI rollout?

When there is no settled legal basis and no processing agreement with the model vendor, or when there is nobody who can approve access to the data. Those two gaps stop a project outright. The rest, incomplete records and missing training included, get closed alongside the pilot and measured at 30 days and at 90 days.