Signing up for ChatGPT or Claude takes a few minutes. Staff can start drafting emails or summarising meeting notes the same day. The harder part comes when the company wants AI to work with its own data: warehouse stock, customer receivables, client documents. At that point the real work shifts from choosing a model to designing the system around it.
This article walks through what has to be in place for AI integration in a company to be safe and genuinely useful. It is written for business owners and managers, with no technical background assumed.
AI as a personal tool, and AI as part of your systems
In many offices, each employee uses AI on their own account, pasting spreadsheet data into the chat and copying the answer back out. For writing tasks, that works. For operational work, the cracks show quickly. Results vary from person to person, customer data ends up in accounts the company does not manage, and there is no record of who asked what.
When AI is part of the company's systems, it works differently. It reads from the official data source, follows existing access rules, and logs every action. An admin at a distributor can ask which orders have been waiting more than three days to ship and get the answer from the order system, with no manual export. The model behind both setups may well be the same. What changes is the layer built around it.
Data and integration with existing systems
AI answers are only as good as the data behind them. Start by mapping your data sources: ERP, accounting software, CRM, document folders, even WhatsApp conversations with customers. Then check their quality. Duplicate product codes, inconsistently spelled customer names, or an outdated SOP will all end up in the AI's answers.
For documents such as SOPs, contracts, and catalogues, the usual approach is RAG (retrieval-augmented generation). The system first finds the relevant passages, then the AI writes an answer from those passages and cites where they came from. Staff can check the source, so nothing rests on a guess.
For operational data, the AI needs to connect to your internal apps and other running systems through APIs. MCP (Model Context Protocol), an open standard Anthropic introduced in 2024, makes this more orderly. Your system is exposed as a set of clearly defined tools, such as "check stock" or "view invoice status", so assistants like Claude or ChatGPT can only use the functions you have made available. Averoa also builds MCP servers and AI agents for this kind of work.
Permissions, privacy, and approval
Once AI is connected to company data, your access rules have to come with it. Warehouse staff do not need payroll data, and the Surabaya sales team has no reason to browse Medan's customer list. The AI should act on behalf of the signed-in user, with the same per-person or per-team permissions as the underlying system.
Personal data deserves extra care. A clinic holds medical records, a notary office keeps copies of ID cards, and a services firm stores clients' tax numbers. Good practice is to mask NIK, NPWP, and phone numbers before any text is sent to a model, and to make sure the model provider does not use your data for training. This fits the intent of Indonesia's UU PDP (Personal Data Protection Law, Law No. 27 of 2022), which in general terms requires companies to protect the personal data they handle.
For actions that change data, such as updating prices, creating invoices, or messaging customers, add a human approval step. The AI prepares a draft, and an authorised person reviews and approves it. Requests, retrieved data, and actions all go into an audit log, so a complaint or internal review can be traced.
Quality, cost, and upkeep
Answer quality should be measured regularly. Collect real questions from staff along with the correct answers, and test the AI against that set before launch and after every change. That way you spot mistakes before your customers do.
Cost needs designing from the start too. Not every task calls for the most expensive model. Sorting tickets or reading invoices often works with a smaller model, while reviewing a long contract needs a stronger one. Caching repeated questions and setting per-user limits keep the API bill predictable.
The models themselves keep changing. New versions arrive, old ones are retired, and answers can drift. A healthy setup monitors errors, response times, and spend, and has a schedule for re-testing. Design the integration so the model can be swapped without rebuilding the application. Keep prompts, rules, and data connections independent of any single vendor, so you can move between Claude, ChatGPT, and Gemini as needs and prices change.
Steps for AI integration in a company
You do not have to build every layer at once. This order is safer and shows results sooner:
- Pick one use case with a clear problem, such as answering stock questions from the sales team or summarising client files at a tax consultancy.
- Run a pilot with real data and a small group of users. Overly clean sample data hides problems.
- Evaluate against measures agreed at the start, such as answer accuracy, time saved, and monthly cost.
- Integrate with your existing systems, complete with permissions, data masking, approvals, and audit logs.
- Expand to the next team or use case, reusing the foundation you have already built.
Data connections, access rules, and test sets from the first use case carry over, so later use cases are much lighter work.
The layer we build
Averoa uses this same layer in its own products. The Etalasse AI assistant manages products, stock, and orders by chat, and Folders gives Claude and ChatGPT folder-scoped access over MCP with audit logs, citations, and NIK/NPWP masking. Sage in Trellis answers questions over each company's own data, kept isolated per company, and Webuilder generates apps from a plain description. We bring the same experience to our AI integration work for clients.
