AI for a Chief Information Officer (CIO) at a $5M to $50M company comes down to 5 jobs: data readiness, governance, vendor selection, a Microsoft 365 Copilot rollout, and connecting AI to the ERP and CRM. Gartner predicted that through 2026, organizations will abandon 60% of AI projects that lack AI-ready data.
The CIO’s office sits under every one of those projects. Copilot Business lists at $21 per user per month, so most of the cost and risk sits in permissions, duplicate records, disconnected systems and unapproved tools.
AI inside the products you sell is covered in AI for the CTO.
The CIO owns the systems AI runs on: the data, the permissions, the vendor contracts, and the connections between the ERP, the CRM and Microsoft 365. At a $5M to $50M company, that’s often 1 person, sometimes an IT director, doing 4 jobs a large enterprise would split across data, security, procurement and operations teams.
The money is moving toward that desk. At Gartner’s October 2025 IT Symposium, CIOs and technology executives said they plan to raise their AI and generative AI budgets by 33% and 32% on average, while overall IT budgets stay mostly flat.
Results are lagging the spend. McKinsey’s 2026 State of AI survey of 1,719 people found close to 90% of organizations use AI in at least one function, 44% say it’s scaling, and only 37% attribute any EBIT impact to it.
The same survey points at the fix. Nearly three-quarters of AI high performers report fundamentally redesigning workflows, against about one-quarter of everyone else.
Workflow redesign lands on the CIO, because every redesigned workflow reads from a system, writes to a system, and needs someone to decide who can see what.
Here’s what that looks like for a 3-person IT team at a $20M company. The hours are planning assumptions from the kind of week I see at this size, so replace them with your own baseline before you budget against them.
| IT task | Hours/week now | With AI | Hours given back | Mechanism |
|---|---|---|---|---|
| Access requests and password tickets | 8 | 4 | 4 | AI drafts the first reply from your IT knowledge base; a technician checks and sends it |
| System documentation and SOPs | 6 | 2 | 4 | Microsoft Copilot drafts the SOP from a recorded walkthrough; the system owner edits it |
| Vendor security questionnaires | 4 | 1.5 | 2.5 | AI fills answers from your last approved questionnaire; a person checks every line |
| Report pulls for department heads | 6 | 2 | 4 | Saved ERP and CRM exports, with Copilot in Excel writing the summary |
| Monthly access review | 3 | 1 | 2 | AI compares each system’s user list to the HR roster and flags mismatches |
| Total | 27 | 10.5 | 16.5 |
16.5 hours a week is close to half of one IT role given back. At $54.00 an hour over 48 weeks, that’s $42,768 a year in capacity, and every task on the list clears my 20% rule (if AI would give back less than 20% of a task’s time, cut the task).
The math on the IT table
Your data is ready for AI when the 1 or 2 systems a workflow touches have a named owner, permissions that match job roles, few duplicate records, and an API or export the AI tool can reach. Gartner found 63% of organizations lack the data management practices AI needs, or don’t know whether they have them.
Gartner’s prediction from the same 2025 release is blunt: through 2026, organizations will abandon 60% of AI projects that aren’t supported by AI-ready data.
At this size, the trouble usually looks like a CRM with 3 versions of every customer, a shared drive where “Final_v7” sits next to “Final_v8”, and an ERP that only 1 person knows how to export from.
I run this check on each system before any AI tool gets pointed at it. A system needs 4 of 5 passes to go first.
| Check | Pass | Fail |
|---|---|---|
| 1. Named owner | One person can approve changes to the data and the access | “IT owns it” or no one can say |
| 2. Permissions match roles | Access is granted by group, and the last review is under 12 months old | Individual shares, “everyone” links, former staff still listed |
| 3. Duplicates under control | A sample of 100 customer or vendor records shows fewer than 5 duplicates | Duplicates found in the first 20 records |
| 4. Retention rule exists | Old files and records get archived or deleted on a written schedule | Nothing has ever been deleted |
| 5. Reachable | The system has a documented API or a scheduled export | Data leaves only through a person copying and pasting |
The scorecard takes about 2 hours per system. Score your 3 most-used systems and you have a ranked list of where AI can start.
The common advice is to build a data warehouse or clean every system before any AI goes live. I recommend against it at $5M to $50M.
A company-wide cleanup takes 9 to 12 months, delays every result, and scrubs data that no AI workflow will read for years. Meanwhile the team loses patience and starts pasting data into free tools.
Clean the system the first workflow reads. Then the next one. After 3 or 4 workflows, the systems that matter are clean and the ones that don’t stay as they are.
At a $5M to $50M company, an AI governance framework fits in 4 documents: an approved tools list, a data classification saying which data can go into which tool, an inventory of every AI tool and connection, and a monthly review owned by 1 named person.
Governance is the gap even at bigger firms. Gartner’s 2025 survey of 360 IT application leaders found only 13% strongly agree their organization has the right governance structures for AI agents.
