Three mistakes companies make when adopting AI, and what to do before you start

Three mistakes in adopting AI at a company are all paid for later: AI comes in without processes or orderly data; the vendor chooses the technology, selling what it knows rather than what you need; the lawyer arrives once the project is finished, when fixing things means rebuilding them. Each one can be avoided with a single move made before you start.

They are the three charges in the first episode of Innovazione Sotto Processo ("Innovation on Trial"), the technology and law podcast I host with Armando De Lucia, a lawyer specialised in IT law. I bring the view of the people who build systems, he brings the view of the people who answer for them. The episode is called L'AI in azienda: quando sbaglia, chi risponde? ("AI at work: when it gets it wrong, who is accountable?"), it came out on 1 November 2026 and runs 37 minutes. This article covers what a business owner can take back to the company the next day; the full reasoning, with Armando's legal perspective, is in the video, in Italian.

Why doesn't AI work in a company without processes and data?

Because AI carries out a piece of work, and if nobody can describe that work there is nothing to carry out. Many small businesses have no written job descriptions: nobody has written down who does what, who approves, where a document ends up. Things work because people remember them. Putting AI on top of a process that lives only in the heads of the people who run it is like attempting a double piked somersault without ever having trained.

The figure quoted most often on this topic, which we also quoted in the episode, comes from MIT NANDA: in the preliminary report The GenAI Divide: State of AI in Business 2025, published in summer 2025, 95% of the organisations analysed had not obtained a measurable ROI from their generative AI pilots (a summary here). The figure doesn't say AI doesn't work: it says those pilots did not produce an ROI anyone managed to measure. I wrote a separate guide on how to estimate the ROI before you start.

What data should never go into a chatbot?

Personal data about employees and customers, starting with payslips. In the episode I talk about business owners who upload their employees' payslips into an AI assistant: it is convenient, but a payslip contains another person's personal data, and the company answers for where that data ends up. It is the clearest sign of a company that has not yet set itself rules on data. The list of what to keep out of public tools is in this article.

Is "we're still testing" still an excuse?

No. In the episode the answer is clear: the experimentation phase is over. The AI Act, that is Regulation (EU) 2024/1689, is European law, and Italy also has a national AI law, Law no. 132 of 23 September 2025. A company that has been using AI in its processes for months is no longer trying it out: it is using it, and it answers for it like any other work tool.

What to do in practice

• Before choosing a tool, choose a process and write down who does what, with which documents and with which hand-offs. One page is enough. If you don't know which process to start from, here is how to spot it.
• Ask yourself which problem the AI has to solve and which processes it applies to. If you can't answer in two lines, it is not yet time for the tool.
• Decide in writing which data never goes into public AI tools, starting with employee and customer data, and tell your people.

How do you choose the right vendor for an AI project?

Start from a question Armando put on the table, one worth asking out loud: is the vendor offering me the solution it knows, or the one my company needs? The two coincide less often than it seems. Anyone who has worked with a platform for years tends to see that platform in every problem.

On the technical side, the signal I look at is the range of alternatives. Today a company can use a cloud model through a large provider's API, meaning it connects its own software to a model running on someone else's servers. But it can also run AI locally, or use open-weight models, meaning models whose weights are published, on machines that stay under its own control. There is no single right answer: it depends on what data you handle and on how much it would cost you to see it leave the company. That is why I am wary of anyone who, whatever the problem, only proposes "let's just plug into the API": it means the most delicate choice, where your data goes, has already been made for you without being discussed. When it makes sense to keep AI in house, and what it costs, is covered in my article on on-premise AI.

What to do in practice

• Ask every vendor for at least two different routes to the same problem, and why they recommend one.
• For each route, ask where the data ends up, who can see it and where the machines are.
• If the only proposal is to connect to an external model's API, ask what would change with a local model. If they can't answer, you already have your answer.

The other questions to ask a consultant, with the warning signs, are in this guide.

Who do you need on an AI project team?

Fewer developers than before, and roles that used to be missing. In my experience a project today needs about half the engineers it needed two years ago, thanks to vibe coding, that is AI-assisted development, used with care. This is not a statistic: it is what I see in the projects I work on.

Alongside the developers, though, you need two roles. The first is the business analyst, who understands the process before anyone writes a line of code. The second is the legal tech engineer, who brings the law into the development team: that way the question "can we do this?" comes up while changing course is still cheap, not once the project is finished. I wrote about this role in May, calling it the legal tech analyst: here it is described in full.

When should a lawyer join an AI project?

At the start, together with the technical team. The third mistake is calling the lawyer in at the end, once the project is finished, for a compliance check. In the episode, lawyer Armando De Lucia explained how a legal review done at that point works: every element of the project gets a green, amber or red alert, and a red can force you to rebuild part of the project, or reveal that what you have built, as it stands, is not allowed in the European Union.

What is the real cost of a late legal review?

It is not the fine: it is rebuilding the project. And Armando added another one: if the company is looking for investors, in due diligence, the review an investor carries out before coming in, a non-compliant system weighs as a risk, and it can be enough to make them walk away.

What to do in practice

• Involve whoever handles the legal side during analysis, not during acceptance testing: that is when you decide what data the system collects and what it does with it.
• Ask the vendor who on their team answers the question "can we do this?", and at what stage of the project.
• Put the legal review in the budget from the start: it costs less than a red alert discovered at the end.

Where should a small business start to adopt AI without these mistakes?

With the three moves, in this order:

None of the three requires buying a tool.

In the episode every charge has two voices: I explain how a system gets built, Armando explains what happens when something goes wrong. The first charge starts at minute 4:55, the second at 13:26, the third at 27:20. The episode is on YouTube and Spotify, where you will also find the podcast's show page; the website is innovazionesottoprocesso.it. All episodes are in Italian.

One caveat, the same one that comes with the episode: this article is general information and is not legal advice on your specific case. More articles on how AI really gets into a company are in the AI Adoption hub.

Frequently asked questions

What are the most common mistakes when a small business adopts AI?

Three come up more than the others. The first is introducing AI without defined processes or orderly data, when nobody in the company has written down who does what. The second is leaving the choice of technology to the vendor, who tends to offer the solution it knows rather than the one you need. The third is involving a lawyer only once the project is finished, when a compliance problem can force you to rebuild part of the work. These are the three charges in the first episode of the podcast Innovazione Sotto Processo.

How do you choose an artificial intelligence vendor?

By asking for more than one route. A serious vendor can offer different solutions to the same problem, for example a cloud model through an API, AI running locally or an open-weight model on machines the company controls, and can explain where the data ends up in each case. If the only proposal is to connect to an external model's API, the most delicate choice, where the data goes, has been made without discussing it with you.

When should a lawyer be involved in an AI project?

From the start, during analysis, together with the technical team. According to lawyer Armando De Lucia, a legal review done once the project is finished gives every element a green, amber or red alert, and a red can force you to rebuild part of the project or reveal that what has been built is not allowed in the European Union. The real cost is not the fine: it is redoing the work and, for companies looking for investors, the risk of losing them during due diligence.

What is Innovazione Sotto Processo?

It is a technology and law podcast in Italian, hosted by Gaetano Castaldo, a computer engineer and the founder of Castaldo Solutions, and Armando De Lucia, a lawyer specialised in IT law. Its tagline is "Mettiamo l'innovazione alla sbarra, prima che ci finisca qualcuno" (we put innovation in the dock before somebody else ends up there): in every episode a technology takes the stand, seen by the people who build systems and by those who answer for them. The first episode, "L'AI in azienda: quando sbaglia, chi risponde?", came out on 1 November 2026 and runs 37 minutes.