How am I going to put artificial intelligence into my business if my software is twenty years old and half of the operations are on paper?

In a nutshell

• The question isn't "what AI should we buy?", but rather what does that AI need to read. If the information lives on paper, in a spreadsheet that only one person understands, or in software that doesn't talk to anyone, the AI has nowhere to drink from.
• The path that works has three stages: digitize operations, open legacy software with APIs and connectors, and only then put artificial intelligence to work.
• There is no need to send anything to the cloud. Today you can run open-source AI models on your own server, even on your own hardware and without an internet connection, and carry out the migration in the same way: confined.
• We have already done this in several organizations we cannot talk about. Precisely for that reason we know it can be done with discretion and the usual standards.

The conversation I repeat most often

It happens to me almost every week. I finish a talk about artificial intelligence, someone walks up with a look that says "this is great, but…" and tells me their situation. An ERP installed by a vendor that no longer exists. Orders that come in via email and are entered by hand. A literal notebook where the workshop manager notes down incidents. And a question that is almost a confession: «How am I going to bring AI into this, if we haven't even left the last century yet?»

My answer usually comes as a surprise: you are better positioned than you think. Not because the starting point is good, but because whoever admits this is about to avoid the most expensive mistake of all: putting the cart before the horse.

The figures show you are not alone. According to the INE, in the first quarter of 2025 only 21.1% of Spanish companies with ten or more employees used some form of artificial intelligence, and among those with fewer than ten, the figure dropped to 13,4 % (INE, 2025). In Europe, the average hovers around 20%, but rises to 55% in large companies (Eurostat, 2025). The gap is not about willingness or budget. It is about foundations.

Why AI gets stuck in legacy systems

To put it simply, a language model is a very fast and diligent reader. But it reads what you give it. If your business information is scattered across papers, emails, a "time-honored" Excel sheet, and a database that can only be accessed from an office terminal, the AI arrives, looks around, and finds nothing to read.

There is a second problem, more subtle and more costly: automating a broken process does not fix it, it accelerates it. If an order currently passes through four hands and two approvals that nobody remembers why they exist, an AI that "streamlines" that circuit only makes the mess go faster and makes it harder to undo later. Before asking a machine to do the work, it is wise to know exactly what that work is.

That is why, in all the projects of this type that we have undertaken, AI has arrived at the end. Not out of caution, but out of pure logic.

First phase: digitizing operations (what people actually do)

Digitizing is not scanning. It is making sure that every important operation leaves a structured trace: who did what, when, with what data, and with what result.

In practice, it starts with something very low-tech: sitting down with the people who do the work. What they do every day, what they consult once a year, what happens when an exception appears. That knowledge is usually inside the head of someone who has been solving problems for fifteen years, and it is pure gold.

With that in front of us, we choose two or three processes with high volume and high friction (order entry, incidents, invoicing) and move them to simple digital forms and workflows. No grand platforms. Just enough so that the data is born digital from the start and never has to be transcribed again.

It is the least flashy phase and the one that sustains the most value afterward. Without it, everything else is smoke and mirrors.

Second phase: opening up the legacy system with APIs and connectors

Here is the bottleneck for almost every company. Old software works, people know it, and no one wants to touch it. But it is a closed box: it does not talk to other systems and does not let anyone, neither person nor machine, consult its data without going through its screen.

You don't have to throw it in the trash overnight. The goal of this phase is to provide doors:

• Inventory and diagnosis. What the system contains, what can be extracted, and what the organization still needs. They don't always match, and those gaps must be written down before estimating anything.
• A layer of APIs and connectors around the existing system, so that its data can be read (and, when appropriate, written) in a controlled, documented, and auditable way.
• Phased migration, where applicable, with clear acceptance criteria, a person to validate them, and a rollback plan at each step. A sample that passes the tests proves something about that sample; it does not prove that the entire house has been migrated.

The result is not "new software". It is something more valuable: data that you can consult, move, and protect without depending on a single screen or a single provider. Which, by the way, is exactly what AI needs.

