#147 - IT managers sometimes have to be spoilsports – Soennecken's IT chief on governance, sprawl and the courage to act
An AI bot rebuilds your software, based solely on the documentation. Sounds like science fiction? For Soennecken, that was exactly the reality. In this insights! episode, Joubin Rahimi talks to IT manager Claudia Lorenz about the moment that changed everything, and about Soennecken's bold path towards Agentic AI, Agentic Commerce and a new way of thinking about software. A conversation about governance, courage and the question of whether SMEs can simply skip the intermediate step.
7 min read

There are already topics that are simply still unclear. And in Germany we're known to tend towards not doing anything at first. And I don't think anyone can afford that anymore. That's over. So no matter where, then we have no chance.
"That wasn't so far off" - when your documentation becomes the vulnerability
Suppose you publish documentation of your most important software system openly online. So your partners and customers can look things up anytime. Perfectly logical. And then someone runs an AI bot over exactly this documentation. The result: the bot roughly reprograms your system. Not perfectly, but frighteningly close.
That's exactly what happened to Soennecken. The office trade cooperative based in Overath, with around 500 affiliated retailers and wholesale revenue of €200 million, had made the documentation of its procurement system So.PROCURE publicly accessible. When the team tested an AI bot on it, the result was a shock. Claudia Lorenz, IT manager at Soennecken, puts it succinctly: the bot was really close. The consequence? The documentation went offline immediately.
What sounds like an anecdote is in truth a wake-up call. Because if a freely available AI bot can recreate an industry system based on public documentation, the question arises: how secure is what you communicate about your systems externally? For SAP, Salesforce, Ariba and co., this question should be just as relevant.
From the Quill to the Software Agent: Who is Soennecken?
Anyone who hears Soennecken thinks of flipcharts, hole punches and ring binders. And yes, all of that is part of the history. After all, the lever arch file traces back to founder Friedrich Soennecken. But today's Soennecken eG is far more than an office supplies provider.
Soennecken is a cooperative with around 500 members, all office retailers, who benefit from a broad range of services: in-house logistics and wholesale, IT solutions including shop system and article data management, electronic order processing and a central settlement model that essentially works like a banking model. Relevant wholesale revenue is around €200 million, with the central settlement business accounting for a further €500 million.
The shift in product range is fascinating too. Where paper and folders used to be the core business, quite different products have long since been added: coffee and fruit baskets for the office, hygiene articles (increasingly so since Covid), workplace safety gear and even Makita-brand drills. Soennecken no longer thinks only in terms of offices, but also of trade businesses and hybrid working worlds.
Agentic programming: why Soennecken lets AI agents into development
The day after the conversation with Joubin Rahimi, Claudia Lorenz's team kicked off Agentic Programming. The goal: AI agents should take over the repetitive parts of software development. Everything that requires little specialist knowledge but still eats up time is to be automated. The framework is described via specification, the agents implement it, and at the end the team checks quality and security.
What becomes clear: Soennecken's real asset isn't the code. It's industry knowledge. Soennecken's developers understand what the business department needs after the third word. They know the processes around approval procedures, central invoicing and procurement inside out. This knowledge can't simply be poured into a prompt, and that's exactly what makes the difference.
The first use case: a small agent that guides users of the procurement system through approval processes. Start small, learn, scale. An approach that is typical for the Mittelstand and works.
IT governance vs. drive for innovation: why IT leaders must be spoilsports
Claudia Lorenz is refreshingly honest about downsides of AI revolution. Azure costs rising. Storage getting more expensive, because AI genuinely devours it. And tool sprawl is real: everyone in company finds new AI tool, builds themselves automation, and after half year nobody knows anymore what's running in background. As IT lead she sometimes has to be spoilsport. But that's exactly part of role. Governance doesn't mean preventing innovation. It means creating framework in which innovation can happen without security suffering. Soennecken just passed ISO 27001 certification with special commendation, and Claudia Lorenz doesn't want to give up this level again. Add to that a theme many underestimate: price transparency. In trading business, prices must be traceable to authorities. If AI makes pricing decisions in background, how do you explain that to competition authority? These regulatory questions still unresolved, but pushing them aside no longer option.
Agentic commerce instead of perfect search: simply skip the intermediate step?
Perhaps the boldest statement in the whole episode comes towards the end. Claudia Lorenz asks herself whether Soennecken still needs to go down the path of perfect search and the perfect article data at all. Or whether it's smarter to skip this intermediate step and invest directly in agentic commerce.
