What to automate first in a small business

Quick answer

Start with work that repeats often, has a clear beginning and end, uses available data, and can be checked by a person before an error affects a customer, money, or a contract. The first pilot is not proof that your company needs AI. It is a test of whether one task can be done more reliably, faster, or with fewer corrections.

Inventory the work before choosing a tool

Do not select a process because it looks impressive in a demo. For one week, record recurring steps, inputs, decisions, outputs, exceptions, and the person who owns the work. That becomes a process inventory.

Score the same eight factors from one to five, where five always means greater opportunity or readiness. Score volume, time per case, error and rework burden, rule clarity, data readiness, integration readiness, reversibility, and owner strength. The total runs from 8 to 40. Error and rework points show an opportunity to improve. They do not score potential harm.

Treat legal, financial, or people impact as a separate eligibility gate. Only rank a process when it has a named owner and scores at least three for rule clarity, data readiness, and reversibility. Reject a candidate if an unsafe output could pass without human review. Rank eligible candidates by total score. On a tie, choose the smaller reversible scope and the result you can measure sooner.

Our AI and automation service can help distinguish a small pilot from a brief that already needs a custom system.

Keep four forms of automation separate

Simple workflow automation moves data or notifies a person after a clear trigger. Rules automation decides from written conditions. AI assistance proposes a summary, classification, or reply that a person confirms. An autonomous agent chooses steps and uses tools in a wider context.

The first or second form is usually right for a first pilot. AI assistance can fit unstructured text when human review remains. Do not deploy an agent because it is fashionable. NIST AI RMF calls for risk management through design, use, and evaluation. The European Commission describes the AI Act as risk based. Those are practical reasons to begin with a smaller, reversible scope.

Choose a pilot that can be stopped

A useful pilot has one business owner, one technical owner, and a defined input and output. It might sort incoming enquiries, prepare a reply draft, or check whether a document is complete. It must not send a payment, alter a contract, or make a people decision without approval.

Measure the baseline before launch. Record case volume, handling time, corrections, escalations, and tool costs. Write stop criteria before the pilot begins. Stop if uncorrected errors grow, no one owns the outcome, costs exceed a limit, or exceptions cannot safely return to manual work.

The cost of inaction calculator helps you define a measurable baseline, not a savings promise.

Human review must be operational

State which outputs the system may perform alone and which wait for a person. A reply draft may need review before sending. Finance, employment, and contract actions need approval, a decision record, and a way to undo the action. The OECD AI Principles support accountability, transparency, and human oversight. In practice that means a named owner, access limits, and a record of what the system did.

Security guidance matters especially when the pilot connects CRM, email, or internal documents.

Validate at 30/60/90 days

At 30 days, check that the process is used and that you are measuring the same data as before the pilot. At 60 days, review corrections, escalations, costs, and cases the system could not handle. At 90 days, decide whether to extend, adjust, or end the pilot. Expansion follows only when the owner accepts both the benefit and the remaining risk.

Bring the process map, baseline, human review rules, stop criteria, responsibilities, and the decision needed to the management meeting. This creates agreement before one team buys a tool and another team inherits the consequences.

If the process needs bespoke permissions, several systems, or a lasting audit trail, see custom software development. More decision guides are on the blog.

Limits and next step

This framework is not legal advice, a security audit, or validation on your data. Not every repeated process should be automated. Begin with one case, measure it, and let people correct what the system does not understand.

Sources

• NIST AI Risk Management Framework
• European Commission AI Act
• OECD AI Principles