Why most AI projects never make it to the CRM
60-70% of "successful" AI projects that end in POC never make it to real production. The main reason is predictable: CRM integration is the phase teams systematically underestimate. Without a real connection to the CRM, the AI produces pretty suggestions no one executes — and that's not "phase 1", that's the end of the project.
Plugging the AI into your CRM is not optional or "for later". It's the difference between an assistant that suggests and a system that executes. If your vendor proposes splitting that phase off and "we'll connect it in V2", V2 most likely never lands.
The 3 layers: read, write, execute
- Read. The agent reads data from the CRM — contacts, opportunities, activity, notes — to understand context before deciding.
- Write. The agent writes to the CRM — creates contacts, logs activity, updates fields. This is where risk shows up: one bad write can pollute your base.
- Execute. The agent triggers actions that live in the CRM — fire sequences, assign leads, move opportunities between stages. Cost of error is at its highest here.
HubSpot · Pipedrive · Salesforce: what changes between them
| Aspect | HubSpot | Pipedrive | Salesforce |
|---|---|---|---|
| API | Well documented, ergonomic | Simple, limited on custom | Powerful, complex, needs expertise |
| Rate limits | Generous on paid plans | Reasonable | Varies by license |
| Custom objects | Limited on lower plans | Limited | Very flexible |
| Webhooks | Well implemented | Functional | Excellent but complex |
| Technical integration cost | Low-medium | Low | Medium-high |
Security and permissions (what your DPO will ask)
Before getting into CRM specifics it pays to have the general frame settled, because it applies identically to every system you connect afterwards: what permissions to give an AI agent works through the reads/writes/executes/never-touches matrix, the dedicated service credential and revocation tested cold.
Before connecting AI to the CRM, your DPO is going to ask three things. Having the answers ready saves you months of blockage:
- What personal data is sent to the LLM, and under what conditions? You need to know it field by field and have it documented.
- Does the LLM provider train on that data? OpenAI and Anthropic business plans: no. Confirm it in your specific DPA.
- Is there an audit trail of what was sent, when, and for which decision? Encrypted logs with minimum retention.
Recommended patterns
- Rule-based validation before writing. Every write action passes validation (format, ranges, field existence) before executing.
- Human confirmation on critical operations. Any action affecting opportunities >$X or top-tier customers requires confirmation before executing.
- Structured, reversible logs. Every action must be reversible in under 1 minute.
- Initial sandboxing. Roll out first in a test environment or with a subset of accounts for 2-4 weeks.
- Continuous quality metrics. % correct actions, % human escalation, % detected errors.