Introducing AI without an IT department: what you do yourself and what others take on
It works if the provider takes care of operation, updates and backup, for example in a cloud in Germany. Only a few tasks stay in-house: a person who manages accounts and apps, rules on data, the data protection impact assessment and contracts, training and, where applicable, the staff representatives. Providers, partners or your IT service provider handle connections to specialist systems, sign-in through existing user management or running a server.
Is AI possible at all without an IT department?
Yes, as long as the technical operation does not rest with you. Many medical practices, care facilities and small municipalities have no IT department of their own, but an external service provider or a municipal data centre. An AI platform from a cloud suits them, with the provider taking care of servers, updates and backup. Running a server on your own premises usually only pays off for larger organisations and needs someone to look after it.
What stays in-house, and what do others take on?
| Task | Who takes it on |
|---|---|
| Servers, updates, backup, monitoring | the cloud provider |
| Accounts, groups, sharing apps | one person in your organisation as administrator |
| Rules: which data may go into which app | management together with the data protection officer |
| Data processing agreement, data protection impact assessment | your organisation as controller, with documents from the provider |
| Staff training | provider, partner or a person in your organisation |
| Sign-in through existing user management | your IT service provider with the provider, if required |
| Connecting specialist systems | provider together with the vendor of the specialist system |
| Co-determination | management with the works council, staff council or employee representatives, where there is one |
Responsibility cannot be outsourced: for data protection, your organisation remains the controller, and the provider is the processor (Art. 28 GDPR).
What should you look for when choosing a provider?
- Operation by the provider: updates and backup are included; you do not need to install anything.
- Location and contract: data centre in the EU, data processing agreement and, for professional secrecy holders, a commitment under § 203 StGB (German Criminal Code, professional secrecy).
- Ready-made apps: tasks such as drafting letters or summarising minutes should work without any setup of your own.
- Administration without specialist knowledge: inviting people and assigning permissions.
- Documents: templates for the data protection impact assessment and the record of processing activities, technical and organisational measures.
- Support in your language: availability, first response, contact person.
- Starting small: minimum size and term that suit your organisation.
A detailed list is in the checklist for assessing AI providers.
What role does your IT service provider play?
It does not have to be involved, but it can help: with sign-in through existing user management, with firewall approvals or with connecting systems it looks after. Talk to it early so that it knows what is coming. Some IT service providers and municipal data centres also offer AI platforms themselves for several customers.
Which steps do you take?
- Try it out: with sample data, without real patient or citizen data.
- Decide: tasks, people, budget, term.
- Contracts and data protection: data processing agreement, data protection impact assessment, rules on data.
- Set up: name an administrator, invite people, share apps.
- Train: before the start, on your own tasks.
- Follow up: after a few weeks, find out what is missing.
How does this work with basebox?
- Cloud from 5 people: registration in two minutes with your work e-mail address, invite your team with groups and permissions, licence per person on invoice, €490 to €178 per person per year (list price, net). The minimum term is one year.
- Operation by basebox: we take care of operation, updates and backup in our data centre in Germany. Each organisation has a separate environment with its own user management. Your data does not train any model.
- Try it out: after registration you work with 1 million tokens free of charge and without a time limit. Your account is in our cloud from the start.
- Ready-made apps: your staff choose the task and get the result, without any knowledge of AI.
- Documents: data processing agreement, agreement under § 203 StGB, templates for the data protection impact assessment and the record of processing activities on /sicherheit.
- Help with setup: the setup in your IT (€24,900 one-off, optional) covers installation, sign-in through your user management, e-mail and network, support on the first working day and two training sessions. basebox runs without setup by us too. Individual training sessions cost €900 online and €1,400 on site plus travel expenses.
- Partners: evoila and Systhemis for implementation, consulting and operation, Consileon for consulting on the rollout and training (Partners). IT service providers can also run basebox for several customers, each customer in a separate environment.
- A server later: if your organisation grows, you can switch between cloud and server at any time for a flat fee of €4,200. On request, basebox can run the server, remotely for €1,200 per month or in our data centre for €2,100 per month.
Frequently asked questions
Who is the administrator if we have no IT?
A person who knows how things work in your organisation, for example from practice management, the head office or the administration. They invite people, set up groups and share apps. No programming skills are needed; training is advisable.
Do we need our own user management such as Active Directory?
Not in the basebox cloud: each organisation has its own user management there, and you invite your team with groups and permissions. If your IT service provider already runs user management, it can be connected via LDAP, OIDC or SAML.
Can we start together with other municipalities or facilities?
Yes. For an association of municipalities or a joint authority (in Germany, for example a Verwaltungsgemeinschaft, Amt, Verbandsgemeinde or Zweckverband), you conclude a joint contract with basebox. The people of all participants are counted together and lower the price per person, whether they all work in one organisation or each facility has its own instance.
What happens if something does not work?
You contact the provider's support. At basebox, support is available on working days from 9 am to 5 pm, in German and English, with a first response within one working day, prioritised by severity.
Sources
This article was created with the help of AI, based on the sources listed. Responsible for the content: basebox GmbH. Not legal advice, no liability. Research as of 11 October 2026.