What to automate first in a small business

Quick answer

Start with work that repeats often, has a clear beginning and end, runs on data you already have, and fails in a way a person can catch before it reaches a customer, the bank account or a contract, which is where errors get expensive. The first pilot is not there to prove your company needs AI. It is a narrower question. Whether this one task can be done more reliably, faster, or with fewer corrections that somebody rekeys by hand afterwards.

Inventory the work before choosing a tool

Do not pick a process because it looks impressive in a demo. For one week, write down the recurring steps, the inputs, the decisions, the outputs, the exceptions, and the person who owns the work even though no org chart says so. That is your process inventory.

This scoring is our proposed way to compare candidates, not a NIST standard or a legal test. Rate each factor from one to five, with five indicating greater opportunity or readiness.

The total ranges from 8 to 40. Rework points indicate an opportunity, not the severity of possible harm. The three-point threshold used next is also a proposed internal rule that should be adapted to the process risk.

Legal, financial, or people impact is a separate eligibility gate, judged on its own. A process only enters the ranking when it has a named owner and scores at least three for rule clarity, data readiness, and reversibility, and anything short of that stays off the list. Reject any candidate where an unsafe output could pass without human review. Then rank what is left by total score. On a tie, take the smaller reversible scope, and the result you can measure sooner.

Our AI and automation service can help distinguish a small pilot from a brief that already needs a custom system.

Keep four forms of automation separate

Simple workflow automation moves data or notifies someone after a clear trigger. Rules automation decides from conditions that a human wrote down in advance. AI assistance proposes a summary, classification, or reply, and nothing leaves until someone confirms it, which is the property that makes it safe to try first. An autonomous agent is a different animal. It chooses its own steps and uses tools in a wider context.

The first or second form is usually right for a first pilot. AI assistance fits unstructured text as long as human review stays in. Do not deploy an agent because it is fashionable. NIST AI RMF calls for risk management through design, use, and evaluation, and the European Commission describes the AI Act as risk based, which together are a practical reason to begin with a smaller, reversible scope.

Choose a pilot that can be stopped

A useful pilot has one business owner and one technical owner. Its input and its output fit in a single sentence. It might sort incoming enquiries, draft a reply for review, or check that the document is not missing half its fields before it reaches the person who has to act on it. It must not send a payment. It must not alter a contract or decide anything about a person without approval.

Measure the baseline before launch. Record case volume, handling time, corrections, escalations and the cost of the tools. Write the stop criteria before the pilot begins, not after the first bad week. Stop if uncorrected errors grow, if nobody owns the outcome, if costs pass the limit, or if exceptions cannot safely return to the manual process they came from.

The cost of inaction calculator helps you define a measurable baseline. It is not a promise of savings.

Human review must be operational

State which outputs the system may perform alone. State which ones wait for a person. A reply draft may only need a glance before sending. Finance, employment, and contract actions need approval, a written decision record, and some way to undo what was done. The OECD AI Principles support accountability, transparency, and human oversight, which in practice means a named owner, access limits, and logs of what the system actually did.

Security guidance matters especially when the pilot connects CRM, email, or internal documents.

Validate at 30/60/90 days

At 30 days, check that the process is actually being used, and that the data you measure is still the data you measured before the pilot. The 60-day review covers corrections, escalations, costs, and the cases the system could not handle. Day 90 is the decision. Extend the pilot or adjust it. Or end it. Expansion happens only once the owner has accepted the benefit and the risk that is left over.

Walk into the management meeting with the process map and the baseline numbers. Bring the human review rules, the stop criteria, who is responsible for what, and one sentence naming the decision the meeting has to make. Otherwise one team buys the tool and another team inherits the consequences.

If the process needs bespoke permissions, several systems, or a lasting audit trail, see custom software development. More decision guides are on the blog.

Limits and next step

This framework is not legal advice, a security audit, or validation on your own data. Not every repeated process should be automated at all. Begin with one case, measure it, and let people fix whatever the system does not understand, because that is the part that tells you where the next pilot should go.

Sources

• NIST AI Risk Management Framework
• European Commission AI Act
• OECD AI Principles