Ungoverned AI is a liability wearing a productivity costume. The 4 documents are how you take the costume off.
| Document | What goes in it | Owner | Review |
|---|---|---|---|
| Approved tools list | Each AI tool, the license tier, who may use it, and for what | CIO or IT lead | Monthly |
| Data classification | 3 or 4 levels (public, internal, confidential, regulated) and which tools may touch each | CIO with finance and HR | Twice a year |
| AI inventory | Every tool, connection, service account and data source, with an owner and a review date | IT lead | Monthly |
| Monthly review | Usage by tool, incidents, new requests, seats to cut | CIO, with 3 to 5 department heads | 30 minutes monthly |
The written policy staff sign is a separate piece of work. My team builds those under AI policies and compliance.
Agents need more than this list covers, because they act inside your systems with their own permissions. I cover identity, monitoring and the agent inventory in AI Agents for the CIO.
Roll out Microsoft 365 Copilot in 3 steps: fix oversharing in SharePoint, OneDrive and Teams first, pilot with 10 to 20 named users tied to specific workflows, then expand only the seats that show weekly use. Copilot answers from everything a user can already open, so a folder shared with the whole company 4 years ago becomes searchable on day one.
Gartner’s 2025 Microsoft 365 and Copilot survey of 187 IT leaders found 40% of organizations piloting Copilot and another 19% planning to. Of those that had finished a pilot, only 5% were moving to a larger deployment in 2025.
The same survey named oversharing, content sprawl and data loss as the main risks. Gartner said the effort to reduce those risks was far greater than most organizations planned for, which pushes up total cost of ownership.
Microsoft’s own deployment guidance for securing Copilot, last updated August 2026, organizes the fix into 3 pillars: remediate oversharing, set up guardrails, and meet regulations. It says SharePoint Advanced Management is included with a Copilot license, so check your tenant before you buy anything extra.
Gartner’s analyst also pointed out that Microsoft’s default adoption measure counts a user as active after 1 use in 28 days. That’s too low to tell you anything.
Track weekly active use per named workflow. If a seat has no workflow attached and no use for 60 days, cut it.
Here’s the license math for 100 seats.
Six minutes a week is a low bar for anyone who uses the tool. The costs that hurt are seats no one opens and the oversharing cleanup you didn’t budget for.
At the enterprise list price of $30 per user per month on an annual plan, the same 100 seats cost $36,000 and break even at about 8 minutes a week per seat.
I’ve watched the unused-seat problem play out at a Tier 1 automotive supplier I work with. Copilot seats were bought, staff were never trained, usage stayed low, and the company’s Microsoft spend dropped by roughly $100,000 a month as the licenses were cut.
The fix in that kind of case is training and a named workflow for every seat, decided before the purchase order goes out.
Connect AI to your ERP and CRM through each system’s API, using a dedicated service account limited to the fields the workflow needs, and start read-only. MuleSoft’s 2025 benchmark of more than 1,050 IT leaders found 81% call data integration one of their biggest AI challenges, and only 2% have connected more than half their apps.
The same report counted an average of 897 applications per enterprise. A $20M company runs far fewer apps, and most of them still don’t share data with each other.
I connect in 3 stages, and each stage has to work for 30 days before the next one starts.
Start with the AI already built into the system. HubSpot and GoHighLevel both include AI features, and using them adds no new data flows to govern.
When 2 systems need to talk, Zapier or Make.com handles most simple cases. When you hit their ceiling (volume, complex logic, or error handling they can’t express), I write custom Python middleware, because it can retry, log and alert in ways no-code tools can’t.
Every connection needs error handling. If a sync fails at 2 a.m., a named person should get the alert, and the failure should land in a log the AI inventory points to.
Here’s stage 2 at a business services company that runs Salesforce as its CRM and Microsoft Dynamics 365 Business Central as its ERP. An AI assistant compares each closed-won opportunity with the customer and order records, flags missing details, and prepares a draft sales order for operations to approve.
The numbers assume 40 orders a week, so swap in your own volume.
| Order handling | Per order | Per week (40 orders) |
|---|---|---|
| Before: checked and entered by hand | 15 minutes | 10 hours |
| After: review and approve the AI’s draft | 6 minutes | 4 hours |
| Given back | 9 minutes | 6 hours |
That’s 60% of the task’s time back, 3 times the 20% rule. At $54.00 an hour over 48 weeks, 6 hours a week is worth $15,552 a year in capacity.
The operations team puts those hours into resolving order exceptions and coordinating customer onboarding.
Choose an AI vendor by scoring 6 things in writing before the demo: where your data is stored and whether it trains their models, admin controls and audit logs, how it connects to your current systems, exit terms, 3-year total cost, and how it handles errors. Gartner found only 19% of IT application leaders have high confidence in their vendor’s hallucination protection.
My default is the AI inside the tools you already pay for. Microsoft Copilot, HubSpot and GoHighLevel already sit inside your permissions model, and each new vendor adds a contract, a data flow and a line in the inventory.
