An AI strategy for the enterprise: five decisions before the first model
An AI strategy is not a list of tools but five decisions: where AI reads data, what it may do, who confirms, who holds the keys and in what order it is rolled out. How we make them, and where our products sit in them.
In short
- An AI strategy is a set of decisions about data, actions, confirmation, control and sequence — the tool is chosen only after them.
- AI without access to the systems of record at the moment of the question does not know the state of the business, so API integration comes before the model.
- The level of autonomy — copilot, semi-automatic or autopilot — is chosen per type of work and cost of error, not once for the whole company.
- The claim that something was written comes from the system it was written to, and sensitive actions pass through human confirmation.
- Autonomy is extended only when measured results justify it, and only for the types of work that cleared the agreed threshold.
Most companies enter artificial intelligence through a tool: a chatbot subscription, a pilot with one model, a demo everyone likes. A few months later the question remains why nothing in the business itself has changed. The answer is almost always the same — the tool was chosen before the decisions that determine whether AI can do the work at all.
An AI strategy is neither a list of tools nor a presentation about the future. It is five decisions made before the first model: where AI reads data, what it may do, who confirms, who holds the keys and in what order it is rolled out. This piece describes how we make those decisions and where our products sit in them. The wider picture is on the AI strategy page.
Decision 1: AI works inside the systems, not beside them
A company's work lives in its systems of record — the ERP, the CRM, the warehouse system, the document archive. AI that cannot reach those systems at the moment of the question does not know the stock level, the order status or the deadline in the contract. It is then left with two options: guess or stay silent. Neither is a strategy.
So the first step is not choosing a model but taking an inventory: which systems hold the data for the process you want to improve, whether they have an API, and what may be read and what may be changed through it. An agent that can only talk is a conversationalist; an agent that can check, write and notify is a colleague. Integration makes the difference — we wrote about it in the piece on the API-first approach.
Decision 2: Autonomy is chosen per type of work
"May AI decide on its own" is the wrong question. The right one is: for which type of work, under which limits, and with what kind of trail. In practice there are three levels.
| Level | What the agent does | Who decides |
|---|---|---|
| Copilot | Suggests a move or a draft | A person sends or discards it |
| Semi-automatic | Prepares the move and waits for approval | A person approves |
| Autopilot | Acts on its own within set limits | Rules and limits, with a full trail |
The level is not chosen once for the whole company. NG Sara, our AI sales agent, works on exactly these three levels, and the level is chosen per customer segment: where a mistake is expensive, Sara suggests; where it is cheap and repetitive, she acts on her own within the limits. How the cost of error determines autonomy is covered in detail in AI agents in the enterprise.
Decision 3: The system confirms the write, not the model
A language model can say "done" convincingly even when nothing was written. A strategy therefore has to decide who claims that an action was carried out. Our rule is simple: the claim of a write comes from the system it was written to, and sensitive or irreversible actions pass through human confirmation.
This is how NG Copilot, the AI assistant in NG CRM, works. By default it only reads and answers, stating where each answer comes from. Action suggestions are switched on separately, and even then every change sits on a card with its old and new value and waits for the user's confirmation. Some actions, such as sending a quote to a customer, also wait for a second person's approval, and the outcome of the action is reported by the server, not by the model. We covered the security side of the same topic in the piece on AI agent security.
Decision 4: Data and model stay under your control
Every call to an external model takes some company data outside. A strategy therefore decides which kinds of data may go to which provider, what is masked before sending, and whose key it is. When a company uses its own key with a provider it chose, it knows where queries go and what they cost. When personal identifiers are masked before a web search, the query carries no more than it must.
Both rules exist in NG Copilot: it runs on the company's own AI key, and when web search is enabled it masks the tax ID, company registration number, e-mail address and phone number before the query is sent. These are not technical details for the end of a project but decisions management should make at the start.
Decision 5: Sequence and measurement before scaling
The first AI process should not be the most visible one, but the one where the work is frequent and a mistake is cheap and easy to check. Before rollout the baseline is measured — how many cases, how much time per case, how many escalations. The agent then works first in the shadow, then in proposal mode, and only then on its own, and only for the case types that cleared the agreed threshold. How to set up such measurement is described in how to measure the ROI of an AI project.
The rule for scaling: autonomy is extended per type of work, only once measured results justify it — never because the pilot looked good in a presentation.
Where things sit in our portfolio
Our products follow the same decisions. Each covers a different part of the work, and what they share is that AI works on top of existing systems and data.
| Product | Work | Control |
|---|---|---|
| NG Sara | Sales: opportunities with existing and new customers | Three autonomy levels and a full audit trail |
| NG Nora | Inbound customer calls and messages | Escalation to a person with context, transcript and action trail |
| NG CRM · NG Copilot | Answers from CRM data and action suggestions | Writes only on confirmation, sensitive actions need a second person |
| NG Tara | Workflows that cross several systems and people | Human approval under the process rules and a trail of every action |
| NG One, NG DMS, NG WMS · NG Copilot | Questions over ERP data, documents and stock | Same access rights as the user; MCP for your team's AI assistants |
NG Tara is the newest part of that picture: an autonomous agent that takes requests through voice, chat, e-mail and messaging, and carries out tasks through APIs and MCP in ERP, CRM, WMS, DMS and MES systems. How it takes one task from request to approval is described in a separate piece on NG Tara.
How to start
A good AI strategy for the first year fits on one page: two or three processes with a clear accuracy criterion, the systems to read from and write to, the autonomy level for each process, who approves and what is measured. If you would like to write that page together, get in touch — the first conversation is about the process, not the tool. What that work looks like as a service is described on the services page.
Let's talk about your case
Describe the process that costs you the most. In a short call we tell you whether automating it pays off, and what that would concretely involve.
Frequently asked questions
What is an enterprise AI strategy?
It is a set of decisions made before choosing a tool: which systems AI reads data from, which actions it may take, who confirms them, which data may go to which provider, and in what order AI enters the processes. Without those decisions even the best model stays a demo that does not change the work.
Where should we start with AI?
With a process where the work is frequent, the input is often text, and a mistake is cheap and easy to check. Before rollout the baseline is measured, the agent first works in the shadow, then in proposal mode, and on its own only for the case types that cleared the agreed threshold.
May an AI agent carry out actions in our systems on its own?
It may, but only for the types of work where that has been agreed, and within clear limits. Sensitive and irreversible actions pass through human confirmation, and the claim that something was written comes from the system it was written to, not from the model. Every action leaves a trail.
Is NG Tara available?
Yes. NG Tara is commercially available: it works across several channels and carries out tasks through APIs and MCP in ERP, CRM, WMS, DMS and MES systems. We start with a demo on one of your workflows.
How do we measure whether an AI strategy works?
By measuring before and after rollout, per process: the number of cases, time per case, the share of escalations and the share of suggestions accepted without change. A feeling that it is "faster" is not a measure, and autonomy is extended only when the numbers justify it.
Keep reading
- AI & automation9 min read
AI agents in the enterprise: where the ROI is, and where it isn't
The gap between a demo that impresses and an agent that survives production is not the model. It is which job you delegated, and who carries the cost when it is wrong.
Read - Security10 min read
Security and privacy of AI agents: what to check before production
An AI agent in production has access to data and takes actions — which makes it a new attack surface. A checklist: permissions, prompt injection, tool guardrails and the fate of personal data.
Read - AI & automation9 min read
How to measure the ROI of an AI project before you start it
The return on an AI project is not computed afterwards but before, against a baseline measured while nothing has changed. A guide to the costs people forget and a pilot that yields a defensible number.
Read