Implementing AI without an in-house IT department

You have no developers on staff. IT is an external party that looks after laptops and Microsoft 365, and everyone else gets on with their own job. Still, you see work that could go a lot faster with AI. Good news: implementing AI without an IT department works fine. But not without internal ownership.

An external partner can handle the architecture, integrations, security, build and technical management. What you can't outsource: deciding whether the outcome is right in practice, which risks you accept and who is responsible after go-live.

Which roles do you need in-house as a minimum?

Business owner

Sets the goal, approves scope and budget, chooses priorities and decides whether the pilot continues or stops. That can be a managing director, an operations manager or a department head.

Process expert

Knows the exceptions in the daily work, supplies examples, describes the decision rules, tests the workflow and checks the output. A supplier won't learn your process from a manual. The people who do the work are essential.

Technical point of contact

Without your own IT department, this is often your existing managed service provider (MSP), an application administrator or the implementation partner. This role covers accounts, permissions, integrations, passwords and keys, incidents, logging and changes.

Privacy and security

This can sit in-house, externally or be shared. How doesn't matter, as long as it is explicitly someone's job.

What can an external partner take on?

A lot. Facilitating process workshops, designing the solution, testing technical feasibility, building integrations, testing, securing, going live, monitoring, documenting, training and support.

What a partner can't decide on its own:

• whether an answer to a customer is correct in substance;
• which exceptions are acceptable;
• which financial authorisations apply;
• which risks your organisation accepts;
• how employees' roles change;
• whether the business case is good enough.

Step 1: choose one process with a clear owner

With little internal capacity, you don't start with a company-wide AI strategy. Choose one process with clear input, a clear outcome and someone who stands behind it. How to choose is covered in which business processes suit AI.

Step 2: list your systems and suppliers

Make an overview per system: what it is for, who owns it, which supplier is behind it, who has admin rights and whether there is an API or standard integration. Think of Microsoft 365, your CRM, your accounting software and wherever documents live. Without an IT department, this overview matters even more. Otherwise, at the first incident, nobody knows who to call.

Step 3: choose how you organise it

There are three common models.

• One implementation partner: one point of contact and little handover. The risk is dependency, so arrange the exit properly.
• Implementation partner plus your existing MSP: the MSP keeps infrastructure and accounts, the partner does the AI workflow. The risk is that tasks fall between two parties. Record where the line is.
• Several specialists: lots of depth, but more coordination and more work for you.

Choose the model that fits how much time you have to coordinate. What to look for in a partner is covered in choosing an AI implementation partner.

Step 4: record access and permissions

Give the application only the permissions the task needs. Write down who administers the Microsoft environment, who manages the integration keys, which mailboxes and folders are accessible, which systems are read-only and which may be updated. Above all: who can revoke accounts and what happens when the contract ends.

Step 5: start with a limited pilot

An example of a manageable first scope: one shared mailbox, three categories, only categorising and summarising, nothing sent automatically, one process owner and a weekly review. Small enough to oversee, big enough to learn from.

Step 6: arrange management before you go live

Agree who receives alerts, how quickly someone responds, who approves changes, who keeps an eye on costs, who adds new users and how often you review quality. The difference between a pilot and a working system often lies exactly in these agreements.

Step 7: train your people

AI literacy is more than explaining a button. Staff need to know what the workflow does and doesn't do, how errors arise, when to check, how to handle sensitive data and how to report or correct an error. More in AI literacy: what do you need to arrange?.

Who does what? A simple split

Give every activity exactly one person who is ultimately accountable. A workable split looks like this:

• Choosing and accepting the use case: business owner.
• Baseline, test set and quality of content: process expert.
• Design, build and monitoring of the workflow: external AI partner.
• Permissions, accounts and infrastructure: MSP or application management.
• Incidents and changes: the partner carries them out, the business owner decides.
• Exit and handover: business owner, with the partner and the MSP doing the work.

What goes into the contract?

Scope, responsibilities, access, data processing and subcontractors, ownership of code and configuration, documentation, support and response times, how changes are handled, incident reporting, costs and licences. And the exit: how you export data, how access is revoked and what is handed over.

How do you avoid vendor lock-in?

Ask for an architecture document, exportable configuration, the source code or a suitable licence, an overview of all external services, the data model, the prompts and rules, the test set, an operations manual and a list of where each key is stored. Full independence isn't always necessary. Switching should remain practically and contractually possible.

Security without an in-house IT team

"The supplier handles it" is not a security policy. As a minimum, check: limited permissions, multi-factor authentication, separate test and production environments, secure key management, logging, an incident procedure, periodic permission reviews and a backup and recovery plan. For sensitive or business-critical applications, have someone review it independently. See also AI security for SMEs.

An example

A wholesaler without an IT department wants to process order emails faster. Internally, the operations manager is business owner, an order administrator is the process expert and the managing director decides on budget and risk. Externally, the MSP manages Microsoft 365 and the accounts, and an AI partner builds the workflow. The first version reads one mailbox, categorises messages, extracts order fields, flags unknown item codes and prepares a draft order that an employee approves. The wholesaler hires no developers, but does supply test cases, decision rules and weekly feedback.

Next step

Do you have a clear operational problem but no IT team to tackle it? In the AI Opportunity Audit we map process, systems, roles and a manageable first scope together. If you already know what needs to happen, AI implementation takes care of the build and management.