Low-code for SMEs: Governance is key

5 min read

Low-code platforms enable business and IT teams to develop applications using visual tools. For SMEs, this can be a way to improve internal processes more quickly. What matters is who approves an application, what data it processes and who is responsible for its operation. These questions need to be addressed before the first production deployment.

Where low-code can help SMEs

What is low-code? Low-code is a development approach in which visual components and models take on some of the programming work. Depending on the platform and the task, additional code may be needed.

Potential pilots include internal approvals, an overview of service requests or an application for recording master data. The benefits depend on the process: a digital approval process is particularly helpful when the people involved agree beforehand who makes each decision and what happens in an exceptional case.

A business team can describe the requirements and create an initial design. IT works with the team to review integration with existing systems, access and ongoing operation. Additional reviews should be planned for applications involving sensitive data or affecting customers.

Rules to establish before starting

Governance defines who may develop applications, how they are reviewed and who supports them after approval. A simple register should record the purpose, responsible person, data sources and interfaces of each production application. It should also name a deputy in case the responsible person is unavailable or leaves the company.

Separate environments are recommended for development and production. Before approval, permissions, data processing and key exception cases should be tested. Changes also need a traceable path from the initial request through to renewed approval.

Microsoft’s documentation on data policies shows what technical guardrails can look like: in Power Platform, organisations can define which connectors are permitted in an environment and which may be combined. The appropriate rules depend on the data and business processes involved.

A centre of excellence, or CoE, can maintain these rules and support business teams. This does not necessarily require a separate department. In smaller companies, IT, data protection staff and business teams can share the work, provided responsibilities and available time are clearly defined.

Compare platforms by cost and data access

When selecting a platform, what matters is whether it can securely access the required data sources and whether access rights can be assigned appropriately. Testing, logging, vendor support and the ability to export data when switching platforms are equally important. A shared pilot using the same requirements and test cases can help compare platforms.

The price comparison should cover all intended users, required connectors, storage and external support. Internal time spent on training, review and operation must also be included. Existing licences can make it easier to get started, but they do not automatically cover every feature: according to Microsoft’s licensing overview, some Microsoft 365 licences include limited usage rights for Power Apps and Power Automate. Premium features are subject to separate licensing terms.

Before making a decision, companies should also establish which data and application components can be exported and in what format. Exporting data alone does not answer how business logic, interfaces and permissions can be recreated on another platform.

Measure the pilot against the business process

A suitable first use case has a clearly designated owner and a manageable amount of data. An internal request with a defined approval path can be a suitable option. Before starting, the business team and IT document how the existing process works and what improvement the pilot is intended to achieve.

Potential measures include processing time, the number of manual handovers and the effort required for corrections. These figures must be collected in a comparable way before and after the pilot. Implementation costs and ongoing effort should be included in the same assessment. Only then can the company decide whether to expand the application or whether another use case would make more sense.

If the application processes personal data, companies must assess their own role and that of the platform provider. The European Commission explains that processing on behalf of a controller requires a contract or another corresponding legal act. Appropriate technical and organisational measures should also form part of the assessment.

Frequently asked questions

Image source: AI-generated (November 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.