Perspectives & Newsroom

AI Governance in Italian SMEs: why an AI assessment is essential before starting any project

Introduction

Many Italian SMEs face the same challenge today. Someone in the company uses ChatGPT to write emails. The marketing team experiments with an AI tool for content creation. A salesperson tests a sales enablement platform. All of this happens without coordination, without shared data, and without anyone taking responsibility for the outputs generated.

The point is not whether AI will enter the company. It already has—often through the back door. The real issue is that it is being adopted without governance. And that, more than a missed opportunity, is a tangible risk.

The biggest barrier to AI adoption in SMEs is not the algorithm itself. It is the maturity of data, processes, security practices, and internal ownership. That is why, before launching any AI initiative, a thorough assessment is essential: to understand where the company is ready, where it is not, and which use cases can truly deliver measurable value.

IN SUMMARY
AI governance in an SME does not mean slowing down AI adoption. It means creating the conditions to use it safely, effectively, and with clear priorities. An AI Assessment provides the diagnosis needed to start with the right use cases, rather than investing in disconnected tools that are not aligned with real business processes.

Why AI has become a priority for Italian SMEs

The artificial intelligence market in Italy reached a value of €1.8 billion in 2025, marking a 50% increase compared to 2024 (Artificial Intelligence Observatory, Politecnico di Milano). While much of this growth has been driven by large enterprises, AI has now become a strategic topic for businesses of every size.

The gap between large companies and SMEs, however, remains significant. In 2025, 71% of large Italian enterprises had launched at least one AI project, compared to just 8% of small and medium-sized businesses (AI Observatory, Politecnico di Milano). The most concerning figure relates to preparedness: according to the 2025–2026 Digital Innovation in SMEs Observatory by the Politecnico di Milano, 76% of Italian SMEs have not invested and do not plan to invest in artificial intelligence, only 7% have implemented structured AI training programs, and 47% have not carried out any Research & Development activities in the past three years.

So why is AI becoming such a prominent topic among SMEs as well? Because of three converging pressures.

Competitive pressure
Large enterprises are building a significant operational advantage. Companies that stand still are not losing ground tomorrow—they are losing it today in terms of response times, operating costs, and service quality.
Pressure on margins and productivity
Labour costs, energy prices, and increasing operational complexity continue to erode margins. When applied effectively to repetitive tasks, AI can deliver measurable reductions in both time and errors.
Skills shortage
Finding and retaining qualified talent is becoming increasingly difficult. Automating low-value activities allows key employees to focus on higher-impact work and strategic priorities.

WHAT THIS MEANS FOR SMEs
There is no need to replicate what large enterprises are doing. The key is to identify two or three use cases that can generate tangible returns within the next six months, leveraging the data, processes, and resources the company already has in place today.

The risk is not failing to adopt AI, it’s adopting it without governance

The most common mistake SMEs make is not standing still. It is launching AI initiatives based on the wrong use cases, with poor-quality data and no one accountable for managing the process. Here are the most significant risks.

Shadow AI. Employees use personal AI tools to support their work. Company data ends up on uncontrolled platforms, often without management even being aware of it.
Uncontrolled Data. ERP systems, CRMs, business applications, and spreadsheets operate in silos. Applying AI to fragmented data inevitably leads to unreliable results.
Unverified Outputs. Without a structured review process, AI generates content, analyses, and figures that may be used without proper validation.
Unclear Accountability. When an AI-generated output is wrong, who is responsible? Without clearly assigned internal ownership, accountability becomes blurred.
Security and Privacy Risks. AI increases the number of potential data exposure points. Cybersecurity in Italy is now a strategic business issue, not merely a technical concern.
AI Act Compliance. European regulations make it essential to maintain control over data, responsibilities, and risk management processes (a topic we will explore shortly).
Tools Without a Roadmap. Companies accumulate licenses and AI tools without achieving meaningful process improvements. Costs increase, while business value remains unchanged.

This is not a theoretical problem. According to McKinsey’s The State of AI 2025, around 88% of organizations use AI in at least one business function, yet nearly two-thirds are still in the experimentation or pilot phase, and only about one-third have successfully scaled AI across the organization. Moreover, only 39% report a tangible impact on business performance and financial results.

The gap between organizations that experiment with AI and those that generate real value from it is almost always a matter of data quality, process maturity, and governance—not technology.

AI Governance means putting AI into practice, not slowing it down

There is one misconception that needs to be addressed right away. Governance does not mean bureaucracy, committees, or endless forms to sign. It means creating the conditions to use AI in a way that is secure, measurable, and scalable.

Effective AI governance for an SME is built on five key dimensions.