The logic behind it is compelling: if SAP customers handle their purchases via AI agents within a few years and the MCP protocol becomes the standard, then retailers such as Soennecken members need to be able to understand and service these requests. Anyone who only starts engaging with this topic then is too late.
Claudia is honest: she doesn't have all the answers yet. But she has the right mindset. And she has the courage to question the status quo instead of clinging to optimising what already exists.
"Nobody can afford that any more" – why waiting is toxic in the AI age
There's an attitude deeply rooted in many companies: wait, check, check again, and then maybe dare a small step. In Germany this caution is almost culturally ingrained. Claudia Lorenz disagrees: anyone who still wants to afford that has already lost.
Their approach: do it. But with sense of responsibility. Fall flat enough that damage stays manageable. Then learn from it. Next trend comes in three months anyway, so no point waiting for perfect plan.
A fellow student of Claudia's rolled out AI together with his clients. Everything well thought through. But in the test version, clients had already entered real data. Then it got hacked. Data breach. It shows: perfect security doesn't exist. But awareness and a conscious approach to risk make the difference.
What IT decision-makers can take from this conversation
The episode with Claudia Lorenz isn't a glossy success story. It's an honest look behind the scenes of an organisation that's in the midst of change. And that's exactly what makes it so valuable. Here are the key takeaways:
Check your public documentation. If a bot can rebuild your software from your docs, you have a problem. Not tomorrow, but now.
Your asset is the industry knowledge, not the code. AI can write code. But it cannot understand why your customer needs certain approval processes. Invest in your teams' knowledge.
Start with small agents. You don't need a master plan. An agent that guides users through a process is a good first step.
Governance is not an innovation killer. It's the precondition for innovation to work sustainably. ISO 27001, clear tool guidelines and cost control aren't brakes, but guard rails.
Dare to skip the intermediate step. Not everything has to be perfect before you take the next step. Sometimes it's smarter to jump straight to where the market will be in three years.
Would you like to listen to the full episode?
Find the podcast of the interview here:
Please accept the corresponding cookies to view this embedded content.
Prefer to watch the episode? No problem!
You'll find a recording of the interview here:
Please accept functional cookies to watch this video.
Prefer to read?
Joubin Rahimi
Great to have you back for a new episode of insights! My name is Joubin Joubin Rahimi, and today on the couch with me is Claudia Lorenz from Soennecken. Hi Claudia.
Claudia Lorenz
Hello. Glad to be here.
Joubin Rahimi
Absolutely delighted. And that came about completely spontaneously via the post on LinkedIn, though we'd actually seen each other briefly in the morning, and bang, here we are, able to chat.
Claudia Lorenz
Exactly, I thought I'd just make a silly comment and now I'm sitting here.
Joubin Rahimi
I'm serious. Maybe you'd like to say two, three sentences about yourself, your role, about Soennecken.
Claudia Lorenz
Yes, exactly, I'm Claudia, I'm at Soennecken. Soennecken is an office supplies trading cooperative. So we have around 500 office retailers. We deal with, unsurprisingly, office supplies trading. I head up IT at Soennecken. So I'm not really the marketing expert. I often just have to deal with the fallout of what people come up with. I come from a software development background myself and once thought trading would be quite simple, and was taught otherwise
Joubin Rahimi
And I think you've already broken the ice. I get to deal with what others think up. Marketing, sales, they always have wild ideas. No governance. Just doing it is probably the way.
Claudia Lorenz
That would be great. Exactly. So we're meant to move quickly, but afterwards it should run stably.
Joubin Rahimi
I've also worked in software development, same as you. We know it just doesn't work like that. Let's start with Soennecken. So I first had contact with you when I started my career. The flipcharts with Soennecken. Very smart, always the epitome. But what exactly do you do? I don't think everyone really knows you.
Claudia Lorenz
One question. Are you one of those who use the back of the flipcharts so there are no lines on it?
Joubin Rahimi
I only take back side.
Claudia Lorenz
We need to print our logo on the back. That was a consideration we had. Otherwise I've forgotten your question.
Joubin Rahimi
Yes, but have you done any studies on that, that most people flip it round?
Claudia Lorenz
I see this in many workshops, that the people, the moderators, always turn it around.
Joubin Rahimi
That's probably much nicer. The question is, what does Soennecken actually do? Because you're not a paper manufacturer, you have a much bigger remit that most people, I think, aren't even aware of.
