Integrating AI into processes means no longer using it as a separate chat and instead placing it as one more step in the workflow, fed by the system's own data, with human validation and a log of every decision. According to Deloitte (The State of AI in the Enterprise 2026, more than 3,200 leaders in 24 countries), 84% of organisations have not yet redesigned jobs or workflows around AI. That is the second phase, and most have not started it.
The first phase is over: what changes in the second
The first phase of AI in the enterprise was individual. Each person discovered that an assistant saved them an hour a day summarising, translating or drafting, and adoption grew without anyone planning it. Deloitte's State of AI in the Enterprise 2026 report measures it precisely:
- The share of employees with access to sanctioned AI tools grew by 50% in one year, to around 60% of the workforce.
- Only 25% of organisations have moved at least 40% of their experiments into production.
- Only 34% use AI to significantly transform their business model.
- 84% have not yet redesigned jobs or workflows around AI capabilities.
Read them together: lots of people with access, few experiments in production and almost nobody touching the process. That is exactly what it looks like from the inside. The assistant is in the next tab, but the process for approving an invoice, reviewing a contract or onboarding an employee is the same as in 2022, only with a copy-and-paste in the middle.
The second phase is not about bigger models. It is about where the AI sits: outside the process, fed by hand by each person, or inside the process, fed by the system and with the same rules for everyone.
Why the prompt does not scale
The hand-written prompt works very well for one person and very badly for an organisation, for four reasons that compound:
- It depends on who writes it. Two people in the same department get different results from the same document. The process is not repeatable and therefore cannot be improved.
- The AI does not see the system. It only sees what is pasted in. It does not know which supplier this is, which contract is in force or what was approved last time. All the context that adds value stays in the ERP or the document management system.
- Nothing is recorded. Nobody can say what was asked, what the AI answered or what was done with the answer. For an audit or a claim, the step simply does not exist.
- There is no control over what leaves. When context is pasted by hand, personal data, prices and contracts leave with it. It is the exact mechanism of shadow AI.
None of the four is fixed with prompt training. They are fixed by moving the AI somewhere else.
The anatomy of an AI step inside a process
A well-designed AI step inside a workflow has six components. If one is missing, what you have is a chat by another name.
| Component | Question it answers | Example: supplier contract |
|---|---|---|
| Defined input | What does the AI receive, and from where? | The contract PDF from the supplier record, not pasted text. |
| Bounded task | What exactly must it do? | Extract parties, term, amount, renewal clause and penalties. Nothing else. |
| Structured output | In what format does it return the result? | Record fields filled in, not a paragraph of prose. |
| Confidence threshold | When does it ask for help? | If it cannot find the expiry date with confidence, it flags the field and does not invent it. |
| Human validation | Who reviews, and when? | Purchasing reviews the flagged fields before the contract goes to signature. |
| Log | What is written down? | Which document, what the AI extracted, what the person corrected and when. |
The row most often forgotten is the structured output. As long as the AI returns prose, someone has to read it and retype. When it returns fields, the next step in the flow can start on its own.
Where to start: the three tasks that pay back first
The tasks that work best as a first AI step share three traits: high volume, repeatable judgement and an error that is cheap to correct. With those filters, the same three families almost always appear.
| Family | What the AI does | Where it shows up |
|---|---|---|
| Classify and route | Decides what the document or request is and which queue it goes to. | Invoice mailbox, HR requests, customer incidents, incoming registry. |
| Extract data | Pulls the fields out of a document and fills in the record. | Invoices, contracts, ID documents and certificates, forms, delivery notes. |
| Draft texts | Proposes a text that a person reviews before sending. | Customer replies, case summaries, non-conformity reports, internal communications. |
What not to put first: decisions with legal or financial effect on people, such as approving credit, shortlisting candidates or imposing sanctions. Not because AI cannot help, but because the error is expensive and the law demands guarantees a first project is not ready to give.
A complete example of the second family is in supplier invoice approval automation, and the reading technique in intelligent document processing.
Redesign the job, not just the step
Deloitte's 84% is not about technology: it is about jobs and workflows. When the AI extracts the invoice data, the person who used to key it in moves to validating exceptions. It is a different job, with a different metric and different training, and if it is not redesigned explicitly one of two things happens: the person keeps typing just in case and the saving disappears, or the person validates without looking and the control disappears.
Three concrete changes that go with every AI step put into production:
- The job metric changes. From invoices registered per day to exceptions resolved and errors caught. If the metric does not change, neither does the behaviour.
- Training is mandatory, not optional. Article 4 of Regulation (EU) 2024/1689 has required since 2 February 2025 that anyone using AI systems has sufficient competence to do so with awareness of the risks. Knowing when to distrust an extraction is part of the job.
- Responsibility is assigned. Every AI step has a business owner who answers for its quality, reviews the exceptions and decides when the confidence threshold changes.
Gartner predicts that by the end of 2026 40% of enterprise applications will include task-specific AI agents, and at the same time that more than 40% of agentic AI projects will be cancelled before 2028 because of costs, unclear value or insufficient controls. Both figures are compatible: AI enters the process, but it only stays when the process was redesigned for it.
The minimum governance you need
You do not need an ethics committee to put an AI step into an invoice workflow. You need the following, and it fits on one page:
- An inventory. Which AI steps exist, in which processes, with which model and which data. It is also what the AI Act asks for; we explain it in the EU AI Act and process automation.
- A validation rule per risk level. Everything, by confidence threshold or by sampling. Decided by the process owner and written into the flow, not into a document.
