Start your AI rollout with a single pilot process that you measure beforehand and for which you decide in writing, in advance, when you will stop. First clarify the works council (if you have one), data protection and your role under the EU AI Act. The order of steps, pilot length, baseline and stop criteria are our own recommendation, not a legal requirement. The legal points in this article apply to businesses in Germany.

In short: the 8 steps

StepWhat you do
1. Choose a processrecurring, high volume, clear input and output
2. Measure the baselinecollect metrics for 2-4 weeks
3. Clarify the frameworkworks council, data processing agreement, DPIA, role under the AI Act
4. Run the pilot6-12 weeks, thresholds and stop condition written down in advance
5. Trainshort training, one-page usage policy
6. Decidestop, adjust or roll out
7. Scaleprocess by process, update DPIA and processor list
8. Keep measuringmonthly figures, quarterly review

Step 1: Choose the first process

KfW Research (KfW is the German state development bank) writes in its analysis of the Mittelstand (small and mid-sized firms; Fokus No. 554, 29 July 2026): “This suggests that identifying first, practical AI applications is a central hurdle” (our translation).

A good first process happens often, has clear input and output and needs no sensitive employee data: for example, pre-sorting enquiries, arranging call-backs and appointments, or preparing draft quotes. Avoid anything that observes or evaluates staff at the start: it involves the works council, can fall under the high-risk rules and is prohibited for emotion recognition (Art. 5). Questions for vendors: AI for trades businesses: what to check.

If the process is rare or runs differently every time, AI does not pay off. A template, a checklist or, on the phone, a well-configured answering machine is often enough.

Step 2: Measure the starting point (baseline)

Measure for two to four weeks before the start: volume per week, handling time per case, errors and follow-up questions, lost enquiries such as calls never returned. Background on missed calls: Missed calls in the trades.

Step 3: Clarify before the pilot: works council, data protection, AI Act

Works council (Betriebsrat), if you have one

As of 20 October 2026. If there is no works council, these rights do not apply. The list is not exhaustive. The Data Protection Conference (DSK) also advises a service or works agreement setting a clear framework for AI use.

Data protection

As of 20 October 2026.

Details: GDPR checklist for AI in business and GDPR-compliant AI vendors for SMEs.

AI Act: what applies to whom

As of 20 October 2026. Under the AI Act (Regulation (EU) 2024/1689), a provider is anyone who develops an AI system or has it developed and places it on the market or puts it into service under their own name or trademark (Art. 3(3)); a deployer is anyone who uses it under their own authority (Art. 3(4)). If you use a ready-made tool, you are usually a deployer. Who is obliged depends on your role: if you have a system built for you and put it into service under your own name, you can be a provider yourself.

Art. 50 applies from 2 August 2026; we derive this from Art. 113.

At the workplace, Annex III no. 4 classes as high-risk AI systems used for recruitment and selection, for decisions on working conditions, promotion and termination, for allocating tasks based on individual behaviour or personal traits, and for monitoring and evaluating the performance and behaviour of employees. Anyone using such a system informs “workers’ representatives and the affected workers” before putting it into service (Art. 26(7)).

Step 4: Pilot with fixed stop criteria

Our recommendation, not a standard: 6 to 12 weeks, one site or one team. Before the start, write down:

If a threshold is missed, you stop or adjust; you do not extend.

Step 5: Training and AI usage policy

As of 20 October 2026. Under Art. 4 of the AI Act (wording since 27 July 2026), providers and deployers take measures to support the AI literacy of their staff and other persons who operate and use AI systems on their behalf. Technical knowledge, experience, education and training, the context of use and the persons on whom the system is used are to be taken into account. They do not have to guarantee a particular level.

To start, a short training on the specific tool and a one-page policy are enough: which tools are allowed, no customer or staff data in publicly available AI services, who checks results before they go out, who to contact about errors.

AI avatar videos can make onboarding in several languages easier; whether that fits you is something we clarify in the initial call. If your own employees appear as avatars, check the deepfake disclosure duty under Art. 50(4) and clarify their consent.

Steps 6 to 8: Decide, scale, keep measuring

Compare pilot and baseline, then stop, adjust or roll out, process by process, with an updated DPIA assessment and processor list. Keep measuring the step 2 metrics monthly and review each quarter.

What is funded in Germany, and what no longer is

As of 20 October 2026, according to each official programme page; funding status can change at short notice.

BAFA (Federal Office for Economic Affairs and Export Control): consulting subsidy for SMEs. The guideline applies at most to applications submitted by 31 December 2026. It funds advice “on all economic, financial, personnel and organisational questions of business management” (our translation). The guideline does not mention AI; AI-related advice may qualify, so check with BAFA or the Leitstelle (intermediary body) in advance. Conditions include:

We do not hold out the prospect of BAFA funding for our own services, including the AI Check.

Digitalbonus Bayern (regional example). Small businesses can apply “until December 2027” (our translation); a quota is released each month. Small means fewer than 50 employees and at most 10 million euros in annual turnover or balance sheet total. Consulting and training without implementing a solution or a link to the funded project are not eligible.

Mittelstand-Digital centres. They offer free innovation advice. According to the funding notice of the Federal Ministry for Economic Affairs and Energy (BMWE) of 15 December 2025, funding of the existing centres ends “gradually by the end of December 2026” (our translation); a new network is planned from 2027.

Digital Jetzt has ended; according to the same funding notice it was “limited until the end of 2023” (our translation).

Why businesses do not start

According to the Federal Statistical Office (Destatis), 26 percent of businesses overall used AI in reporting year 2025 (as at 24 November 2025). Businesses that considered AI but do not use it name there lack of knowledge (72 percent), unclear legal consequences (62 percent), data protection concerns (60 percent) and excessive costs (32 percent).

Next step

If you want to know where a first pilot could start in your business, book a free initial call (30 minutes, first assessment). The next step after that is the AI Check: paid, and credited towards a follow-up project. On ongoing support: AI consulting.

This article is general guidance and not legal or funding advice; legal position and funding status as of 20 October 2026, for businesses in Germany. Please check with a lawyer, your data protection officer and the funding body before any decision.

Sources