Where should a mid-sized company start with AI?

Start in marketing and sales. It's where EU companies already use AI most, the work is text-heavy and easy to check, and the legal risk is low. Name one owner, buy one business AI assistant, run two pilots for 90 days and train everyone who gets access, for the EU AI Act's AI literacy duty. Then move to the next department.

This guide is for owners and managing directors of companies with roughly 20 to 250 employees: no AI team, no data scientist, a lot of curiosity and some worry about the law. The pillar guide on using AI in marketing without losing quality covers rules and review. This one zooms out to the whole company: where to start, in which order to continue, who does the work, what the first year costs and what the EU AI Act asks of you.

How far along are small and mid-sized companies with AI?

Further than many owners think, and well behind large firms. According to Eurostat, 20.0% of EU enterprises with ten or more employees used AI in 2025, up from 13.5% a year earlier. Among small firms it was 17.0%, among medium-sized ones 30.4% and among large ones 55.0%. Germany and Austria are above the EU average.

Why the rest hold back is well documented for Germany. The Federal Statistical Office (Destatis) asked companies that had considered AI but don't use it. In its 2025 survey, 72% named a lack of knowledge, 62% unclear legal consequences and 60% data protection concerns. Only 32% said the costs seemed too high.

That order matters for your plan. Knowledge and legal clarity come before money. So the first investment is in people and a few written rules. Software is the cheap part.

Why should marketing and sales come first?

Because that's where AI already works in companies like yours. Eurostat reports that 34.7% of EU enterprises using AI apply it in marketing and sales, the most common purpose in 2025, and that the gap between small and large firms is smallest there. The work is text-heavy, repeats every week and is easy to check.

• The material fits the tools. Among German companies using AI, Destatis counts 52% using text mining and 52% generating images, video or audio. Texts and images are what marketing and sales produce every day.
• A person can check the result. A sales lead checks an AI proposal draft in minutes. A wrong production forecast is much harder to spot.
• The legal risk is low. Typical marketing uses aren't high-risk under the EU AI Act. AI that screens job applicants is, which is why HR waits.
• The team sees results early. In my view this matters most in a company without an AI team. A better proposal or a sharper website page in week six convinces more people than a strategy paper.

There's a second reason I'd start there. My view: with AI, marketing can now run with far fewer people than before. For a mid-sized company that never had a full marketing department, that's the biggest single change AI brings. Which marketing processes to pick is covered in the guide on where a B2B company should start with AI in marketing.

Which departments come after marketing?

Move outward from marketing in order of checkability and risk. Sales and customer service come next, then administration and finance, then production. Anything that decides about people, such as recruiting, comes last. The EU AI Act classes AI for recruiting and for decisions about employees as high-risk. That area waits until your team knows how to work with AI.

Eurostat's purpose data shows the same order in practice. After marketing and sales, EU enterprises using AI apply it to business administration and management (31.1%), accounting, controlling or finance (23.1%) and production processes (20.8%). Logistics comes last at 6.1%.

A word on customer service. A chatbot on your website is tempting as a first project. I'd wait. It talks to customers without a person in between, it often touches personal data, and Article 50 of the AI Act requires that people are informed when they interact with an AI system. Start with AI that drafts answers from your own documents and a person who sends them.

What does a 90-day AI plan look like without an AI team?

Ninety days are enough for a first round. Two weeks for an inventory and rules, two weeks for the tool and training, six weeks for two pilots in marketing and sales, two weeks to measure and decide. At the end you know what works in your company, what it costs and which department is next. These durations are my planning assumptions.

• Weeks 1 and 2, inventory and rules. Ask every department which AI tools people already use, including private accounts. Pick two candidate tasks in marketing and sales and measure how long they take today. Write a one-page rule on tools, data and review.
• Weeks 3 and 4, tool and training. Choose one business assistant with a data processing agreement. Train everyone who gets a seat, and keep a list of who was trained on what.
• Weeks 5 to 10, two pilots. Good candidates: proposal drafts from your own templates, account research before sales calls, website or LinkedIn content built from an interview with your best expert.
• Weeks 11 and 12, measure and decide. My rule of thumb: keep a pilot when time per unit drops by at least a quarter and the number of corrections doesn't rise. Change it when only one of the two holds. Stop it when neither does.
• From week 13, the next department. Take what you learned to sales operations or customer service, with the same rules and the same measurement.

Who does the work when there's no AI team?

One owner, a few champions and the managing director's backing. The owner is someone who already knows the business, not a new hire. They keep the rules and the tool list, run the pilots and report results. Champions in each department test and teach their colleagues. Outside help speeds up the start and should make itself unnecessary.

• Sponsor. The managing director. Sets the order of departments, approves the budget and says out loud that using AI within the rules is wanted.
• AI owner. Often the head of marketing, operations or IT. My rule of thumb: about one day a week during the first 90 days, half a day after that.
• Champions. One person per department that runs a pilot. They collect what works and what fails.
• Data protection contact. Approves the tool and keeps the data processing agreement on file.
• Everyone with a seat. Gets trained, knows where the rules are and whom to ask.

My view: most companies don't need more software. They need better systems. For AI that means a named owner, a written rule and a review step, before anyone buys a second tool.

What does the first AI year cost a mid-sized company?

Less in licences than in time. For a company with 80 employees and 15 first users, licences for a business AI assistant come to a few thousand dollars or euros a year. The larger cost is the hours of the owner, the training and the pilots. Budget both, or the licences end up unused.

