Study by CANCOM and ServiceNow: Mid-Sized Companies Are Using AI Productively—But Integration, Security, and Governance Are Hindering Scaling

Home / News / Study by CANCOM and ServiceNow: Mid-Sized Companies Are Using AI Productively-But Integration, Security, and Governance Are Hindering Scaling

01. Jul 2026 | Press releases

Study by CANCOM and ServiceNow: Mid-Sized Companies Are Using AI Productively-But Integration, Security, and Governance Are Hindering Scaling

• Three out of four mid-sized companies are already using AI productively-but only one in four has fully integrated it into their core processes.

• Nearly half of all companies operate AI in isolated silos, and 16 percent use uncontrolled "shadow AI" with growing security and compliance risks

• Integrated platforms, robust data architectures, and controlled operating models are the key drivers for sustainable AI success.

CANCOM, in collaboration with ServiceNow, has published the study "AI zwischen Vision und Umsetzung - Wie der Mittelstand den Schritt von Pilotprojekten zur breiten Umsetzung schafft". The survey, conducted by the analyst firm techconsult, shows that artificial intelligence (AI) has become a strategic priority for German mid-sized companies and is already being used productively. At the same time, there are significant challenges regarding company-wide integration, governance, and the secure scaling of AI applications.

For the study, techconsult surveyed IT and business decision-makers from mid-sized companies with 500 to fewer than 2,000 employees in Germany on behalf of CANCOM and ServiceNow in early 2026. The key finding: 76 percent of companies are already using AI productively, but only 26 percent have fully integrated it into their core processes. Many companies thus remain at the stage of individual pilot projects or isolated use cases.

AI has arrived in the SME sector, but about half of these companies operate AI in silos

According to the study, the correlation between strategic anchoring and actual maturity level is particularly clear: Companies with a clear "AI-first" approach have fully operationalized AI significantly more often than companies that implement AI only at the departmental level. At the same time, 49 percent of the surveyed companies continue to pursue isolated departmental strategies, which can lead to data silos, parallel structures, and security risks.

"The study clearly shows that AI in the SME sector has moved beyond the experimental phase. The crucial next step is now its controlled and scalable integration into business-critical and value-adding processes," says Simon Russin, Vice President of Enterprise Applications at CANCOM. "Those who introduce AI only on a departmental basis are creating shadow AI within their own organizations, with the corresponding risks. Nearly half of SMEs are currently taking precisely this risky path."

EU AI Act Makes Governance Mandatory; Many Companies Are Unprepared

Companies see the biggest hurdles to AI integration in the areas of IT security and risk management (38 percent), costs and budget constraints (28 percent), and a lack of expertise (25 percent). The results thus underscore that AI implementation is increasingly an infrastructural and organizational challenge. Added to this are requirements related to data sovereignty (23 percent) and regulatory uncertainties (22 percent).

These issues are becoming even more pressing as the EU AI Act gradually comes into effect: What was previously voluntary governance is increasingly becoming a regulatory requirement. Already, 28 percent of companies explicitly cite demonstrable compliance capability as a criterion when selecting their IT service provider. Against the backdrop of the EU GDPR, NIS2, and the EU AI Act, this is no longer a peripheral issue but a competitive factor.

Agentic AI is moving from a future concept to concrete implementation

Agentic AI is also gaining importance. 21 percent of companies are already using or testing agent-based approaches, and another 36 percent plan to implement them within the next twelve months. The majority views Agentic AI not so much as a disruptive revolution, but rather as the next stage of process optimization and automation.

"Today, companies need more than isolated AI applications. What's in demand are integrated platforms that securely connect data, processes, and AI," says Alwin Schauer, AVP Alliances & Channels Ecosystem at ServiceNow. "Especially with regard to Agentic AI, transparency, control, and governance are becoming crucial prerequisites for the productive use of autonomous systems."

Integrated Platforms Are Becoming a Key Success Factor

The study's findings highlight a clear need for action: AI must be viewed more as an integral part of an integrated IT and process architecture, rather than as a siloed departmental project. Companies that consolidate their data structures, adopt platform-based approaches, and establish centralized governance models lay the foundation for scalability, security, and sustainable, routine AI operations.

Expectations for external partners are changing accordingly. Rather than ad-hoc implementation service providers, companies are seeking strategic transformation partners who possess technical AI expertise (40 percent), industry knowledge (35 percent), and a holistic architectural approach (34 percent). Speed alone is now a deciding factor for only 23 percent.

The full study is available for download here. (Available in German only.)