AI for mid-sized companies: status, barriers and a plan for the first 90 days

AI for mid-sized companies: status, barriers and a plan for the first 90 days

AI for mid-sized companies is more widespread than often assumed, but unevenly distributed: use rises with company size and even more with in-house research and development. It is held back mainly by data protection, the skills shortage and lack of time, hardly by technology. A narrow start with a short payback, prepared in 90 days, makes sense.

For decision makers in brief

• Effort: The first 90 days are about clarification: AI inventory, data classification, usage rules and a check of deadlines. Technology comes afterwards, with a single use case.
• Cost: Companies using AI invest on average around 2 % of their net revenue in AI, and almost half invested zero euros in the previous year (Federal Network Agency, Bundesnetzagentur, 2025). Because the most important federal funding programme was frozen as of August 2026, a project has to pay for itself through its own business case.
• Risk: In 39 % of industrial companies AI is merely tolerated (ZEW 2026, the Leibniz Centre for European Economic Research). There, nobody knows which data goes where.
• Time: Narrowly scoped individual cases pay back in three to twelve months, broad programmes take two to four years on average (Deloitte 2025, consultancy study).

Where AI for mid-sized companies stands today

In Germany this group is known as the Mittelstand, mid-sized companies with roughly 50 to 1,000 employees. How widespread artificial intelligence is among them depends heavily on who is asking. Depending on the survey, the adoption rates in the industry report range from 13 % to 58.7 %. The reasons are different populations, different definitions of AI and self reporting. The following table puts the most important values side by side.

Destatis is the Federal Statistical Office, KfW the German state development bank. AI adoption by company size shows a clear gap. Among small companies with 10 to 49 employees, not even one in four uses AI, from 250 employees it is more than half. In the KfW SME Panel the share has nevertheless increased fivefold compared with 2016 to 2018.

The high ifo rate, from the Munich economic research institute, measures something else. It includes simple applications such as text drafts, translation and research. 22.5 % of users rely exclusively on free systems, only 18.7 % run their own AI systems (ifo 2026). Use is therefore not the same as implementation. The same gap shows in machinery and plant engineering: 43 % use AI in the company (VDMA 2025, the German mechanical engineering association), yet only 13 % in their own production (Fraunhofer ISI 2024).

Research beats size

The strongest indicator of whether a mid-sized company uses AI is not its headcount. According to the KfW SME Panel 2025, 53 % of companies with in-house research and development use AI, compared with only 18 % of companies without their own research. In research intensive manufacturing the rate is 23 %, in the rest of manufacturing 17 %.

For practice this is good news. Companies that change their processes regularly also change them with AI. A small company with an established culture of improvement is better placed than a large one that has not touched its workflows for years. The bottleneck is rarely the technology budget, it is the habit of questioning a process before automating it.

What slows AI implementation in SMEs

The barriers are well measured, and most of them are not technical.

Bitkom is the German digital industry association. Our analysis of 52 published practitioner conversations (September 2025 to August 2026) shows the same picture from another angle. 42 of 206 pain point statements concern data, IT/OT and integration, a further 32 concern leadership, culture and change. The survey names the risk, the conversations name the effort.

Two practical consequences follow. First, data protection is a question of architecture: if design data, cost calculations or customer prices must not leave the company, the model has to run where the data is. Second, the skills shortage and lack of time are a question of responsibility. If you have no in-house capacity for operations, do not gloss over it, decide deliberately who will monitor and retrain the system after the rollout.

What pays off

On average it takes two to four years to achieve a satisfactory return, and only 6 % reach it in under twelve months (Deloitte 2025, consultancy study). Narrowly scoped individual cases such as predictive maintenance, by contrast, pay back in three to twelve months. The difference lies not in the technology but in the scope.

For AI in mid-sized companies in the DACH region, a location factor comes on top. According to the consultancy study BCG 2026, payback periods in high wage regions are materially shorter than in low wage regions, where comparable projects take two to eight times as long. The cost pressure weighing on many businesses is therefore also the strongest argument for targeted use. The share of companies that name an unproven benefit as a barrier also shows, however, that without a baseline before the start there is no demonstrable success.

Funding: status as of August 2026

The funding landscape for AI in mid-sized companies had thinned out considerably by summer 2026. The following overview reflects the status in the industry report. Please check the current status before any planning, as some programmes were due to restart or be restructured in early 2027.

The practical conclusion of the industry report: a project has to pay for itself through its own business case, not through the funding rate. This speaks in favour of narrow use cases with a short payback. We keep the checked status of the programmes on our page on funding for AI projects.

The 90-day plan to get started

The first 90 days decide whether a later use case stands on solid ground. The industry report names four work packages for this.

AI inventory. Without this list, any prioritisation is guesswork. Also ask about privately used services, because that is exactly where data leaks out uncontrolled.

Data classification. This decision determines architecture and cost more than any choice of model. Deciding early saves detours later.

Usage rules. Bans create shadow IT, providing tools creates control. Only 30 % of industrial companies actively provide AI to their employees, 8 % explicitly ban it (ZEW 2026). Good AI usage rules fit on a few pages and name the approved tool. Involve the works council early, Bitkom published a guide on this in February 2026.

Check deadlines. Some obligations already apply: the reporting obligations of the Cyber Resilience Act since 11 September 2026, data access for newly placed connected products under the Data Act since 12 September 2026 and, for machine manufacturers, the Machinery Regulation since 20 January 2027. Following the Digital Omnibus, the high risk obligations of the AI Act only follow on 2 December 2027 for standalone systems and on 2 August 2028 for AI in regulated products.

After these 90 days the actual implementation begins, with a single use case, a fixed baseline and a period of parallel operation. The complete sequence of steps over twelve months is set out in chapter 12 of our industry report, and the route into regular operation is described in our guide from pilot project into operations. We see this guide as the preliminary stage to both.

Do it yourself or have it done

Once the groundwork is done, anyone introducing AI in a mid-sized company usually faces the same decision: build an in-house team or commission a partner. With the skills shortage and lack of time as the second and third most frequent barriers, the answer is rarely a purely in-house build. What matters is that infrastructure, implementation and operations are clearly assigned, so the benefit does not fade after the pilot. How we bring these three areas together is shown in our overview of AI implementation for mid-sized companies. We set up a first internal pilot in 72 hours, productive implementation takes 4 to 10 weeks. Typical use cases for manufacturing businesses, from spare parts demand to maintenance data, are described on our page on AI for manufacturing.

Checklist: is your company ready for its first use case?

Answer the following questions with yes, partly or no. The list works well for a session with management, IT and the business unit.

1. Do we know which AI tools our employees use today, including unofficially?
2. Is it defined in writing which data may leave the company?
3. Do we provide an approved AI tool instead of merely tolerating or banning use?
4. Is there a named person who is responsible for AI and has working time for it?
5. Do we know the current metric for the planned use case from the system, not from gut feeling?
6. Is the required data available digitally and can it be extracted without a special project?
7. Can our ERP be connected for reading and writing?
8. Has the works council been informed about the project and involved in the preparation?
9. Have we set the deadlines that apply to us against our own planning?
10. Is it clear who will monitor and retrain the system after the rollout?
11. Does the use case pay off even without funding?

If you answer no to more than half of the questions, start with the 90-day plan and choose a back office process as your first case, one that does not require a connection to machines.