Framing
The question is rarely “AI or no AI”, but “one tool or one system”. A single AI tool, for example a chatbot on the website or a separate phone-AI subscription, solves a concrete problem quickly and with manageable risk. An AI operating system connects several such building blocks through a shared knowledge base, consistent approval rules and the same system integrations. This page looks at when the step from a single tool to a system pays off. What an AI operating system is and which building blocks it consists of is explained in AI operating system explained.
The difference only shows with several tools. A single tool has one knowledge base and one rule logic. Two independent tools have two, and they can contradict each other if nobody keeps both in sync. A system has one shared knowledge base, no matter how many channels hang off it.
Such a central platform can come from us, from another provider or from software you already use. The criteria on this page apply to any of them.
Tool sprawl and shadow AI: what it means for your business
Several AI tools can pile up without anyone deciding on them: someone drafts emails with a private chatbot account, the website gets its own chatbot, the phone its own subscription. When employees use tools their employer has not provided, this is called shadow AI.
Two surveys show how widespread it is, and they measure different things:
- Employees about themselves: in the IW employee survey of March and April 2026, 29.1 % of employed AI users (n = 2,793) said they use tools their employer has not provided. In companies with fewer than 50 employees the share was 33.5 %, in those with 250 or more 25.5 %. The authors note themselves: „Nicht bereitgestellt heißt dabei nicht zwingend heimlich oder verboten“ (“not provided does not necessarily mean secret or forbidden”, IW-Kurzbericht 63/2026). The data is a cross-section and based on self-assessment.
- Companies about their staff: Bitkom Research, commissioned by the digital association Bitkom, surveyed 604 companies with 20 or more employees by phone (calendar weeks 27 to 32, 2025). In 8 % of companies the use of private AI tools is widespread, 17 % report individual cases, and another 17 % don’t know for sure but assume it happens. 23 % had set rules for using AI tools (Bitkom, 21 Oct 2025).
The IW figure describes what employees say about themselves. The Bitkom figures describe what companies know or assume. They cannot be read side by side as a trend.
The German data protection conference (DSK, Datenschutzkonferenz) writes about unauthorised, uncontrolled AI use without clear rules: „Es ist davon auszugehen, dass dies derzeit Realität in vielen Unternehmen und Behörden ist“ (“it can be assumed that this is currently reality in many companies and public authorities”, AI guidance, para. 36). A ban alone does little, in the IW authors’ view: „Reine Verbote würden vor allem engagierte Beschäftigte treffen“ (“pure bans would mainly hit engaged employees”). What follows from this is an overview first, not a platform.
Comparison table
| Criterion | AI operating system | Individual AI tools |
|---|---|---|
| Effort per additional building block | less effort for knowledge base and rules, since both already exist; cost per building block depends on scope (see pricing) | each building block brings its own knowledge base and rules |
| GDPR/data sovereignty | central overview of providers, DPAs and sub-processors (for us: privacy policy, section 17); retention periods defined once, but every service involved has to implement them | one DPA and one deletion process per tool provider, and you keep the overview yourself |
| Maintenance | central: one knowledge base that all channels use; channel settings remain per building block | distributed: every change has to be replicated in each tool individually |
| Scaling | new channels can be connected to the existing structure more easily | every new channel is its own small project |
| ERP connection | connection built once, provided the ERP offers a usable interface; whether write access is possible has to be clarified per vendor | set up per tool, as far as tool and ERP allow it |
| Entry risk | higher, because the architecture is considered from the start | lower, a single tool can be tested with low risk |
| Consistency of answers | same knowledge base; answers can still differ per channel, so test them | channels can contradict each other if knowledge isn’t kept in sync |
| Dependence on the provider | everything hangs on one platform; clarify export of knowledge base, prompts and logs up front | spread across several providers, each with its own contract |
Avoiding AI tool chaos: four ground rules, even without a platform
These four rules don’t require buying anything (as of 20 October 2026):
- Tool and DPA list. Write down which AI tools are used in the business, for what, with which data, and whether there is an AVV (data processing agreement, Art. 28 GDPR). Ask about private accounts too, without blame. A provider may only engage further processors with your prior written authorisation (Art. 28(2) GDPR); their list belongs in your overview.
- One knowledge source with an owner. Services, opening hours and standard answers sit in one place, and a named person keeps them current. Every tool that answers customer questions is maintained against that source.
- Work accounts and roles. The DSK recommends that employers provide devices and accounts for work use of AI (para. 41), set internal rules for its use (para. 36) and make employees aware through training and guidelines (para. 46). The guidance is a recommendation by the supervisory authorities, not law. Also define who may use which tool with which data.
- Log. Record which tool answered or sent what to customers, as far as the tool allows. Without a log, an error is hard to trace later.
More items to tick off are in the GDPR checklist for AI in the company.
When A, when B
A single AI tool fits when you’re testing AI in your business for the first time and don’t yet know whether and how well it works. The phone assistant alone is a manageable first step, without committing right away to a larger architecture decision.
The AI operating system fits once it’s foreseeable that two or more channels need AI, say phone plus WhatsApp, or phone plus an agent for quotes. Then you don’t rebuild the knowledge base and rules for every building block, and that can lower the maintenance effort per building block.
As a rule of thumb: a tool to try things out is entirely fine. From the second or third AI building block onward, it’s often worth asking the system question. A system isn’t inherently better. It depends on how much duplicate maintenance you already have today.
Central AI platform for SMEs: when it isn’t worth it
Our assessment, not a measurement. A central platform is usually too much when
- you have one use case and no second channel is foreseeable,
- nobody in the business can maintain the shared knowledge base (it then goes stale, and every channel answers with the same outdated information),
- your existing office or CRM software already covers the need,
- the provider offers no exit path, meaning no export of knowledge base, prompts and logs,
- you process particularly sensitive data. The DSK considers technically closed systems preferable from a data protection standpoint (para. 20). Check especially carefully whether a platform delivers that.
With us, a central knowledge base, shared approval rules and a log of everything belong to tier 3. What each tier includes is on the pricing page.
What to check with any platform
Whichever provider the platform comes from, get these points in writing before signing:
- Sub-processor list: which services process your data, in which country, and how do you learn about changes? Under a general authorisation, the provider must inform you of intended changes, and you can object (Art. 28(2) GDPR).
- Export: knowledge base, prompts and conversation logs in a format you can reuse.
- Roles: who may change knowledge, who approves answers?
- Logs: what is stored, for how long, and who can see it?
More on choosing a provider is in the article choosing AI providers for SMEs with data protection in mind.
If you’d like to go through your tool list with someone: the free initial call takes 30 minutes and gives you a first assessment.
This article is general guidance (as of 20 October 2026) for businesses in Germany and is not legal or tax advice.
Sources
- Bitkom: Beschäftigte nutzen vermehrt Schatten-KI, press release of 21 Oct 2025 (retrieved 20 Oct 2026)
- Engels/Hammermann: Schatten-KI: Beschäftigte sind schneller als ihre Betriebe, IW-Kurzbericht No. 63/2026 (retrieved 20 Oct 2026)
- Datenschutzkonferenz: Orientierungshilfe Künstliche Intelligenz und Datenschutz, version 1.0 of 6 May 2024 (retrieved 20 Oct 2026)
- Art. 28 GDPR (gdpr-info.eu) (retrieved 20 Oct 2026)