When a new vendor is the right call, I send these questions before anyone sees a demo.
| Question | Why it matters | A good answer |
|---|---|---|
| Does our data train your models? | Your data could surface in another customer’s output | No, in writing, in the contract |
| Where is our data stored, and for how long? | Retention drives legal and audit exposure | A named region and a deletion period you can set |
| What admin controls and audit logs do we get? | You can’t govern what you can’t see | Per-user access, exportable logs, single sign-on |
| How does it connect to our ERP and CRM? | Custom work raises cost and failure points | A documented API or a native connector |
| How do we leave? | Lock-in turns a pilot into a permanent cost | Full data export in a standard format within 30 days |
| What does it cost over 3 years at our expected seat count? | Year 1 pricing often expires | A written 3-year quote |
Score each answer 0, 1 or 2. Anything under 8 out of 12 doesn’t go to a pilot.
Then run the numbers. The AI ROI Calculator shows whether the hours a tool gives back cover its 3-year cost.
Ordered people first, then process, then tech. Each step names who does it and what it produces.
Days 1 to 30: people
Days 31 to 60: process
Days 61 to 90: tech
I’m Lee Pomerantz, Certified Chief AI Officer, founder of eMediaAI, Fort Wayne, Indiana. I work with leadership and IT teams at $5M to $50M companies, and every engagement runs in one order: people first, then process, then tech.
The AI Opportunity Blueprint™ is where it starts. It’s a 10-day, $5,000 forensic audit: your staff record the tasks, I map where the hours and the data go, and you get a prioritized workflow map, an ROI projection, an implementation roadmap and governance recommendations.
For a CIO, the Blueprint doubles as the readiness check. It shows which systems can carry AI now and which need cleanup first.
If a task returns less than 20% of its time, the report says cut it. If the numbers don’t hold, it says don’t build.
Microsoft 365 Copilot Business costs $21 per user per month, a price Microsoft announced in December 2025 for smaller organizations, and the enterprise version lists at $30 per user per month on an annual plan. For 100 seats, that’s $25,200 or $36,000 a year. The larger cost is usually the permission cleanup before rollout and the seats that go unused after it.
One named person should own AI governance in a mid-sized company, usually the CIO or IT lead, backed by a committee of 3 to 5 department heads that meets for 30 minutes a month. The owner keeps the approved tools list and the AI inventory current. The committee reviews usage, incidents and new tool requests, and decides which seats to cut.
AI data governance is the set of rules deciding which data each AI tool may read, who can see the results, and how long that data is kept. At a $5M to $50M company, it usually means a 3 or 4 level data classification (public, internal, confidential, regulated), permissions granted by group, and a written retention schedule. Gartner found 63% of organizations lack AI-ready data practices or aren’t sure.
An AI acceptable use policy should name the approved AI tools, say which data classes may go into each one, require a human review of AI output before it reaches a customer or a financial record, and explain how to request a new tool. Most mid-sized companies fit this on 2 pages. eMediaAI writes these policies as part of its AI policies and compliance work.
Measure the ROI of AI against a baseline taken before rollout: hours per task per week, multiplied by a loaded hourly rate, minus license, setup and training costs. The BLS put full-time private industry compensation at $54.00 an hour in June 2026. A team getting 16.5 hours a week back over 48 weeks gains $42,768 a year in capacity at that rate.
Plan for a first AI rollout to take an IT lead about 4 to 6 hours a week for 90 days at a $5M to $50M company. That covers scoring 3 systems with a readiness scorecard (about 2 hours each), writing 4 governance documents, cleaning up oversharing before a Copilot pilot, and a 30-minute monthly review. Department staff each spend a few hours recording tasks and joining a 2-hour training.
The biggest risks of rolling out AI across business systems are oversharing, unused licenses, and broken connections that fail without anyone noticing. Copilot answers from every file a user can open, so stale shares expose confidential data. Gartner’s 2025 survey found risk work cost far more effort than planned. Fix permissions first, cut seats idle for 60 days, and route every sync failure to a named person.
A CIO’s first AI move is a one-page note to staff explaining what AI is for and where the hours it gives back will go, followed by naming 1 owner for AI governance. Next, score the 3 most-used systems on a 5-check readiness scorecard and pick 1 workflow on a system that passes. Pilot it with 10 to 20 named users and report hours at day 90.
An AI readiness assessment checks whether a company’s data, systems, permissions and staff can support a specific AI workflow, and prices that workflow before anything is built. eMediaAI’s AI Opportunity Blueprint™ is a fixed $5,000, 10-day assessment that delivers a prioritized workflow map, an ROI projection, an implementation roadmap and governance recommendations. Any task returning less than 20% of its time gets cut before a build.
Book a free 20-minute call to see if the AI Opportunity Blueprint™ is right for you.
Book Your Call
© 2026 eMediaAI.com. All rights reserved. Terms and Conditions | Privacy Policy