A typical scenario, with assumptions you should replace with your own: 80 employees, 15 seats in the first year, an assumed 25 US dollars per seat and month (the business plans compared in the guide on which AI tools a team really needs list 20 to 25 dollars), an owner at one day a week for 13 weeks and half a day a week after that, two hours of training per user and two pilots with two people each.

Two points follow. The owner's 32.5 days cost more than the licences in almost any company with a salaried manager. And seats nobody uses make every used seat more expensive, so start with the people in the pilots and add seats on demand.

What does the EU AI Act require from a mid-sized company?

A company that uses AI tools is a deployer under the EU AI Act. For typical marketing and office use, three things matter: measures for the AI literacy of your staff, transparency for deep fakes and certain published texts, and much stricter rules for high-risk uses such as recruiting. What follows is a summary of the regulation. It isn't legal advice.

• Who counts as an SME. The Act relies on the EU definition from Recommendation 2003/361: fewer than 250 employees, and an annual turnover of up to 50 million euros or a balance sheet total of up to 43 million euros. Many companies that call themselves Mittelstand are larger.
• AI literacy, Article 4. Since 2 February 2025, providers and deployers have to take measures for the AI literacy of staff who work with AI systems. The Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, reworded the duty: companies take measures to support AI literacy, and the text now says they don't have to guarantee a specific level for each person. Training plus a record of it is the practical answer.
• Transparency, Article 50. From 2 August 2026, deployers must disclose deep fakes, meaning AI-generated or manipulated images, audio or video that would falsely appear authentic. AI-generated text published to inform the public on matters of public interest must be disclosed too, unless a person reviewed it and someone holds editorial responsibility.
• High-risk, Annex III. AI used to recruit or select people, for example to screen applications, and AI used for decisions on promotion, termination or monitoring of employees counts as high-risk. Since the Digital Omnibus, these obligations apply from 2 December 2027.
• Fines. For SMEs, each fine is capped at the lower of the percentage and the fixed amount named in Article 99. The Digital Omnibus extends parts of this relief, including the fine cap, to small mid-caps: fewer than 750 employees and up to 150 million euros turnover or 129 million euros balance sheet.
• Swiss companies. Under Article 2, paragraph 1, point c, the Act also covers providers and deployers outside the EU when the output of their AI system is used in the EU. Selling into Germany or Austria from Zurich? Ask counsel.

Data protection comes on top. GDPR and the Swiss FADP apply as soon as personal data goes into an AI tool. The basics are in the guide on starting with AI in B2B marketing. Again: this isn't legal advice. Talk to your data protection officer or a lawyer first.

What to do this week

1. Ask every department head which AI tools their people use today, including private accounts.
2. Name one AI owner and block one day a week in their calendar for the next 90 days.
3. Pick two candidate tasks in marketing and sales and start measuring how long they take.
4. Shortlist one business assistant with a data processing agreement and no training on your inputs.
5. Write a one-page AI rule: approved tools, data that never goes in, who reviews what.
6. Book a two-hour training for the first users and keep the attendance list.
7. Check whether anyone uses AI to screen applicants or assess employees, and put it on the list for legal review.

AI won't wait for the perfect strategy, and it doesn't need one. It needs an owner, two pilots that can be measured and a team that knows the rules. Want an outside view on where your company should start? A one-day Momentum Workshop is built for exactly that decision.

Frequently asked questions

Is AI worth it for a small company?

For most, yes, when it starts with text-heavy work that repeats every week. According to Eurostat, 17.0% of small EU enterprises already used AI in 2025. Among German companies that considered AI but don't use it, Destatis found only 18% thought it wasn't useful. Lack of knowledge was the main barrier, at 72%.

Do we need an AI team or a data scientist to start?

No. A business AI assistant needs no development work. What you need is one owner who knows the business, written rules for tools and data, and trained users. Specialists become useful later, when you connect AI to your own systems or data, for example in production or customer service.

Does the EU AI Act apply if we only use ChatGPT?

Yes. A company that uses an AI system in its business is a deployer under the AI Act. Article 4 asks you to take measures for your staff's AI literacy, and Article 50 sets disclosure duties for deep fakes and certain published texts. Most office and marketing uses aren't high-risk. This isn't legal advice.

Which AI tool should a mid-sized company start with?

One general business assistant for everyone in the pilots, chosen by where your documents and email already live. Check that it comes with a data processing agreement and doesn't train on your inputs. Add specialist tools only after a pilot shows the assistant falls short on a weekly task.

How long until AI pays off for a mid-sized company?

I know of no reliable public benchmark for mid-sized companies, so be careful with promises. What you can know after 90 days is whether two concrete tasks got faster without more corrections. That's a measured answer for your company, and a better basis for the next budget than any industry average.

Sources

1. Eurostat: 20% of EU enterprises use AI technologies (11 December 2025)
2. Eurostat: The use of artificial intelligence (AI) technologies in the European Union, key results, 2026 edition
3. Destatis: Unternehmen mit Nutzung von Technologien der künstlichen Intelligenz nach Beschäftigtengrößenklassen (2025)
4. Destatis: Gründe gegen die Nutzung von Technologien der künstlichen Intelligenz nach Beschäftigtengrößenklassen (2025)
5. Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
6. Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
7. EU AI Act, Article 4: AI literacy (consolidated text)
8. EU AI Act, Annex III: High-risk AI systems
9. EU AI Act, Article 99: Penalties
10. European Commission: SME definition (Recommendation 2003/361)
11. Recommendation (EU) 2025/1099: small mid-caps, EUR-Lex