To implement artificial intelligence without taking undue risk, start with one specific process that has a metric, decide what data the AI can see, give it only the permissions it needs, test it before using it with customers and name one person responsible for supervising it. Most projects don't fail because of the AI model, but because the tool doesn't fit into the way the company works.
Why do so many AI projects fail to deliver results?
Because the tool gets bought before the process is defined. A preliminary MIT study (project NANDA, July 2025), based on interviews, a survey of 153 executives and the analysis of more than 300 public initiatives, estimated that 95% of organizations still get no measurable return from generative AI on their bottom line, six months after the pilot.
The main cause the study identifies is not the quality of the models, but what it calls the "learning gap": tools that don't learn, that integrate poorly or that don't fit existing workflows. MIT itself notes that its figures are directional and based on interviews, not on official company reports, so they are best read as a signal, not as an exact statistic.
Adoption, on the other hand, is moving fast. A survey by MIT Sloan Management Review and BCG of more than 2,000 executives in 116 countries found that 35% of organizations already use AI agents and another 44% plan to soon, and it warns that adoption is moving faster than companies' ability to redesign processes and define who decides and who supervises.
What it costs you: paying for licenses and pilot hours that never reach daily operations.
How many companies in Mexico already use artificial intelligence?
Close to half of the large ones. According to the Banco de México (Mexico's central bank), in June 2026, 48.5% of companies with more than 100 employees reported using at least one artificial intelligence technology, and 64.8% expect to use it within the next three years. In September 2025 the comparable figure was 24.3%, although Banxico notes that the questions in the two surveys differ.
The most important obstacles companies reported were workers' lack of knowledge about how to apply it, the lack of trained staff and the lack of resources. And so far, most have not seen significant effects on employment. In other words: the challenge is not getting the technology, but knowing how to apply it.
What are the real risks of using AI in a company?
The U.S. National Institute of Standards and Technology (NIST) published a risk profile specific to generative AI in 2024. These are the four that most affect a company that uses it with customers and with its systems:
| Risk | What it looks like in your company | How to reduce it |
|---|---|---|
| Made-up answers ("hallucinations") | The assistant states a price, a stock level or a policy that isn't real, with complete confidence | Have it answer from your systems' data, not from memory, and say "I don't know" when it lacks the data |
| Data leakage | Customer or company data ends up where it shouldn't | Decide what data the AI sees and with which provider (step 2) |
| Over-trusting the tool | The team stops reviewing what the AI produces | Human approval on what matters and periodic reviews (steps 3 and 4) |
| Hidden malicious instructions | A message, email or document carries text that tries to make the AI do something it shouldn't | Minimum permissions: even if it is tricked, it can't do harm (step 3) |
Step 1: Why start with a process and not with the tool?
Because a tool without a process has no way to prove it works. Pick a task that repeats every day, that is done by hand today and that you can measure: lead response time, documents classified per day, overdue collections. Write down where it stands today; that is your baseline.
AI makes sense where you need to classify, answer or analyze. If the task only moves data from one system to another, an automation without AI is often enough, and it is cheaper and more predictable.
What it costs you to skip this: a pilot that "looks good" but that nobody can say how much it saved.
Step 2: What company data can the AI see?
Only what it needs for the task. Before connecting the AI to your ERP, CRM or WhatsApp, make a list of what information it will read, which provider will process it and where it is stored.
In Mexico, the current Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties) was published on March 20, 2025. It requires the data controller to maintain administrative, technical and physical security measures, and it establishes that, when data is transferred to third parties, the privacy notice must be communicated to them. The law does not mention artificial intelligence, but your company remains responsible for your customers' data even when an AI provider processes it. Review your specific case with your legal advisor.
Step 3: What permissions should an AI agent have?
The minimum for its task, and nothing more. OWASP, the reference community in application security, includes "excessive agency" in its 2025 risk list: giving an AI system more functions, more permissions or more autonomy than it needs. If the AI only has to check stock, it doesn't need to be able to change prices.
