Claude in Mid-Market and Enterprise

The question for 2026 is not whether to implement Claude, but how to move from pilot to scale. By 2026, AI has become mainstream: about 78% of organizations already use it in at least one business function. But according to the MIT NANDA report "The GenAI Divide" (2025), about 95% of enterprise generative AI pilots produce no measurable P&L impact, and only about 5% reach scale. The gap is not model quality, but how AI is embedded into processes and data.

This article covers three things that determine the outcome: where to start a pilot and how to grow it to scale; why GDPR is often applied more broadly than the law requires (commercial data is rarely personal, and a pilot can be built legally on anonymized and synthetic data); and which task level mid- and large-sized business can close fastest with Claude, based on real KT.Team cases.

AI adoption is already mainstream, and generative AI has reached about 67% penetration by market estimates. So the bottleneck has shifted: it is no longer "is there a suitable model" but "has the use case been turned into a working process." The MIT NANDA report calls this the GenAI Divide - the gap between a pilot and P&L impact. The same report offers a practical benchmark: buying from a specialized vendor or partnering reaches results in about 67% of cases, while in-house builds from scratch succeed three times less often, at roughly one third.

The probability is higher where adoption is driven by a line manager, not just IT. The takeaway for mid- and large-sized business: scale comes not from "one more model," but from a narrow process, a measurable result, and a business-side owner.

The first use case is chosen by three criteria at once, not by how "trendy" the topic is:

GDPR regulates not "any data" but personal data. Article 3 defines personal data as any information directly or indirectly relating to an identifiable natural person; the legal key is whether a specific person can be identified. Item master data and product attributes, product composition, technical specifications, tender terms, invoices, warehouse documents, industry classifiers, and aggregated metrics do not relate to a specific person, so the personal-data regime does not apply to them.

This leads to a common mistake: applying the law more broadly than required and blocking AI unnecessarily.

When a process cannot work without real personal data, the responsible pattern is not to send personal data directly to someone else's model, including a foreign one. LLM & Security Gateway provides a two-way boundary: personal data is tokenized before the model and de-anonymized in the response - the provider sees only anonymized data, which also removes cross-border transfer risk. For local preparation of text before sending, there is the anonymize skill.

The fastest to adopt are tasks with a narrow process and measurable result; agents and the security boundary are already scale-level. The table goes from the fastest entry point to the most mature level, each with real KT.Team proof.

Most level 1-4 scenarios start well as a narrow pilot; levels 5-7 usually grow out of the first successful deployments.

At scale, the control point is not a single model, but the layer between processes and providers. What it covers:

Multi-vendor is the norm here, not the exception: a single gateway lets you keep several frontier models and choose the right one for each task without locking into one provider. More - LLM & Security Gateway.

Launch a pilot in 2-4 weeks - a verifiable first step: