The AI-ready enterprise: modernising ERP, customer experience and cyber resilience

For mid-market firms, AI is no longer limited to promising pilots and interesting experiments. Today, it is increasingly embedded across core workflows, systems and functions – and delivering real productivity and decision-making improvements. But as firms shift pilots into production they often face a difficult question: do they actually have the right operating model to maximise the value of AI?

How they answer it often determines whether or not they’re able to successfully scale the technology across the organisation. Indeed, the real divide now is not between companies that are experimenting with AI and those that aren’t. It is between those that are prepared to fundamentally redesign the business around AI, and those that simply bolt it onto existing processes.

Chris Howarth, CEO of Avanade, helps enterprise and mid-sized organisations — particularly those with revenues between US$300mn and US$5bn — to scale with practical AI, cloud and intelligent operations.

“There are companies now that are fully embracing the fact that this technology is not about just buying something and implementing it in the organisation. It is actually about designing your organisation with AI in mind, and then creating the unique use cases. When organisations adopt that approach they’re going to get to a different place in terms of scaling AI.”

Most firms, he argues, have now moved beyond the pilot phase. “They understand what’s working and what’s not and what that means,” he explains. “But to decide you are going to re-orientate your organisation around AI, that is a big decision that takes focus and must be made collectively.”

Fixing the foundations

Regardless of ambition, meaningful AI adoption depends on getting the underlying data infrastructure right. Poor data quality, siloed systems and inconsistent access can hugely undermine trust in AI outputs and slow adoption among employees. Firms do not need to solve every data challenge at once though, says Howarth. “But if you’re serious about implementing it AI in an area of your business, you really need to invest in getting the data correct so that you’ve got a very, very strong foundation for decision-making.”

Microsoft’s cloud-based Intelligent Data Platform can help firms tackle data fragmentation by unifying databases, analytics, and governance into a single, integrated cloud ecosystem, providing the foundation they need to expand AI across the organisation. But there’s also the challenge of legacy ERP and CRM systems.

Put simply, these systems were designed to be static data repositories and therefore tend to struggle with the real-time access demands of AI. Nevertheless, Howarth does not fully subscribe to the view that they are suddenly obsolete: it’s more that their role is evolving.
“Some of the historical decisions around core legacy systems, predominantly CRM and ERP, can limit the amount of value you can get from surrounding them with agents,” he explains. However, cloud-native solutions “are very well set up for what is needed.”

When firms are modernising ERP and CRM systems, they should also consider their ability to incorporate further advances in AI. As Howarth says, “They need to think through how that system will interact with the agentic world we understand today, but also what we don’t understand today, so making future-proof choices will be key.”

He points out that many firms have already spent years reducing tech debt. “They don’t want to end up thinking in another five years ‘how do I now remove all of this tech debt again?’ They want to get it right from the beginning.”

Many firms also need to overhaul their security and governance processes to successfully scale AI. In fact, security and governance concerns are often one of the most pressing barriers to scale today.

“It’s a genuine concern, as organisations are rightly cautious about how their data is exposed, and vulnerabilities they may or may not bring into the organisation, and waves and waves of potential shadow IT” says Howarth. “When companies turn on these tools and suddenly see they’ve got thousands of agents, they can get very, very nervous very quickly.”

As such, “The single biggest factor in organisations that are starting to scale and starting to re-engineer the business around AI is that they’ve at least got a base camp of security, privacy and control in place. Your data is super important, and to protect that data you need to be comfortable that what you’re doing is safe and secure.”

The steps to success

Strong security and governance around AI can also give mid-market firms the confidence to be more ambitious with their strategy. “If you just layer AI onto existing workflows, you’re only going to get so much benefit,” says Howarth. “These benefits can be incredible on an
individual level, and they can contribute to a process improving quickly. But if AI is effectively augmenting the individuals and the process you have in place, you’ll only get so far.”

The larger opportunity lies in true process redesign. “We truly believe that this technology gives you the opportunity to completely redesign and rethink your entire business process,” says Howarth. “That’s when you’re going to see the really dramatic changes.”

Avanade sees three major pivots along the journey to transformation: from individual productivity improvements, to AI agents with humans in the loop, and finally fully autonomous execution of tasks. This last stage demands the biggest changes to existing processes. “You’re having to completely rethink not just the process that you’re trying to get to a level of autonomy on, but every process that sits around it,” Howarth explains.