- A data boundary. What information the model may see and under which contract. If personal data is involved, the processor and the service location are defined before starting; how to do it is in LLM and RAG with EU GDPR compliance.
- A log. Every run records what went in, what came out and who validated. Without it there is no audit and no improvement possible.
- A periodic review. Every quarter, the process owner looks at the exception rate and decides whether the threshold goes up, down or the step is retired.
When the AI step stops being a task and starts taking chained decisions, governance has to grow with it; we cover that case in AI agent security in business processes.
A 90-day plan to move from phase one to phase two
One process, three months and a number at the end. It is the opposite of a transformation programme, and that is why it works.
- Days 1-30 — Choose and measure. Pick a process that hurts, has volume and whose documents are already in a system. Ask the people who run it where they copy and paste into a chat today. Measure time per case and the current error rate: without that baseline there will be no decision at the end.
- Days 31-60 — Build the step. Define input, task, structured output, threshold and human validation. Build it in the real flow, not in a separate demo, with a small group of users and logging on from day one.
- Days 61-90 — Operate and decide. Thirty days of real use. Compare time, errors and exceptions with the baseline. Adjust the threshold once. And on a date fixed in advance, decide: expand to another process, keep it or close it.
The decision date is the most important part of the plan. We explain why in why 95% of AI pilots never reach production.
How Dokuflex solves it: AI as one more step in the flow
Dokuflex, a low-code BPM platform with AI, is built on the idea in this article: AI is not a separate application, it is an action you drag into the process designer just like a human task or an integration.
- AI actions in the designer. Classifying a document, extracting fields, summarising a case or drafting a text are steps in the flow in Dokuflex low-code BPM, with the input taken from the record and the output written to its fields.
- Human validation as a task. The next step can be a human task created only when confidence falls below the threshold, with owner, deadline and escalation, like any other approval.
- The documents are already there. The AI works on Dokuflex's document management, with the permissions of the user who starts the process. Nobody exports anything.
- A log of every run. Which document, what the AI returned, what the person corrected and when, in the case history.
- Processing under control. The model receives the minimum context and under contract, with the architecture described in LLM and RAG with EU GDPR compliance.
The practical result is that the 90-day plan above needs no integration project: the AI step is drawn in the same flow where the tasks already live, which is why the timeline is counted in weeks, as we explain in how an AI-powered BPM cuts implementation time.
Book a demo and see an AI step inside one of your processes →
Frequently asked questions
What does integrating AI into business processes mean? +
It means no longer using AI as a separate tool into which each person copies and pastes information, and instead placing it as one more step inside the workflow: it receives data from the system itself, performs a bounded task such as classifying, extracting or drafting, returns a structured result, passes through human validation when the risk requires it and leaves a record of what it did. The difference is that the result no longer depends on who wrote the prompt.
What does Deloitte's report say about AI adoption in 2026? +
The State of AI in the Enterprise 2026 report, based on a survey of more than 3,200 business and technology leaders in 24 countries, notes that around 60% of employees now have access to sanctioned AI tools, but that 84% of organisations have not yet redesigned jobs or workflows around AI, and that only one in four has moved at least 40% of its experiments into production.
Why does prompt-based AI use not scale? +
For four reasons: the result depends on the skill and the mood of the person writing the prompt; the AI does not see the system's data, only what is pasted in; there is no record of what was asked or what was done with the answer; and there is no control over what information leaves the company. A process does the opposite on all four points: same input, same task, same validation and same log, whoever runs it.
Which tasks should be automated with AI first? +
Those that combine high volume, repeatable judgement and an error that is cheap to correct: classifying and routing documents or requests, extracting data from invoices, contracts or forms, and drafting texts that a person reviews before sending. Decisions with legal or financial effect on people come later and always with human validation.
What is human validation or human in the loop? +
It is the process step in which a person reviews, corrects or approves the AI's result before it takes effect. It is designed according to risk: it can be mandatory for everything, only when the model's confidence falls below a threshold, or only by sampling. What matters is that it is an explicit step in the flow, with an owner and a deadline, and not a recommendation in a policy document.
What does the EU AI Act require when AI is integrated into a process? +
At a minimum, Article 4 of Regulation (EU) 2024/1689, applicable since 2 February 2025, requires staff who use AI systems to have sufficient competence to do so with awareness of the risks. If the process falls within one of the high-risk areas of Annex III, such as access to employment or the evaluation of people, the obligations are far greater and the system should be inventoried and assessed before going into production.
Where do I start if my company is still in the first phase? +
With a single process, not a strategy. Choose one that hurts, has volume and whose documents are already in a system; identify the specific task that is done today by copying and pasting into a chat; turn it into a step in the flow with a defined input, a structured output and human validation; measure time and errors before and after for thirty days; and decide with that figure whether to expand or close it.
Sources
- Deloitte — The State of AI in the Enterprise 2026: survey of more than 3,200 leaders in 24 countries; access to sanctioned tools, experiments in production, business model transformation and redesign of jobs and workflows.
- Digital Skills and Jobs Platform (European Commission) — summary of the Deloitte report: headline figures and link to the full document.
- Gartner, 26 August 2025: 40% of enterprise applications will feature task-specific AI agents by the end of 2026.
- Gartner, 25 June 2025: more than 40% of agentic AI projects will be cancelled by the end of 2027.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act): Article 4, AI literacy; Annex III, high-risk systems.
Take the AI out of the tab and put it in the process
Book 30 minutes: we take one of your real processes, find the task done in a chat today and draw it as a step in the flow with its human validation. No commitment and no generic presentation.