"IT strategy" sounds like corporate slide decks. Underneath sits a simple question: does our IT carry the business, today and in three years?
Updated 19 October 2026: Substantially revised: step sequence with scoring matrix, figures from the KfW studies, and the funding section as of September 2026.
Almost nobody can answer it. KfW Research puts it plainly: only 20% of German mid-sized companies have a digitalisation strategy at all. The figure tracks company size closely: 16% among firms with fewer than five employees, 45% among those with 50 or more (KfW Fokus Volkswirtschaft No. 387, June 2022, based on the KfW SME Panel).
For an SME, a workable IT strategy fits on a few pages. The scoring matrix I use for prioritising is below. Copy it, no sign-up, no download.
What a strategy measurably changes
The strategy is not an end in itself. In the same KfW analysis, a typical mid-sized company with a strategy pursues projects to reorganise workflows or digitalise products "roughly a third more often". It takes on digital sales and marketing initiatives "well over half as often again", and uses big data applications "more than three times as often". It also spends "well over half again as much" on digitalisation, just under EUR 29,000 a year in the model calculation.
That relationship is a correlation, not a proven cause: firms that plan invest more, and firms that invest tend to plan. For practical purposes the direction is enough.
Step 1: Take stock
What do you actually have? Systems, licences, contracts, accounts, dependencies. Without an honest inventory you are planning in fog. Unused licences and a forgotten legacy system usually surface at this stage, and both earn concrete points in the matrix later.
Step 2: Objectives and risks
What has to run for the business to run? Two numbers per critical system: how much downtime is survivable, and how much data loss. Then the three risks that actually materialise in mid-sized firms: outage, attack, and dependence on a single person.
On attacks, a figure instead of a hunch: "In recent years, just under a third of Mittelstand companies have fallen victim to cybercrime," states the KfW Digitalisation Report Mittelstand 2025 (p. 25). Those affected are "primarily larger companies and digital front-runners", though smaller firms increasingly become worthwhile targets as they digitalise. That is why multi-factor authentication and a tested backup usually end up near the top of the priority list even though no deadline forces them.
Step 3: Prioritise with points, not enthusiasm
This is where most lists fall apart. "Sort by impact" sounds sensible but produces whatever order occurs to the loudest person in the room. Four criteria, 0 to 3 points each:
| Code | Question | 0 | 1 | 2 | 3 |
|---|---|---|---|---|---|
| I Impact | What happens if it fails? | nothing noticeable | individual workstations | one department | the business stops |
| D Deadline | Is there a fixed date? | none | > 24 months | 12 to 24 months | < 12 months or already passed |
| T Time saved | How much time does it save the team? | none | < 1 hr/week | 1 to 4 hrs/week | > 4 hrs/week |
| E Effort | How long does implementation take? | < 1 day | up to 1 week | up to 1 month | longer |
Rank = (3 × I) + (3 × D) + (2 × T) − (2 × E) (maximum 24, minimum −6).
| Rank | Slot it into |
|---|---|
| ≥ 18 | this quarter |
| 12 to 17 | this half-year |
| 6 to 11 | the annual plan |
| < 6 | drop it deliberately and record the decision |
The weighting is my opinion, not a standard: impact and deadline count twice as heavily as effort, because effort is negotiable and an expired deadline is not. Three rules make the score usable.
A deadline beats a score. Anything with D = 3 goes into the next quarter even if its total rank is low. A missed deadline does not get cheaper while you wait.
Impact gets calculated, not estimated. What an hour of standstill costs you can be worked out with the IT downtime cost calculator. It calculates purely locally in the browser: no form that gets submitted, no server reading along, nothing stored, so you can use your real numbers. That turns I into a euro figure rather than an opinion.
The drop list is part of the result. Anything scoring below 6 is documented by name as "deliberately not done". That is precisely what separates a strategy from a wish list.
The fixed dates that populate the "deadline" criterion
D is not a matter of judgement: it is in the calendar. Through 2028, four dates carry most of the weight for German SMEs:
- 10 November 2026: end of support for .NET 8 and .NET 9. Anyone running in-house line-of-business applications should already have the move to .NET 10 LTS scheduled.
- 1 January 2027: e-invoicing, the obligation to issue applies to businesses with more than EUR 800,000 in prior-year revenue, and from 1 January 2028 to all B2B transactions. The stages and the XRechnung-versus- ZUGFeRD question are covered in the article on the e-invoicing obligation from 2027.
- Already passed: the BSI grace period for NIS2 registration ended on 31 July 2026. The legal obligation remains in force; affected companies should register without delay. This is the textbook case for D = 3 at an otherwise low rank.
- Recurring costs belong in the plan too, for example the Microsoft 365 price increase (see Microsoft 365 licence audit 2026).
Step 4: Budget and ownership
A strategy without a budget and without an owner is a wish list.
The widely quoted "3 to 5 percent of revenue" does not appear anywhere in the KfW surveys of digitalisation spending, and I am not aware of a primary source for it. Planning with it means planning with a number that has no origin. What does exist is measured spending. In 2024, digitally active mid-sized firms spent an average of roughly EUR 25,000 on digitalisation. The spread is wide: just under EUR 10,000 at firms with fewer than five employees, just under EUR 189,000 at those with 50 or more, around 19 times as much (KfW Digitalisation Report Mittelstand 2025, charts 17 and 18, reporting period 2022 to 2024).
