Digital transformation for the CEO: ROI, tax credits, security and disruption

How should the return on digital transformation be defined and tracked?

Digital transformation is not buying software. The order is:

1. assess the current state and digital maturity
2. set the processes to improve and how to measure them: the baseline, the method and the review frequency
3. then choose the systems (ERP, MES, IoT, AI)
4. lay out a roadmap with controlled risk

The three common starting points need different first steps: paper- and manual-based processes start with process mapping and metrics before choosing systems; an ERP disconnected from the shop floor starts with integration and data governance; a digitised company wanting AI starts with data governance.

If you only deploy a single packaged application, the process does not change and no equipment connection or cross-system integration is involved, the software vendor's support is usually enough.

Are there tax incentives for digital transformation investment?

Assess the investment tax credit under Article 10-1 of Taiwan's Statute for Industrial Innovation. According to the Industrial Development Administration and the Ministry of Finance, after the 2025 amendment:

• Items: smart machinery, 5G systems and cybersecurity remain, with artificial intelligence and energy saving and carbon reduction added; licensed software recognised as an intangible asset is also included
• Period: from 1 January 2025 to 31 December 2029; only orders placed from 1 January 2025 qualify for the new items and cap
• Cap: the amount eligible for application rises from NT$1 billion to NT$2 billion
• Procedure: the implementing rules were issued on 27 November 2025; delivery or technical service must be completed within 2 years from the day after ordering, and the credit is claimed in the year of delivery

Whether specific equipment or services qualify and how the credit is calculated are for your statutory auditor to judge under the implementing rules and the facts.

Once equipment is connected and systems are integrated, security risk grows. Who owns it?

Connecting equipment and integrating systems widens the attack surface, but the risk can be managed by building matching security controls at each stage instead of digitising first and patching later.

The CEO should confirm three things:

• Scope: whether new cloud, data and equipment assets are inside the ISO/IEC 27001 information security management system scope, with risk assessment and treatment plans
• OT security: once production equipment is connected, how OT and IT are separated into zones and conduits under IEC 62443, and the target security level of each zone
• People and equipment: Article 9-1 of the Regulations Governing Establishment of Internal Control Systems by Public Companies requires adequate human resources and equipment to plan, monitor and carry out information security management

These regulations apply to public companies; non-public companies are not bound by them but can follow them voluntarily.

What if a system cutover stops the line or blocks shipments?

This must be handled at the planning stage, not on go-live day. The CEO should ask: how do we keep shipping if a cutover or go-live causes an outage?

The approach is to bring enterprise risk management, information security and business continuity management into the transformation plan together:

• use a business impact analysis (BIA) to assess disruption losses and maximum tolerable downtime, and derive recovery time objectives (RTOs)
• arrange backup and fallback options for the cutover period
• exercise and keep records: a plan without a BIA and exercise records counts as non-existent in audits and customer reviews

Where a formal business continuity management system is needed, see ISO 22301 business continuity management.

The transformation will use employee or customer personal data. What should we watch?

Once data is centralised, personal data risk is centralised too. The CEO should confirm two things:

• Lawfulness: whether every batch of personal data is collected, processed and used for a specific purpose with a legal basis (Articles 19 and 20 of Taiwan's Personal Data Protection Act)
• Data governance: how data quality, access rights and retention are managed, and who can access what

If the data concerns people in the EU, the GDPR also applies; sending an EU subsidiary's data back to Taiwan within the group may be a cross-border transfer. See GDPR consulting.

What should go to the board on digital transformation? Does it belong in the annual report?

The board should see investment and metrics:

• the operational metrics to improve, their baselines and review cycle
• roadmap, budget and progress
• the security, disruption and personal data risks digitisation brings, and the responses

For public companies, Article 20, item 6 of the Regulations Governing Information to be Published in Annual Reports of Public Companies requires an analysis of the effect of major domestic and foreign policy and legal changes and technological change (including cybersecurity risk) on the company's finances and business, with responses; the effects of digital transformation can be included there. These regulations apply to public companies; non-public companies are not bound by them but can follow them voluntarily.

How does Winners Consulting help the CEO drive digital transformation?

VP- and director-level consultants lead the work end to end, never outsourced, applying Security by Design so security controls are built at every stage.

• Assessment and roadmap: assess digital maturity, identify opportunities in process automation, data integration and AI, with a digitisation risk assessment alongside.
• Integration with security built in: help select and deploy ERP, MES, IoT and AI tools, with an OT/IT security architecture aligned with ISO 27001.
• Data governance: a governance framework for data quality, data security and data sovereignty.
• Business continuity: enterprise risk management, information security and business continuity management built into the transformation plan.
• Change and results: organisational change management and quantifiable digital metrics.

Read more: Digital transformation consulting, Choosing a digital transformation consultant, Choosing an AI transformation consultant.

Request a free mechanism diagnosis