While this is challenging, it’s also the key to generating maximum value from AI. Indeed, mid-market firms that achieve this level of automation can extend their reach and capabilities in ways that allow them to punch above their weight in the market. Take the sales function, for example, where AI can put more what customers want in front of them without increasing headcount.

As such, the technology is not just about being more efficient internally. “It’s about how you take more coverage to market,” Howarth notes, “so it’s a growth topic, not just an efficiency one.” He adds that Avanade is now working with companies not just on autonomous selling, but also autonomous purchasing, “which kind of blows your mind in terms of machine-to machine interaction.”

However, none of this is possible without genuine leadership commitment to AI-focused redesign. “Our ultimate indicator of success is that these changes are CEO-led,” says Howarth. “If it’s not on the CEO’s agenda, we don’t really feel like it’s going to be successful.”

Avanade’s approach

Avanade helps mid-market firms across the entire AI implementation lifecycle, from readiness assessments to agent design. It also provides packaged, modular solutions offering greater speed, outcome predictability and cost efficiency – something that’s vitally important for organisations managing tighter IT budgets.

Rather than conventional implementation programmes, the company focuses on delivery models that are more suited to the nature of AI transformation. “Some organisations may say ‘we don’t know exactly what we need around this process, but we know what we want the outcome to be,’” Howarth explains.

Avanade’s AI Transformation Studio enables it to run a creative process with that firm, ultimately putting the necessary skills and resources and proven solutions around that process to reach the desired outcome. “It’s not like a normal ERP or CRM implementation where you can plan it from day one to the end,” says Howarth. “It’s much more fluid in terms of how you get there.”

Avanade’s “hand-in-glove” working relationship with Microsoft and deep knowledge of its ecosystem can also act as an accelerator for a firm’s AI ambitions. “Everyone’s comfortable using Teams. Everyone is comfortable using a prompt on a Copilot – it’s so intuitive. If you’re then able to do things that are very unique to your organisation through that interface, that’s better than feeling like you’re in a really different environment.”

Rather than simply implementing Microsoft products, Avanade is also working alongside them during the engineering phase, so that when new AI tools are released, “we’re able to scale them fast”. While Microsoft is obviously focusing on building out broad, horizontal AI capabilities, Avanade is primarily focused on how new solutions will serve needs across business functions like finance and procurement, thereby completing the picture for its customers.

When asked for some closing advice for leaders, Howarth simply says: “Be bold. Think of what area of your business you think you can get the biggest return from and focus on that. But once you’ve made the decision, accept that you’re going to need to transform and re engineer it.”

The gap between what mid-market firms want to achieve with AI and what it delivers is rarely due to not having the right model. False advertising isn’t the issue either: it’s clear that AI can enhance operations in a variety of ways and improve organisational productivity and decision-making. But when it comes to scaling the technology, governance shortcomings often stop promising projects in their tracks.

Today, data is frequently distributed across departments, defined inconsistently and governed informally. Access controls are set once and rarely revisited. Data lineage is also murky, undermining confidence in AI outputs and potentially increasing exposure to regulatory and reputational harm.

If the data feeding models aren’t accurate and traceable – and protected with strong access controls – scaling can seem more of a liability than an opportunity. This inevitably leads to promising pilot projects being mothballed once governance concerns come to the fore, rather than progressing to production.

“Mid-market ambition can easily be killed by chaos in your business data and a lack of a robust, mature AI security strategy,” says Scott McKinnon, field chief security officer UK&I at Palo Alto Networks. “Because security at these mid-market firms is often ad hoc and siloed, AI pilots are frequently unmanaged with little to no security guardrails. This lack of control acts as a brake on ambition by encouraging an overly conservative, ‘department of no’ approach.”

Data published by Stanford’s Human-Centered AI Institute shows that 74% of organisations cite inaccuracy as their top AI risk, indicating data quality and governance problems across a wide range of companies. Some firms may be trying to apply traditional data governance thinking to AI, but often well-established practices don’t translate to the new reality.