Treat these as a plausibility check rather than a target. If your total is off by a multiple, either your list or your expectation is wrong.
For context on the wider picture: in the same report, the share of mid-sized firms with completed digitalisation projects fell by 5 percentage points to 30%, and total spending dropped by around EUR 8 billion to just under EUR 24 billion. Your competitors are currently investing less, not more.
Ownership is a decision, not a job title: what stays in-house, what goes outside, and who decides when it is unclear. For small firms a fixed monthly support allowance with a single named contact is often enough. What that looks like is set out on the IT support and maintenance page.
Step 5: Delivery and review
The strategy is not a document for the drawer. Thirty minutes twice a year: what got done, what changed, what moves up, what comes off the list. SMEs rarely need a tighter rhythm. The one thing that matters is that the drop list is read out at the review, otherwise everything quietly migrates back into the plan.
Funding: status as of September 2026
The most common flaw in articles on this topic is out-of-date funding advice. Two of the most frequently cited German programmes no longer exist:
- Digital Jetzt has ended. The funding portal states: "Das Förderprogramm ist ausgelaufen und das Förderportal wurde zum 31.03.2026 abgeschaltet." (The programme has expired and the portal was shut down on 31 March 2026.)
- go-digital has ended too. The official notice reads: "Das Förderprogramm go-digital ist am 31.12.2024 ausgelaufen. Es können keine Förderanträge mehr gestellt werden." (The programme expired on 31 December 2024 and no further applications can be filed.)
Still running is the BAFA subsidy for SME consulting, but on a clock. Within the validity period of the funding directive, which ends on 31 December 2026, each eligible company can have a maximum of five self-contained consulting engagements funded, and no more than two per year.
How much you get depends on where the company is based: 80% and a maximum of EUR 2,800 in the eastern federal states and the Lüneburg and Trier regions, 50% and a maximum of EUR 1,750 in the western federal states, in Berlin and in the Leipzig region. Companies in North Rhine-Westphalia therefore fall under the lower rate. Anyone who carries the widely quoted "up to 80%" into their budget is overstating the subsidy by EUR 1,050 here.
Three formalities decide between approval and rejection. The application goes in online through the BAFA application platform, and then you wait: "Erst nach Erhalt dieses unverbindlichen Informationsschreibens dürfen Sie mit der Beratung beginnen" (you may only start the consulting after receiving that non-binding information letter). Signing already counts as starting, because "als Beginn der Beratung [gilt] bereits der Abschluss eines Vertrages über die zu erbringende Beratung". And the format is prescribed: one-to-one consulting, no more than five days, and "Seminare und Workshops werden nicht gefördert" (seminars and workshops are not funded).
In North Rhine-Westphalia there is also MID-Digitalisierung, administered by NRW.BANK since 1 January 2026 and now much narrower in scope: it funds only the development of digital products built on artificial intelligence, machine learning, data mining, real-time processing or AR/VR. The former "digital processes" strand has been discontinued. It covers 50% of eligible investment costs up to EUR 15,000, with a EUR 4,000 minimum threshold, allocated by a monthly lottery followed by a 28-day application window.
Whether any of these fits your project depends on how it is scoped, something worth checking together before anything is signed.
What actually counts
IT strategy in a mid-sized company does not mean more technology. It means deliberate decisions instead of chance. Five steps, a few pages, a matrix with four columns and thirty minutes of course correction twice a year: enough to leave the 80% without a strategy behind.
Would you like a roadmap like this for your own company? In a free, no-obligation initial consultation we work out the first steps together.
Sources
- KfW Research: Mittelständische Unternehmen mit Digitalisierungsstrategie gehen die Digitalisierung aktiver an, Fokus Volkswirtschaft No. 387, 9 June 2022: the 20 / 16 / 45% shares (chart 1, source: KfW SME Panel 2021); the effect of having a strategy and the just-under-EUR 29,000 figure from charts 3 to 6 (model calculation based on regression analyses, 2021 and 2019 surveys).
- KfW Research: KfW-Digitalisierungsbericht Mittelstand 2025 (reporting period 2022 to 2024, published 2026): 30%, just under EUR 24 billion, roughly EUR 25,000 average, just under EUR 10,000 / EUR 189,000 by company size (charts 17 and 18), cybercrime on p. 25.
- BAFA: Unternehmensberatung programme page: running until 31 December 2026, a maximum of five consultations, work may only start after the information letter. Funding rates and regional caps, the five-day limit and the exclusion of seminars and workshops from the BMWE leaflet Förderung von Unternehmensberatungen für KMU (June 2025 edition); format and deadline rules additionally confirmed via esf.de. As of September 2026.
- Digital Jetzt: notice on digitaljetzt-portal.de, retrieved September 2026.
- go-digital: official notice Förderprogramm go-digital ausgelaufen (innovation-beratung-foerderung.de, 1 January 2025).
- NRW.BANK: Mittelstand Innovativ & Digital (MID): MID-Digitalisierung, retrieved September 2026.
Note: The articles on this blog are produced with the help of AI and are editorially reviewed before publication. Editorial responsibility lies with Emre Yurtbay (see the legal notice).