Claudia Lorenz
Exactly. Ultimately we really do have a support mandate for our members. As I said, these are office retailers, so there's a great deal involved. On one hand we have our own logistics, so we're a wholesaler. Members can buy from us, can do away with their own logistics as a result. We're effectively their extended logistics arm. We provide members with IT solutions, and the shop alone isn't enough for that. We also have product data with images, with all the information needed. Then of course the electronic processing of orders, and there's also a kind of banking model, called central settlement, or for the SAP folks, agency business. Meaning we pay the suppliers' invoices on behalf of our members and then bill it onward. Several strands that we serve.
Joubin Rahimi
How many members do you have, then?
Claudia Lorenz
We have around 500 members. I can't say exactly, but it ranges from small retailers or a small town's smaller retailers we have, right up to large multi-site retailers who really supply entire areas with office supplies in B2B.
Joubin Rahimi
Just to get a feel, you not small in revenue either. Don't know if you share figure publicly or not, but well over 50 million.
Claudia Lorenz
Right, I'm bad at remembering revenue figures. Our relevant revenue is first of all the wholesale figure, because that's really backed by work and productive labour. That's roughly €200 million, and the rest of the business in central settlement is I think around another €500 million, though we merely pass that through, so it's not directly our revenue.
Joubin Rahimi
But so that everyone already knows this: you're not a small player, real work actually happens there.
Claudia Lorenz
Yes, and IT really matters a lot here, because trading business pays off in this environment, especially when we're small. We ship pencils, we ship notepads, so it has to work as close to perfectly digitalised as possible, otherwise there's no need for us.
Joubin Rahimi
And you also have the contract for the retailers on that. Office supplies will probably also, is home office changing more towards remote, how much paper, so how much is still printed? That is changing, isn't it?
Claudia Lorenz
That's a good point. Yes, that's changing. And the season was and still is always in January, because many companies traditionally stocked up on folders with paper. If you need that, you need hole punches, you need binding strips, you need trend sheets. That's of course declining sharply. I don't know how many folders you still have in your office. I don't have any left. And Post-its alone don't make up for it. And what we're now looking at is simply how we expand the ranges, because offices keep developing, despite home office. Many companies are also starting to go back to the office more and simply take a look. In the office you need coffee, you need biscuits, very important, fruit baskets, of course office furnishings, and hygiene has been added, boosted also during the Covid period, but it's been added. Meanwhile there's also workplace safety with us, or Makita drills. So we're now very broad in that regard and no longer just look at offices, but also at smaller trade businesses.
Joubin Rahimi
And for IT. You develop software for the members too, or the members can use the software you provide. How do you see the software development process there? So what's changing in that regard
Claudia Lorenz
a lot right now.
Joubin Rahimi
So tomorrow, how can we put it without startling anyone?
Claudia Lorenz
Yes, we gave ourselves quite a scare. We had the documentation for our procurement system available online, so that all members, all retailers, all customers could always look things up there, and we then ran one of those well-known bots over it and had it programme our so-called Procure system. And it wasn't far off at all. So we've now taken the documentation off the web for the time being, because it really contains a lot of specialist procurement knowledge around office supplies, how banks handle approval processes and similar things. So we've now secured that for ourselves to some extent. And for us it's just getting started. We're not actually that many people in development, and we benefit from having had very long, very stable customer relationships with our retailers for a long time. And the development team we have too — these are colleagues who've known Soennecken for a very long time, you don't need to explain office retail to them any more. They understand the requirements from the specialist department after the third word. The difficult thing is always coming up with new ideas when you're in this environment, when you're always working with the same colleagues in this way. But we're managing that switch well right now — tomorrow is really the kick-off where they start engaging with agentic programming. One person has worked it all out, and we're starting now and really want to build agents right across the board, starting with a small test balloon for our procurement system, so that there's a small agent that helps users, for example, through approval processes.
Joubin Rahimi
Really exciting at first to reverse-engineer from the documentation.
Claudia Lorenz
Not possible any more, we removed it.
Joubin Rahimi
Right, but for everyone else, if you've got your docs out there or need to reprogram Ariba.
Claudia Lorenz
I do not know where the limits are, but we were really proud of our system, and it was really quite something. So, initially in the first scope of functionality, we did not touch the architecture at all, we did not do any of that. We more or less dropped it in fairly simply, but the result took us by surprise.
