It starts with a list of the processes that eat up your time. For four weeks, note down what causes the most effort in day-to-day work and adds the least value. From that, pick exactly one use case: definable in a single sentence, with a measurable goal, with data that already exists. Typical candidates are preparing proposals, incoming mail, answering emails, writing reports, research. Run a six-week pilot on that one case with one or two employees. Only once that pilot saves hours and is accepted do you move on to the next. Whoever starts ten topics in parallel finishes none.

Licence costs are rarely the problem. Microsoft 365 Copilot runs at around €30 per user per month, ChatGPT Enterprise is similar, Claude comparable. The expensive part is everything around it: preparing data, integrating with existing systems, training, ongoing maintenance. Budget €15,000 to €60,000 in implementation costs per productive use case and plan for a 20 to 30 % buffer. In my experience, the payback period for clearly scoped use cases is six to 18 months. The condition: you define beforehand what you measure — processing time saved, fewer errors, shorter turnaround. Without a baseline before you start, nothing can be proven a year later.

Three levels can be distinguished. Free versions of ChatGPT or Gemini are unsuitable for business data, because inputs can feed into model training and the storage location stays unclear. Paid business editions — ChatGPT Enterprise, Microsoft 365 Copilot, Claude for Work, Gemini Enterprise — offer data processing agreements, EU data residency and a training opt-out. That makes them GDPR-ready, provided you add internally: a written AI policy, a clear list of approved tools, and training on what must not be entered. The biggest real gap is shadow AI through private accounts. An officially approved option closes that gap more effectively than bans do.

The answer depends on your existing IT. If you are deep in Microsoft 365 — Outlook, Teams, SharePoint, Excel — then Microsoft 365 Copilot is the obvious choice, because it sits right inside the programs your employees already work in. For general research, drafting text and longer documents, ChatGPT Enterprise or Claude for Work are usually stronger. Many companies end up with two tools: Copilot for everyday office work, ChatGPT or Claude for deeper work. If data residency in Europe is a hard requirement, also look at Mistral AI or Aleph Alpha. Choose for your specific use case.

Language models produce plausible-sounding but sometimes invented answers — so-called hallucinations. This does not disappear with a better model; it is controlled through process. Three measures have proven themselves: first, every AI output that goes outside the company or influences a business decision is checked by a person. Second, you let the model access your own documents instead of answering freely — through retrieval methods or embedded sources. Third, you write an AI policy that sets out permitted use cases, review steps and the four-eyes principle. Whoever puts these three things in place gets usable results and notices early when something is off.

Employees have two worries: will I be replaced? And will I be monitored? Both are legitimate and both need to be addressed openly. Three steps have proven themselves. First, involve the team early: the people who know a process best choose the use cases, not management alone. Second, say clearly what AI is meant to do in the company and what it is not — for example, automate routine work to free up time for customer conversations. No hidden job cuts. Third, train actively. Two half-days on the tool, plus a weekly drop-in session during the first three months. People who understand the tools fear them less. People who do not understand them quietly sabotage them.

Three points are relevant for most companies. First, risk classification: most business AI applications — drafting text, summaries, research — fall into the “limited risk” category with manageable obligations. High risk applies to personnel selection, credit scoring and critical infrastructure. Second, obligations as a user: trained oversight staff, documentation of the systems in use, and logging of relevant inputs for at least six months. Third, AI literacy: since February 2025 you must be able to demonstrate that your employees are trained in working with AI. In concrete terms: an inventory of all AI tools in use, a written AI policy, training records, and a responsible person in the company. If you have these four points, you are set up for most use cases.