--- title: "AI transformation at SUMAX – four layers and one gateway" description: "AI transformation at SUMAX, a German digital marketing firm: how Carl-Uwe Würfel has run it since 2023, from leadership to governance, with a hands-on demo." url: https://carl-wuerfel.de/en/transformation author: Carl-Uwe Würfel --- 1. [Home](https://carl-wuerfel.de/en) 2. Transformation # The AI transformation at SUMAX Since 2023 I have been moving SUMAX, a digital marketing firm in Dortmund, Germany, onto AI as a whole company: how work gets done, who holds which role, which services we offer and which rules apply. Internal figures and client names stay inside the company. ## Four layers, one transformation. AI transformations rarely fail on technology. They fail when one of four layers is missing. 1. 01 ### Leadership Workflows first, tools second. I decide what gets a tool and who answers for it. Whoever passes on an AI result has checked it. 2. 02 ### People Roles redefined, learning done together. Change only holds if the team shapes it. The tools are built together with the people who use them. We rewrote role profiles, built a training program and set shared working standards. Today the large majority of employees use our own AI tools every month. AI takes over the busywork, professional judgment stays with people. 3. 03 ### Operations Recurring work as shared workflows, not isolated tools. Instead of many separate tools we built one shared foundation for our workflows. The output of one task is available to the next, new models are connected and evaluated centrally, and a model can be swapped without touching a single tool. We replaced several purchased tools with our own. I designed the architecture myself, which is why I know what to ask of teams and vendors. 4. 04 ### Governance Cost, quality and compliance in daily operations. Every AI call is logged with its cost, a five-figure number every month. Roles and permissions govern who may use what; approvals govern what leaves the building. Content for healthcare clients is checked against German health advertising law before release, and EU AI Act requirements are built into the workflows. ## One job. Through the whole business. This is what running operations looks like day to day: an example job moves through account management, the editorial team, the gateway and sign-off. Making sure every step holds is my job. _Example job_ Ad copy for a clinic The business * **Client** * **Account management** * **Editorial team** * **Sign-off by a person** * **Time and cost per team** Gateway: one layer, six stations 1. 01**Access** Editorial role, healthcare client: review required 2. 02**Cache** No valid result available 3. 03**Model routing** Standard model: text review does not need the largest model 4. 04**Review** Health advertising law: 2 claims flagged (cure promise, before-and-after) 5. 05**Cost ledger** Booked to editorial, healthcare client 6. 06**Approval** Returned to the editor, not approved Revised, then signed off by a person Several vendors * **Large model** analysis, proposals * **Standard model** reviewing copy * **Small model** summaries * **Data and specialist services** search data, translation 1. Account management A client orders ad copy for their clinic. Account management takes the job and hands it to the editorial team. 2. Editorial team The team writes the copy and books its time to the job. Tens of thousands of these entries tell me where the hours go. 3. Gateway: access and model Editorial has the copy checked with AI, and every call goes through the layer. Who may do what is set in one place, and no vendor locks us in. Is this role allowed, is there a result already, and which model is enough? Review required for healthcare clients, no stored result, standard model is enough 4. Gateway: review The legal risk shows up before the copy reaches the client. Does the result follow the rules? Two claims flagged: a promise of a cure and a before-and-after comparison, both banned by German health advertising law 5. Gateway: cost Every call is booked to a team, even if the copy never goes out, and logged with role and model. That keeps AI cost visible per team. What did it cost, and who is it booked to? Booked to editorial, healthcare client 6. Sign-off Nothing leaves the building without a person’s sign-off. Not this time: back to the editor. Who signs off before it leaves the building? Returned to the editor, not approved 7. To the client Editorial revises, a person signs off the new version. Only then does it go to the client. Revised, then signed off by a person ## A five-figure number of AI calls a month. All through the same layer. Every AI request from across the company passes the same layer with six stations and is booked with its cost. What has already been answered takes a shortcut. What breaks a rule goes back. Before anything leaves the building, a person signs off. ### You are at the sign-off. Three results from our daily work, each after the review. Decide what happens next. Then see how we decide, and why. Review · Cost ledger · Approval · in-house · outside · Approve · No sign-off needed · Send back ____ 1. Editorial #### Check ad copy for a clinic Review: Health advertising law: 2 claims flagged (cure promise, before-and-after) Where it goes: Goes to the client and will be published. **How we decide : Send back.** Two claims break health advertising law. Whatever breaks a rule goes back to the editor, even if the rest reads well. 2. Sales #### Analyze competitors for a proposal Review: Every statement linked to a source Where it goes: Goes into a proposal for the client. **How we decide : Approve.** Every statement has a source, but the proposal leaves the building. So the head of sales reviews it before sending and signs off. 3. Account management #### Summarize a long client email Review: No rule affected Where it goes: Stays in the team, as a note on the email. **How we decide : No sign-off needed.** The summary stays in-house and can be checked against the email at any time. Signing off every result would only slow things down. The rule behind it Whatever breaks a rule goes back. · Nothing leaves the building without a person’s sign-off. · Whatever stays in-house and is easy to check runs without sign-off. [Check a workflow of your own](https://carl-wuerfel.de/en/ai-automation#pruefen) ## The most important layer is the one nobody sees. A single request, station by station: who is asking, whether the result already exists, which model is enough, what the review finds, what it costs and who signs off. Try a run. · 1. **Access** Who is asking, and is this role allowed to? 2. **Cache** Is there a valid result already? 3. **Model routing** Which model is enough for this task? 4. **Review** Does the result follow the rules? 5. **Cost ledger** What did it cost, and who is it booked to? 6. **Approval** Who signs off before it leaves the building? 1. **Access** Editorial role, healthcare client: review required · 30 ms 2. **Cache** No valid result available · 40 ms 3. **Model routing** Standard model: text review does not need the largest model · 1.4 s 4. **Review** Health advertising law: 2 claims flagged (cure promise, before-and-after) · 600 ms 5. **Cost ledger** Booked to editorial, healthcare client · 20 ms 6. **Approval** Returned to the editor, not approved · 30 ms Cost of this run: €0.03 · Time 2.1 s Illustrative values. No real clients, volumes or costs. ## What I learned from the AI transformation. 1. ### Order before speed. Workflows and the foundation first, tools second. We build with the people who do the work, and never run more at once than the team can carry. 2. ### Switching off is an achievement. A system nobody uses costs attention and trust. We define in advance how we will recognize failure, and we end applications that miss the bar. 3. ### Rules at the only door. Cost limits, data protection and reviews only work if no request can bypass them. Hence one shared layer instead of rules inside every tool.