For important actions (sending a formal quote, applying a discount, deleting or modifying records, sending mass emails), the recommendation is that a person approves before they are carried out. That way, even if the AI makes a mistake or someone tries to trick it, the damage stays contained.
Step 4: How do you test the AI before using it with customers?
With real cases from your operation and in a test environment. NIST's AI risk management framework recommends testing systems before putting them into operation and regularly while they run, and monitoring their behavior in production.
- Gather real questions and cases, including the hard ones: the upset customer, the discontinued product, the request outside policy.
- Review the answers with whoever does the task today; they know what is right.
- Start with a small group of users or customers and expand when the step 1 metric improves.
- Review a sample of conversations or results every week, especially at the beginning.
Step 5: Who is responsible for what the AI does?
A person at your company, by name. The OECD AI Principles (Mexico is a member of the OECD) call for human oversight and traceability: being able to reconstruct what data the system used, what it did and who authorized it.
In practice: every AI action should be recorded in your system (for example, in the order or customer history in Odoo), the owner should review the indicators, and there should be a clear procedure to switch it off or correct it if something goes wrong.
Should you build the AI in-house or with a partner?
It depends on your team, but the data favors relying on someone. In the MIT study, tools developed with external partners reached production about 67% of the time, versus about 33% for those built in-house. The study notes that these are self-reported results.
What makes the difference, according to the same study, is that the tool integrates into the workflow and learns from it. That is why at NIQERA we work in four stages: diagnostic (without a diagnostic we don't start configuring), architecture, implementation with your real data and operation with measurement against agreed indicators. And we don't promise that AI, by itself, will solve the business's problems.
If your case is serving customers, see how an AI agent that serves customers on WhatsApp works, connected to your CRM; if it is getting operations in order first, start with the Odoo implementation.
Quick checklist before you start
- One chosen process and its metric today.
- The list of data the AI will see and the provider that processes it.
- The AI's permissions, in writing, and which actions require approval.
- A set of real test cases.
- A named owner and a weekly review on the calendar.
Glossary
- Generative AI
- Artificial intelligence that produces text, images or other content from instructions.
- AI agent
- An AI system that, besides answering, performs actions in other systems: checking stock, creating a quote, sending a message.
- Hallucination
- A false or made-up answer that the AI presents with confidence.
- Prompt injection
- Text hidden in a message, email or document that tries to make the AI do something other than what it should.
- Human in the loop
- A design in which a person reviews or approves the AI's important actions before they are carried out.
Frequently asked questions
Where do I start with AI in my company?
With a process that repeats every day, that is done by hand today and that you can measure. Write down where it stands today so you can compare later.
Can I use an AI chat with my customers' data?
First check which provider processes the data and under what conditions. In Mexico your company remains responsible for your customers' personal data; review your case with your legal advisor.
Do I need Odoo to use artificial intelligence?
Not necessarily, but with your data organized in a single system the AI has something to answer from and its actions are recorded.
Is AI going to replace my team?
According to the Banco de México, most companies already using it have not seen significant effects on employment. What is common is that AI takes over repetitive tasks and the team supervises and decides.
What happens if the AI makes a mistake?
That is why it gets minimum permissions, a person approves the important actions and every action is recorded: the error is caught and corrected before it grows.
Sources: MIT NANDA, "The GenAI Divide: State of AI in Business 2025", July 2025 (preliminary findings) · MIT Sloan Management Review and BCG, "The Emerging Agentic Enterprise", November 2025 · Banco de México, «Opinión empresarial sobre la adopción de inteligencia artificial en México…», September 2026 · Banco de México, «Opinión empresarial sobre la adopción y el uso de inteligencia artificial y automatización», December 2025 · NIST AI 600-1, generative AI profile, July 2024 · NIST, AI Risk Management Framework 1.0 · OWASP, Top 10 for LLM Applications 2025: Excessive Agency · OECD, AI Principles · Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF, March 20, 2025)