“Data governance enables organisations to understand where data comes from, trace lineage and fix issues when something goes wrong,” says Peter Manta, AI practice leader at Informatica from Salesforce. “AI, however, doesn’t behave in the same way.”

When a model learns something, it can’t really unlearn it. “So if, for example, it’s picked up something it shouldn’t have, it doesn’t have a clean way to roll that back. And this could cascade quickly if not managed properly.”

Shadow AI – and now shadow agents – has also demonstrated the need for robust governance. “Staff are using ChatGPT, Copilot and similar tools to draft client communications, summarise meetings and generate reports,” says Shaun Hurst, principal regulatory adviser at Smarsh. “In a regulated firm, that’s both a records management problem and a supervision problem. If those interactions aren’t being captured and retained, you have a compliance gap that may not be visible yet.”

Larger organisations are often better equipped to address fragmented and inconsistent data sources, unclear ownership and gaps in access controls or permissions than mid-market firms. “Their issue is in many ways bigger than that faced by large enterprises because they lack the legal, risk and IT specialists as well as the staff training budgets needed for compliance,” says Simon Gooch, field CIO at Saviynt. “It’s like they have a ‘Polo mint problem’: they can do all the perimeter work but there can still be a hole in the middle.”

Building good governance

Given all the issues that need to be addressed, the instinct to treat AI governance as a parallel structure, separate from existing frameworks, is understandable. But George Tziahanas, AGC and VP of compliance at Archive360, believes this is the wrong approach. “If an enterprise builds a parallel structure just for AI, the organisation risks fragmenting how it operates,” he explains. “The smarter path is to extend the governance frameworks already in place.”

Firms can then layer on capabilities specific to how AI functions within their organisation, focusing on “monitoring, observability and a clear understanding of what each AI system is doing and whether that matches what it’s actually supposed to do,” says Tziahanas.

The expansion approach is backed by Drexel University and Precisely’s State of Data Integrity and AI Readiness 2026 report, which found that organisations which expanded existing data governance to include AI governance outperformed those that created separate AI governance programmes, or reduced data governance efforts to focus on AI. In addition, 71% of organisations with governance programs reported high trust in their data, compared to 50% without governance programs.

Hurst also stresses that mid-market firms must address compliance well before any deployment of AI. “Too many firms treat AI adoption as a technology project and bring their compliance function in at the later stages,” he says. “In a regulated firm, that’s the wrong sequence. Compliance should be shaping the governance framework before tools are deployed, not reviewing it afterwards.”

Each AI use case should also be properly assessed before building anything. “Does it make sense from a legal standpoint? Is this something we’re even allowed to do? And then, does it make sense commercially, with a clear return on investment?” says Manta. “Not every AI idea is a good one, and some won’t make it past those initial checks.”

Accountability and adaptability

Board-level accountability for AI governance, along with AI literacy at the executive level, is also a must. Leaders should recognise that governance isn’t something you build once – it must be continuous and automated to keep pace with model drift and new use cases. “Leaders need to accept that governance frameworks today must be far more dynamic than we have historically been used to,” says Tziahanas. “The velocity and scale of AI, and what it does, requires a significant degree of automation simply to keep pace with the rate of change.”

Governance isn’t about eliminating all risk, however. It’s more about managing it in a sensible way. “One of the practical ways organisations are doing that is defining what I would call a human–machine boundary,” says Manta. “For example, you might use AI to go through documents and identify risks, but leave the final decision to a human. Where that boundary sits depends on the risk profile of the process, how complex it is, and the impact if something goes wrong.”

For mid-market firms that have been hesitating to expand AI because the regulatory picture feels unclear, stronger, smarter governance is ultimately the key to removing much of the ambiguity that prevents projects from reaching production. “If you know what tools are approved, how they’re monitored and where the boundaries are, leadership can say yes instead of defaulting to no,” Hurst concludes. “That’s not just a compliance benefit – it’s a competitive advantage.”

Ultimately, organisations that treat governance as an enabler rather than an obstacle will be better positioned to turn AI ambition into reality. By strengthening data foundations, embedding accountability and continuously adapting oversight, mid-market firms can move beyond cautious experimentation and scale AI with confidence. In doing so, governance becomes not a brake on innovation, but the mechanism that allows it to accelerate safely and sustainably.

