How do we stay in control of AI?

In many companies, AI has long been part of the work: in preparing quotes, in customer service, in checking invoices. The more tasks it takes over, the more pressing four questions become. Who checks what the AI delivers? Which data leaves the company? How dependent do we become on individual providers? And what does the law require?

These questions belong on the management’s table. Whoever settles them can give AI more responsibility. Whoever leaves them open stays at the trial stage.

How much open questions hold things back is shown by the current survey of the digital industry association Bitkom. Companies that use AI most often name data protection requirements as an obstacle, two thirds of them. Almost half worry that company data could fall into the wrong hands. And two thirds of the companies that do not use AI yet feel held back by legal uncertainty.

66 %of companies using AI see data protection as an obstacle

45 %worry that company data could fall into the wrong hands

2 in 3companies without AI are held back by legal uncertainty

Quality: who checks what the AI delivers?

Anyone who uses AI every day knows the pattern: an assistant that neatly summarizes a contract can invent a number at the next question. With single requests, this gets noticed. In workflows where AI works on its own, it needs a fixed procedure.

The onboarding principle from the lead article can be laid down precisely. A stepwise approach has proven itself:

1. 01A person checks and corrects every result. This shows where the AI works reliably and where it does not.
2. 02A person checks every result, but only approves or returns it. The AI makes the correction itself.
3. 03Automatic check rules run with every result, for example whether prices and delivery times match the master data. A person only sees the conspicuous cases and a sample.
4. 04The sample gets smaller. Every critical error in it means: one step back.

When the next step is justified is told by a simple rule of thumb from statistics. Whoever has checked 300 randomly selected results without finding a critical error can say with 95 percent confidence that the error rate is below one percent. This makes reliability measurable. And a person always answers for the result.

Data: what leaves the company?

The concern about data is justified, but often vague. Three questions are decisive. Which data goes to the AI at all? Customer data, prices and engineering knowledge need different rules than a text for the website. Where is it processed? Many providers offer data centers in the EU, and some models can also be run in-house. And what may the provider do with it? Business contracts usually rule out that inputs are used for training. That belongs in writing in the contract, not only in the product description.

Whoever has answered these three questions for the most important data can set clear rules: what may go into which tool and what may not. That protects more than a general ban, which gets bypassed anyway.

Dependency: how do we stay able to switch?

This question is often overlooked. The most capable AI models today come from a few providers, most of them from the United States and China. Whoever ties their own workflows firmly to one of them can no longer help decide on prices and direction.

In purchasing, the answer has long been known: no critical part comes from only one supplier. Since the supply shortages of recent years at the latest, every business knows this. The same applies to AI. Workflows should be built so that the model behind them can be replaced. Your own knowledge, meaning data, rules and templates, belongs to the company and sits in its own systems, not with the provider. And where it fits, European providers or open models that can be run in-house are used. The point is not to do everything yourself, but to be able to switch at any time.

Law: what already applies today?

With the law, a sober look helps. Data protection applies to AI as to any other software: personal data needs a legal basis, and service providers need a data processing agreement.

The European AI Act was revised in 2026 and partly postponed. Strict obligations mainly hit high-risk applications, for example in selecting job applications or checking creditworthiness. They only apply from December 2027. For most applications in SMBs, such as quotes, invoice checking or customer inquiries, two things mainly apply: anyone communicating with an AI must be able to recognize it. And companies should promote the AI skills of their employees.

That is manageable. You should still have your own use reviewed legally, ideally once and thoroughly at the start, instead of doubting anew with every new tool.

So how do we stay in control when we use AI? By keeping control in-house rather than with the providers: over quality, data, dependencies and rules. Whoever settles these four points can give AI more responsibility step by step. Not blindly, but a little more with every checked result.