Strategy and Priorities. What business objectives do we want to achieve through AI? Which two or three use cases should take priority over all others?
Data and Systems. What data do we have, where is it stored, how reliable is it, and how effectively do our systems communicate with one another?
Processes and Use Cases. Which processes consume the most time, generate the most errors, or limit growth? These are typically the areas where AI can deliver the greatest value.
Security, Compliance, and Risk Management. Data protection, access control, AI Act compliance, and oversight of AI-generated outputs are essential components of a responsible AI strategy.
Skills, Ownership, and Change Management. Who owns each use case? Who is responsible for training employees? Who measures outcomes and tracks performance?
Application Integration and Information Flows. How effectively do the CRM, ERP, business management systems, and other applications share data? AI creates value when it can access reliable information distributed across the entire business process landscape.

IN SUMMARY
Governance is not a barrier to AI adoption. It is the foundation that enables AI to evolve from an occasional experiment into a tool that delivers continuous, measurable, and controlled business value.

Where AI can create value for SMEs

Business value does not necessarily come from complex AI projects. More often, it comes from reducing manual work and providing visibility into data that is currently fragmented across the organization. Here are some of the most practical opportunities by industry.

Manufacturing

Integration between ERP, MES, and spreadsheets, operational dashboards, production forecasting, and anomaly detection. The real challenge is rarely the algorithm itself, it is the quality and consistency of data across different systems. See also: data analytics and systems integration.

Machinery and Industrial Equipment

Sales intelligence, AI-powered technical knowledge bases with RAG (Retrieval-Augmented Generation), document automation for quotations and technical documentation, and support for service and spare parts management. In many cases, the most valuable data is not found on the shop floor but within quotations, customer history, and after-sales activities.

Food & Beverage

Demand and inventory forecasting, sales and profitability dashboards, and back-office automation. The challenge is often not increasing sales, but improving forecasting accuracy before deviations become costly problems.

Logistics & Transportation

Document automation, AI assistants for customer service, operational dashboards, and anomaly detection. The quickest returns typically come from reducing manual work across orders, documentation, tracking, and customer support processes.

Wholesale and Distribution

Sales intelligence, inventory forecasting, customer segmentation, and integration between ERP, CRM, and e-commerce platforms. The issue is rarely a lack of data—it is understanding which customers and products actually generate profitable growth.

Professional Services

Knowledge management with AI and RAG, document automation, and project reporting. The most valuable asset is internal knowledge, which is often trapped in files, emails, and the expertise of key individuals.

Other sectors that may benefit significantly from AI, depending on their specific context, include private healthcare (with particular attention to privacy and sensitive health data), construction and engineering (cost control and project management), utilities, and financial services. Across nearly all of these industries, the first step is the same: securing data, systems, and access controls before expanding into new AI use cases.

WHAT THIS MEANS FOR SMEs
The goal is not to choose the most innovative or cutting-edge application of AI. The goal is to identify the areas where technology and AI can reduce costs, save time, or minimize errors in a measurable way—leveraging the data that already exists within the organization.

What a serious AI Assessment should evaluate

An assessment that delivers real value is not just a questionnaire—it is a structured diagnostic process. Here are the key areas it should cover.

Mapping Critical Processes. Identifying which processes consume the most time, generate the most errors, or create bottlenecks that limit business growth.
Data and Systems Analysis. Understanding what data exists, where it is located, how reliable it is, and how effectively different systems are integrated.
Identification of Applicable AI and Automation Use Cases. Determining which AI and automation opportunities are genuinely relevant and feasible within the organization.
Governance, Security, and Compliance Assessment. Evaluating governance frameworks, cybersecurity measures, regulatory requirements, and compliance with the AI Act.
Prioritization Based on Impact, Feasibility, and Risk. Not all use cases deliver the same value. A proper assessment ranks opportunities according to their potential business impact, implementation effort, and associated risks.
90-Day and 6-Month Roadmap. Defining a practical roadmap with clear milestones, achievable objectives, and measurable outcomes.
Actionable Recommendations. Providing concrete operational guidance rather than high-level principles or generic best practices.
Quick Wins and Strategic Initiatives. Clearly distinguishing between short-term opportunities that can generate immediate value and more structured projects that require longer-term planning and investment.

From experimentation to a roadmap

The outcome of an assessment should not be a theoretical report that ends up archived and forgotten. It should be an actionable roadmap, supported, when necessary, by the proper management and integration of business systems. For each priority use case, the following elements should be clearly defined:

The use case and its business objective
The internal owner responsible for its success
The data required and where it can be sourced
The technologies involved
The risks that need to be managed
The KPIs used to measure business impact and return on investment
The next concrete steps to move forward

This is the difference between a company that merely experiments with AI and one that successfully deploys AI into production with clear governance and accountability.