Legacy ERP systems were designed to bring control, consistency and structure to core business processes. But AI requires something quite different from them: real-time access to high-quality data. While these systems have delivered significant value over time, many were not built to support the speed and flexibility AI demands today.

Jim Herbert, CEO of Patchworks, says legacy ERP systems are typically rigid, batch-driven and difficult to integrate with modern tools, which makes it hard to feed AI models with the data they need to be effective. “For mid-market firms, this creates a gap between ambition and execution,” he explains. “You can invest in AI tools, but if your ERP cannot surface accurate inventory, order or customer data in real time, those tools are working with incomplete or outdated inputs. The result is limited insight, poor automation outcomes and a lack of trust in AI outputs.”

Over time, legacy systems may have accumulated multiple layers of customisations, tweaks and workarounds that have quietly become part of mid-market operating models. This often creates friction for AI agents. “AI relies on consistency, but manual processes and disconnected systems introduce variability, duplication and error,” says Herbert. “In finance, that might mean mismatched figures across systems or delays in reconciliation. In the supply chain, it can mean inaccurate stock visibility or lagging demand signals.”

In other words, when teams rely on spreadsheets, exports, and manual fixes to bridge gaps between systems, firms tend to lose the single source of truth that AI requires. This means that “instead of enabling automation, AI ends up highlighting inconsistencies or amplifying them,” says Herbert.

The path to modernisation

Unsurprisingly, mid-market firms are increasingly realising that they must move ERP systems to the cloud and embrace out-of-the-box functionality to get the most from AI. “This is a departure from heavily customised on-premise systems as it does require finance teams to adapt business processes,” says Michael Lengenfelder, global solutions architect FP&A at Unit4. “However, they quickly see the value of running their ERP on a well-governed data model, because it gives them more scope to add a semantic layer that opens up opportunities for more agile, AI-enabled functionality.”

Nevertheless, a shift to the cloud cannot in itself overcome all the issues that prevent successful AI deployments at scale. “Firms often assume upgrading systems will solve any problems, but if you just carry forward the same fragmented processes and poor data practices, you’ll simply rebuild the same limitations, albeit in a brand new shiny interface,” says Bobby Brown, CEO and founder of the consultancy Nucleo.

“The opportunity is to enhance ERP’s system of control with AI’s system of intelligence,” he continues. “That means improving data flow, strengthening governance, and ensuring the right context sits around the core system. Done right, ERP provides the foundation for AI to scale safely and effectively.”

A practical way to identify where problems with current processes and workflows may reside is to look closely at where manual intervention is still required. Areas where teams are reconciling data, rekeying information, checking spreadsheets or escalating edge cases by email often signal both operational fragility and the greatest opportunities for AI-driven improvement.

Ultimately, mid-market firms are focused on results and outcomes. Even where organisations need to retain their core ERP systems, progress can be made by simplifying workflows, improving data consistency and introducing AI in a controlled, incremental way, often with humans remaining in the loop for critical decisions.

The mid-market firms that manage to close the gap between systems and AI ambitions with the greatest speed may well be those that stop thinking about ERP modernisation as a large replacement programme, and instead start thinking about it as a capability building exercise. Rather than starting with the platform, the focus shifts to the workflows, decisions and handoffs that matter most, and then working back to the systems, data and operating model needed to support them.

Regardless of what modernisation approach mid-market firms take, the vision should be to move ERP away from a ‘centre of everything’ position and towards a more connected model. “That means integrating ERP with ecommerce, WMS, POS and other systems through a flexible layer that enables real-time data flow and interoperability,” says Herbert.

This unified data environment can then be exposed to large learning models, ensuring that AI tools are working from consistent, up-to-date information across finance and supply chain, while also making it easier to plug in new AI capabilities. “The end goal is not just a newer ERP, but an operational model where data is accessible, reliable and ready to power automation,” says Herbert. “That is what allows AI to move from isolated use cases to something embedded across the business.”

AI readiness is less about adopting new tools and more about ensuring the systems beneath them can support speed, accuracy and scale. By focusing on data quality, workflow design and connectivity, mid-market firms can transform ERP from a constraint into a catalyst. Those that get this balance right will not only unlock greater value from AI, but also build a more responsive and resilient digital core for the future.