How to implement artificial intelligence in a company: steps, agents and security

Almost every management team we speak to says the same thing: they know artificial intelligence can help their company, but they do not know how to start. They see spectacular demonstrations, try ChatGPT on a personal basis and read that their competitors already use it, but when it comes to bringing it into daily operations the doubts appear: what exactly is an AI agent, which process should be automated first, and how can it be done without putting data at risk? This guide summarises what we see in our audits and the steps we recommend for implementing artificial intelligence in a company.

What an AI agent is inside a company

An AI agent is a system that understands a request in natural language, consults the company’s data and carries out tasks in its tools. It does not just reply: it records an order in the ERP, updates a record in the CRM, books an appointment or opens an incident, always within the rules the company defines.

In practice, an AI agent in a company does four things:

• It serves people through the customer’s or employee’s channel: phone, WhatsApp, email, web or internal chat.
• It queries real systems: ERP, CRM, calendar, document base or the switchboard, with limited permissions.
• It carries out specific actions: create, update or send, with rule-based validation for sensitive actions.
• It escalates to a person when the case needs human judgement, with the full context of the conversation.

The difference from a classic chatbot is that the chatbot answers questions while the agent resolves tasks. That is why the value of an agent depends above all on its integrations: an agent connected to the ERP saves real hours; an isolated one only changes the channel through which the same question arrives.

The problems companies run into when implementing AI

The obstacle is almost never the technology. It is the lack of a clear starting point. These are the most common stumbling blocks:

• Not knowing what to automate first: there are so many possibilities that none ends up being chosen.
• Projects that are too big: the aim is to “transform the company with AI” instead of solving a specific problem, and the project drags on without visible results.
• Loose tools with no integration: each person uses a different assistant, with no connection to the ERP, the CRM or email, and the real savings are minimal.
• A lack of data to decide with: nobody measures how much time each process costs today, so what is saved cannot be measured either.
• Doubts about data and compliance: where the information is stored, who has access and what the GDPR or the EU AI Act requires.
• Fear of internal resistance: teams worry that AI will replace their work and do not get involved.

The vision: the whole company using AI, through partial changes

The medium-term goal is ambitious: artificial intelligence present in every department, from customer service to administration, logistics or sales. But the way to get there is not a large transformation project; it is a succession of small changes, department by department.

Each change solves a specific process, is measured and, if it works, is consolidated before moving on to the next. That way the risk is low, the team adapts naturally and the company sees results from the first few months.

Where to start: the most time-consuming processes

The best first process is the one that meets three conditions: it takes up many hours of the team’s time, it repeats every day or every week, and its cost is easy to measure. These are the ones that return the investment in a short time, normally between the fourth and the ninth month.

• Customer service: repeated queries about orders, deadlines, stock or incidents by phone, email and WhatsApp.
• Administration: invoices, delivery notes and orders that arrive as PDFs or by email and are typed into the ERP by hand.
• Sales: requests that are answered late or leads that nobody qualifies in time.
• Internal knowledge: questions from the team that always end up with the same two or three people.

Steps to implement artificial intelligence in a company

1. 1Take stock of your processes: list the repetitive tasks in each department and estimate how many hours a week they take.
2. 2Choose a single process: the one with the most hours and the clearest return. Do not try to cover several at once.
3. 3Define a KPI before starting: response time, hours saved, queries resolved without intervention or errors avoided.
4. 4Decide what the agent can do on its own and what needs approval: that boundary is the foundation of the project’s security.
5. 5Connect the AI to your systems: an agent that reads from and writes to your ERP, CRM or email saves far more than an isolated tool.
6. 6Involve the team from the start: the people who carry out the process today know best where the savings are, and AI frees them from repetitive work.
7. 7Look after the data: hosting in the European Union, minimum permissions and a record of every action to comply with the GDPR.
8. 8Measure, decide and scale: with the results in hand, consolidate the process and move on to the next department.

Phases and timelines: the first 8 weeks

A well-scoped first AI agent reaches production in about 8 weeks. This is the indicative timeline we follow:

• Week 1, audit: we review the process with the head of the area, measure the starting situation and set the KPI.
• Weeks 2 and 3, design and integrations: business rules, tone, permissions and connection to the ERP, the CRM, WhatsApp or the switchboard.
• Weeks 4 and 5, testing with real cases: the agent works in assisted mode, proposing replies and actions that a person validates.
• Weeks 6 to 8, supervised production: the agent handles real cases, conversations are reviewed every week and adjustments are made.
• At the close, a decision based on data: continue and scale, adjust the approach or move on to another process with a higher return.

The MVP: seeing real results before investing more

At Ideas más Ideas we start every project with an MVP, a minimum viable product: an AI agent working on a real process in your company, with your data and your systems, for a defined period. It is not a demonstration or a presentation, but a test in production.

The MVP lets you verify conclusively how AI affects your company: how many queries it resolves, how many hours it frees up and which errors it prevents. With that data, the company and our team make the right decision together: continue and scale the development to other processes, adjust the approach or pivot to another process with a higher return.

Security: how to implement AI without putting data or operations at risk

An AI agent that acts on a company’s systems needs different controls from a tool that only answers. The principle we apply is simple: the AI converses, the rules decide. The model understands the request and proposes the action; a set of fixed rules checks whether it can be carried out.

• Minimum permissions: the agent uses its own account with access only to what it needs, and read-only where that is enough.
• Rules for sensitive actions: payments, refunds, data changes or access are validated with rules, not with the model’s judgement.
• Identification before sharing data: phone verification or a one-time code before sharing personal information.
• Data in the European Union and providers with a data processing agreement that do not use your data to train models.
• A record of every conversation, query and action, for internal audit and to improve the agent.
• Human oversight: the agent escalates when it is not sure and a person can step in at any time.
• Transparency: the person knows they are speaking to an AI, as the EU AI Act requires.

Mistakes to avoid

• Starting with the tool instead of the problem.
• Trying to automate processes that are carried out only a few times a month: the return does not justify it.
• Launching without an agreed KPI: without measurement there is no decision.
• Removing human oversight: the agent must escalate to a person when it is not sure.
• Giving the agent more permissions than it needs “just in case”.
• Leaving the project solely in the hands of IT: the head of the area has to be part of the team.

Implementing artificial intelligence in Madrid, Barcelona and the rest of Spain

The method is the same in every city. Our team is based in Barcelona and works with companies across Spain: the audit and follow-up are done by video call, and the integration with your systems is agreed with your IT team, using secure remote access. What changes from one area to another is the business landscape and the most common processes: logistics in the Henares Corridor, industry in the Vallès or the Basque Country, real estate and clinics in Málaga.