Joubin Rahimi
So, hello SAP, hello Salesforce. What are you doing with the documentation? Use chatbots, no more manuals, go agentic. You don't mean agentic is a huge topic area. Let me ask openly, which one are you tackling starting tomorrow, where you said, the kickoff, then you won't even be here tomorrow at the ECC FORUM
Claudia Lorenz
That's why I'm not here tomorrow. But we have the kick-off. We've only just had the kick-off, we're not working on anything yet. But our idea is indeed that everything around it, which is otherwise fairly mundane development work, that doesn't need that much specialist knowledge, because the specialist knowledge is our asset. My IT only needs it when we need to understand Soennecken, otherwise it can be outsourced. So our asset is precisely the industry knowledge, knowing the colleagues in the specialist departments. But what we will and must learn is describing that via specs, so really describing specifications that are then able to develop software components, create the framework, and of course test AI again at the end. But we want to retain sovereignty everywhere, especially IT security, a very important topic. We just achieved ISO 27001 with special commendation, we don't want to give that up again either. So our picture is that there are many small agents around it, but the core of development is still quality-assured and secured by us. How we need to do it, none of us know yet. We'll learn it.
Joubin Rahimi
Main thing is we'd already had a few conversations here and everyone who looked into it said, just get on with it, take a step forward. The parent company is Time to Act. That fits entirely with how we think.
Claudia Lorenz
You can't plan for it anyway, because in three months the next trend will already be here.
Joubin Rahimi
And so this morning I opened Perplexity again. Perplexity has brought out a new variant now. You can now tell Perplexity, for example, please create an SEO analysis of my website and the competitor websites once a week with recommended actions on what we should do, and send this every week to me and the three colleagues. Here are the e-mail addresses. It practically builds the agent itself, so N8N and whatever they're all called, gone. Don't need to deal with it any more either.
Claudia Lorenz
You still have to organise all this somehow. I was at Microsoft's AI roadshow two weeks ago and we're currently switching from Microsoft's Data Factory to Fabric, where colleagues will presumably in future be able to enter their analysis queries by voice, via prompts. But that also has advantage that you can really build data agents, and I originally come from era of relational databases, super normalised models, maybe not quite, but that was also most important thing during studies. And Microsoft will also enable building an ontology between data, so that data knows, so AI knows how our data relates, so it can answer questions better. I'd really fancy playing around with it right now. But I know I'd lose myself in there and resurface in six months.
Joubin Rahimi
Don't you have to play around a bit right now? Don't you have to do that or
Claudia Lorenz
That for sure.
Joubin Rahimi
So in the evening, when I look at something again, yes, I'm one of those Insta users, and when I have a feed like that, it's the same with Perplexity. Just try it out directly. The crazy thing is, 267 dollars or euros, I'm not even sure now, that's what the licence you need for it costs per month. So starting from ChatGPT at 200, 267 euros is already quite a lot.
Claudia Lorenz
So from an IT manager's perspective, looking at it from internal IT, it's all already quite disastrous, of course.
Joubin Rahimi
Total.
Claudia Lorenz
So Azure costs are rising for us, we're very much oriented towards Microsoft, because I hope that Microsoft, with the new plans they have regarding digital sovereignty, might actually help us establish this security, even though it's Microsoft. But the costs aren't always easy to estimate. But ultimately that has to be organised. Storage is also getting expensive, apparently. So yes, AI is currently eating up the storage.
Joubin Rahimi
I can already see that on the invoices.
Claudia Lorenz
Exactly. And what I was getting at, which is really hard to manage, is this sprawl. So maybe you come up with something nice, something that runs automatically in the background, then you're not around for a while and after six months something stops working. Of course the providers offer options for that too. But at some point, from an IT management and governance perspective, you have to limit the number of tools, and then you're the spoilsport. But that's part of the role.
Joubin Rahimi
That's interesting, because of course we have that discussion too. Who uses which licences, which ones can we switch off again because you're not using ChatGPT any more or you have a different model that also includes ChatGPT, like some Langdoc or you name it or Anti Gravity, and then you've got the models in there too. But so much changes so incredibly fast. And if you have a process that's fairly normal – I have a requirement, I want to try out a tool that maybe isn't there yet, and I hand that to IT, who first review and test it and then it goes into the processes, is it GDPR-compliant, we need to add it to the list – then by the time that's done the next tool is already here, and we haven't achieved anything. How do you deal with that?