If this is your starting point, it is precisely what we do in our legacy systems migration.

Third stretch: AI, at home and behind closed doors

With data now accessible, artificial intelligence ceases to be a promise and becomes a tool: classifying incidents, summarizing case files, drafting the first response, or finding in seconds a document that used to take all morning. In our artificial intelligence service we organize this using the 20-60-20 model: your team defines the context, the AI does the heavy lifting, and your team validates and decides.

And here comes the part that most reassures CEOs (and security managers, who are usually the most and rightly skeptical): none of this requires taking your data out of your company.

Confined AI: how it works, without technicalities

• Open-source models. There are families of open-weight models (Llama, Mistral, Qwen, or Gemma, to name a few) that are downloaded once and run on your machines. There is no subscription listening on the other end.
• Your server or your own hardware. They can run on a company server or a dedicated computer, the size of a shoebox or smaller, like the one we took to Soria.
• No internet connection. Once installed, they work on an isolated network. Neither data nor questions leave the perimeter.
• Confined migration. The same principle applies to migrating from legacy systems: extraction, transformation, and verification can be done within your facilities, without copying databases to external services.
• No noise. No one outside your organization needs to know you are doing this: not vendors, not competitors, not third-party platforms.

It is not theory. In February we were at the REAIM summit in A Coruña, the international meeting on the responsible use of AI in the military field, and in September at the II Responsible AI Conference in Soria. In both forums, the underlying conversation was the same: data sovereignty. What is an obligation in defense is simply common sense for an industrial company, an office, or a foundation.

What we have learned along the way

We have traveled this path with various organizations (whose names, as you will understand, we cannot disclose). Some lessons repeat themselves with an almost amusing stubbornness:

1. The first deliverable is not technology, it is a map. Knowing what data exists, where it is, and who needs it saves months of discussions.
2. Old software hides rules that no one ever wrote down. A billing exception, a field that 'is always left blank.' They must be found before migrating, not after.
3. The people using the system are part of the project. If the transition does not include those who work with it every day, the new system is born orphaned.
4. Confined does not mean improvised. Working without the cloud and without the Internet requires the same rigor as any project: access control, traceability, backups, testing, and documentation. Standards are not negotiable just because you are working from home.
5. AI is the prize, not the excuse. When the first two stages are done right, AI is implemented in weeks. When they are not, no model can fix it.

Where to start on Monday

If you saw yourself in the title question, here are three steps for this very week:

• Choose a process that hurts. One with volume, repetition, and complaints. That is your pilot.
• Make a list of the "systems that don't talk to each other". Software, spreadsheets, and notebooks where information lives that no one else can consult.
• Decide where you want your data to live. If the answer is "right here and nowhere else", you should know that it is entirely possible.

From there, the rest is craftsmanship. And, like almost everything worthwhile in a company, it is done step by step and with the people on board.

Shall we talk? See how we approach the legacy systems migration, tell us what system you use and what you need to preserve or learn how we work with artificial intelligence in business. You don't need to send us credentials or databases to start the conversation.

Javier Cuervo is CTO and co-founder of Proportione, a strategy, technology, and people consulting firm with offices in Madrid and Aveiro.

This article has a versão em português.

Sources

• INE, Survey on the use of ICT and e-commerce in businesses, 2024-first quarter 2025, press release of October 22, 2025: https://www.ine.es/dyngs/Prensa/ETICCE20241T2025.htm
• Eurostat, Use of artificial intelligence in enterprises (2025 data): https://ec.europa.eu/eurostat/statistics-explained/index.php/Use_of_artificial_intelligence_in_enterprises
• Ministry of Foreign Affairs, REAIM 2026 Summit (A Coruña, February 4-5, 2026): https://exteriores.gob.es/es/REAIM2026/Paginas/Cumbre26.aspx
• Proportione, Proportione presents Aviaria Defense and Proportione Defense at the II Responsible AI Conference in Soria: https://proportione.com/proportione-soria-aviaria-soberania-tecnologica/