Ting Guides · For the CTO and CIO
How do you connect AI to your ERP, CRM and accounting without replacing them?
The short answer
You connect AI through the interfaces your systems already expose, not by replacing them. Start read-only: the AI pulls records to answer or prepare work. Add narrow write actions, such as drafting a quote or opening a ticket, only behind permission checks and human approval. The ERP, CRM and accounting systems stay the record of truth.
Reviewed by Abdullah Al-RashedUpdated
What it depends on
What each system actually exposes
List what your ERP, CRM and accounting system offer today: a documented API, read-only database views, scheduled exports, or only screens. An API with its own scoped account is the clean path. A nightly export can still feed read-only answers. Automating screens is the last resort, because it breaks quietly when a screen changes.
Which system owns each record
Decide, record by record, where the truth lives: the customer and credit limit in the ERP, the pipeline in the CRM, the posted journal entry in accounting. The AI reads from the owner at the moment it needs the data, and never keeps a second copy that people start trusting instead.
Whether the AI needs to act, or only to know
Many useful first steps only need the AI to know: answering a branch manager's stock question, or assembling a customer's installed units and open orders before a service visit. Writing back, such as creating a sales order, is a different risk class with its own controls.
Who the AI is acting for
Every request should run with the identity and permissions of the person asking, never a shared all-access account. If a sales rep can't see another branch's margins in the ERP, the assistant answering that rep can't either. OWASP names excessive functionality, excessive permissions and excessive autonomy as the root causes of excessive agency in LLM applications.[1]
How you will know when it is wrong
Agree before launch what gets logged (who asked, which records were read, what was written) and what sends an output to a person for review. Without that log you can't explain to an auditor, or a customer, why a figure appeared.
Which integration pattern fits which task?
Connections between AI and business systems tend to take one of three patterns. They differ in what the AI may touch, and in what can go wrong.
| Pattern | What the AI does | Fits when | The control that matters |
|---|---|---|---|
| Read and answer | Looks up records through the system's interface, then answers or summarizes | People search several systems to answer one question | The asker's own permissions on every lookup |
| Prepare and hand over | Drafts an entry or document, such as a quote or a credit-note request, for a person to check and submit | The work follows rules but needs judgement before it counts | A person approves before anything is posted |
| Act within limits | Makes one narrow, reversible change directly, such as updating a delivery status | The action is frequent, low-risk and easy to undo | One action per tool, limits, a log and an undo path |
In what order should you build it?
Map one task that crosses systems
Pick one task where people copy data between systems, such as answering a spare-part request from stock in the ERP, the customer's installed unit in the CRM and the account's credit status in accounting. Write down every lookup and every copy-paste in it.
List the interfaces and the accounts
For each system in that task, note the interface you will use, the service account it runs under and exactly what that account can read or write. Ask IT for a separate service identity per connection, never a person's login.
Build read-only first
Connect the AI to read the records this task needs and nothing more. Return only the fields the answer uses: a spare-part reply needs the part, its stock and lead time, the customer's unit and the credit status, not the whole customer file.
Test permissions before anyone relies on it
Ask the same question as two staff members with different access, and confirm each sees only what the source system already allows them. Fix any leak before go-live, not after.
Add one write action, behind approval
When the reads are stable, add the single most useful write action and route every instance to a person to approve. Loosen that only when the log shows the action is reliable.
Log, review, then widen
Log every lookup and action with the person, the records and the result. Review a sample each week at first, and add the next task only when the first one runs cleanly.[1]
Where does a connector standard like MCP fit?
What changes for companies in Saudi Arabia
General information, not legal advice. Each regulatory point summarises the official source cited beside it, as checked on the date shown under Sources; confirm how it applies to your company with your legal adviser.
Where the model runs is a data-transfer question
If the AI model or its hosting sits outside the Kingdom, customer and employee records sent to it may be a transfer of personal data. Article 29 of the Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H) sets conditions for transfer outside the Kingdom, including an adequate level of protection there and limiting the transfer to the minimum personal data needed. The Transfer Regulation sets the exemptions from those two conditions and the safeguards they require, such as standard contractual clauses (Article 4). Settle hosting with your legal adviser before live records flow.[2][3]
Names exist in two scripts
Customer names, item descriptions and branch names often sit in Arabic in one system and in English or a transliteration in another. Test lookups with both spellings, and with the transliterations your branches really use, before trusting a match across systems.
One task, three systems: is the spare part available?
ExhibitWorked example
Rasikh Industries, the HVAC plant of the fictional Rasikh Holding, answers spare-part requests from contractors and building owners by hand from three systems. This is how the read-only version splits the work.
- ERPReads stock and lead time for the partNo write
- CRMReads the customer's installed unit and warrantyNo write
- AccountingReads whether the account is on credit holdNo write
Assistant
Drafts one reply per request
Finance approvalAny order on an account on credit hold
The coordinator sendsNothing reaches the customer until a person sends it
| Step | Today, by hand | With AI connected, read-only |
|---|---|---|
| Check stock and lead time | A coordinator looks the part up on the ERP's inventory screen | The assistant reads stock and lead time for the part through the ERP's interface |
| Confirm the customer's unit | Someone checks the CRM for the installed unit and its warranty | It reads the installed unit and warranty status from the CRM |
| Check the account | Finance is asked whether the account is on credit hold | It reads the account's credit status from accounting |
| Prepare the reply | The coordinator types the reply and the quote request by hand | It drafts the reply; the coordinator checks it and sends it |
The decisionNothing in this version writes to a system: each system stays the source, finance still approves any order on a held account, and nothing goes out until the coordinator sends it. That is why it can go live first: the worst case is a wrong draft that someone catches.
Questions people ask
Do we have to replace our ERP to use AI?
Can the AI post entries straight into the accounting system?
What if one of our systems has no API?
What Ting does and doesn't do here
What we do
- We specify the connection in an AI Solution Blueprint: which records, which interfaces, which accounts, which permissions and which approvals.
- We build it on your systems' existing interfaces, with per-user permission checks, logging and an undo path, test it against the Blueprint's acceptance criteria, give your team the runbooks, and stay accountable for how it performs.
- We start read-only and add write actions one at a time, each behind its own tests.
Where Ting helps: Custom AI Implementation
What we don't do
- We don't replace your ERP, CRM or accounting system, and we don't build without an approved Blueprint.
- We don't connect a model to live records before the permission tests pass.
- We don't run a connection under a shared all-access account; each one gets its own scoped service identity.
Sources
Primary sources only, each read in full on the date shown.
- LLM06:2025 Excessive AgencyOWASP GenAI Security Project · checked
- Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H)SDAIA · checked
- Regulation on Personal Data Transfer outside the Kingdom, version 2.0 (August 2024)SDAIA · checked