Claudia Lorenz
That's really the challenge. Holding that balancing act. First you can try things out. We're very good at that in IT ourselves, trying something out and not seeing it through. But at some point you have to look more closely. I have a colleague, or a friend from university, who introduced an AI for their clients, built it together, thought it all through carefully, the community contributed financially to it, and it got hacked. It was still in the test version. Even so, his clients had already used real customer data, and there's your first data protection incident, and you'll never have it fully under control. But you should look closely in the right places, not overdo it, because not every piece of data is really worth protecting to the point of long discussions, but you need to keep an eye on it. And I think the most important thing is that everyone has the awareness, then not much happens either. But you have to safeguard it in some way, because in the worst case, quite simply, if the authorities at some point want to trace how prices came about — as things stand today that's still sacrosanct — it must be possible. How do I explain to them what the AI was thinking in the background?
Joubin Rahimi
I don't know your business. Luckily we don't have to explain our prices, but you probably have the competition authorities.
Claudia Lorenz
It's really a topic actually, if it comes down to it. I always mix that up, I think. So everything that has to be archived is partly also the derivation of prices, if you derive them the way we do. And it can be that this is different in retail than when you sell IT licences. But there are certainly topics that are simply still unclear. And as we all know, in Germany we then tend to prefer doing nothing at first. And I think nobody can afford that any more. That's over. So no matter where, even here in this room, then we have no chance.
Joubin Rahimi
It's also always easier to say that doesn't work, because I don't believe that. Because you never do anything wrong if you never do anything. Just try it once.
Claudia Lorenz
Right, just get on and do it, maybe fall flat on your face sometimes with enough sense of responsibility that falling flat isn't a major setback, and then I think that's fine.
Joubin Rahimi
Yes, we talked about that during the Agentic session. But what about the topic of agentic protocol, agentic commerce? Is that something for your retailers, or is it still far too early?
Claudia Lorenz
I don't know either. I'm currently sort of wearing the IT director hat, because at the moment people sometimes still argue about an article date. We still have small problems, like the unit of measure piece can't be converted into pack. So we actually have very good data, but every now and then you get these edge cases again. The supplier sends it differently. It's still down to little things, and the search in our shop isn't perfect everywhere either. Grounds for criticism. And my thought is whether we shouldn't just, let's say, skip the super perfect search, the super perfect date, and instead focus on this. What does it look like in three years, and what do our retailers need so they can take on requirements from agentic commerce, when SAP customers do all their purchasing only via this route. I have far too little idea of what that will look like. I'm glad I now know the term MCP protocol. So we're still a bit behind, but that's exactly what we should be dealing with, so that maybe, coming from We're not perfect in e-commerce right now, we make the leap forward, perhaps have good ideas for B2B and agentic commerce.
Joubin Rahimi
You already have quite a bit. I also think, compared to other companies, you do a lot. In that respect I wouldn't hide your light under a bushel at all. Not at all.
Claudia Lorenz
That's true. But I'd like this to move forward, back to the very top, because with the procurement system we were right at the front in 2002. It's still very good, still in demand. That means it might not last another 20 years in future, but if you're right at the front, you have a good position again, and that's where I'd like to be again.
Joubin Rahimi
I think that's a brilliant conclusion given the ambition. We also had someone else here, Bastian Siebers from Flaconi. He also said that even if I set the standard, next year the standard wants to move forward, and I think that's brilliant. Thanks, and thanks again for the insights. No documentation online. Then reverse the software engineer. IBM has a lot of software online, freely accessible or open source software. Exactly.
Claudia Lorenz
And if you put the agent online, you should also make sure it doesn't respond to the wrong people.
Joubin Rahimi
One last anecdote. An agent actually called me, and this time it picked up too – and the first time I just clicked away. The second time I asked who they'd called before. He told me. What was the content of the conversation? He told me that too. I hung up and called the company. That's really poor, what you've got going on out there.
Claudia Lorenz
That's right. You noticed it.
Joubin Rahimi
Yeah exactly. But first time I just went, ugh, how annoying. Second time. I want to try it. And it was such lucky punch. I think they made that themselves. Anyway, thanks for the time, thanks for the insights and we'll see each other again in month, six, seven weeks on Insights stage.
Claudia Lorenz
Exactly. Great. Thank you.
Joubin Rahimi
Happy to. Thanks.
Claudia Lorenz
Thank you.
Have questions or feedback?
Then feel free to contact us directly.
- Joubin Rahimi
Managing Partnersynaigy
Show phone numberShow mobile numberShow email address
Subscribe to the blog now and never miss any news
✔️free of charge ✔️weekly news ✔️expert knowledge
Please accept the corresponding cookies to view this embedded content.
