Where Small Businesses Should—and Should Not—Use AI

The right AI question is not:

“What AI tool should we buy?”

The better question is:

“Which defined workflow could benefit from assistance, what information would the system use, and who remains responsible for the result?”

Should you start with the AI tool or the workflow?

Start with the workflow—not the tool. The workflow defines the information, judgment, and accountability involved, which makes it possible to decide whether AI assistance is useful and safe.

A useful workflow should define:

Which tasks should a small business use AI for first?

Good first candidates are bounded, repeatable tasks such as summarization, drafting, classification, structured extraction, retrieval, preparation, and decision support. They should remain reviewable, with a person able to check the output and correct errors before it matters.

1. Summarization

Examples:

• Meeting notes
• Long internal documents
• Public research
• Project updates

Boundary: Someone must verify accuracy and omitted context.

2. First-Draft Preparation

Examples:

• Internal outlines
• Email drafts
• Process drafts
• FAQ drafts
• Content structures

Boundary: AI output is a starting point, not automatic publication.

3. Classification and Organization

Examples:

• Categorizing inquiries
• Grouping notes
• Tagging approved content
• Organizing project information

Boundary: Exceptions and sensitive categories require review.

4. Structured Information Extraction

Examples:

• Pulling fields from approved documents
• Converting notes into a consistent structure
• Preparing a review table

Boundary: Source documents and extracted values must remain available for validation.

5. Knowledge Retrieval

Examples:

• Finding approved SOPs
• Locating templates
• Answering internal questions from controlled sources

Boundary: The system should distinguish retrieved sources from generated interpretation.

6. Repetitive Preparation Work

Examples:

• Preparing meeting briefs
• Creating first-pass project summaries
• Drafting checklists
• Preparing comparison structures

Boundary: Final decisions remain human.

7. Decision Support

Examples:

• Organizing factors
• Highlighting missing information
• Comparing options
• Preparing questions

Boundary: AI supports the decision-maker but does not become the accountable decision-maker.

Where should a small business not use AI?

Not in any workflow where a wrong answer is expensive, hard to reverse, or legally consequential — legal advice, medical judgement, hiring decisions, and moving money are the clearest cases. These are not permanently off-limits, but they require governance, audit trails, and accountable human sign-off that most small businesses have not built yet.

• Final legal advice
• Final tax or accounting determinations
• Medical diagnosis
• Hiring or termination decisions without expert controls
• Housing, credit, or eligibility decisions
• Safety-critical instructions
• Automatic financial transfers
• Unsupervised public communications
• Automatic deletion of business data
• Final contract approval
• Unreviewed factual publication
• Tasks using sensitive information without an approved data process
• Workflows with no method to identify or correct errors

These categories are not ones AI can never touch. They require stronger governance, expertise, controls, and often legal review.

How do you decide whether a workflow is safe to give to AI?

An AI workflow is safer to use when its output can be reviewed, corrected, and measured without exposing sensitive data or shifting accountability to the system. A practical risk screen checks the consequence of error, reversibility, source visibility, vendor retention, and who remains accountable.

How much human review does an AI workflow need?

Most small-business AI workflows need human review matched to the consequence of an error. Start with full review for drafts and recommendations, and use automation only where controls, monitoring, and reversal are defined.

Level 1: Draft Assistance

A person reviews everything before use.

Level 2: Structured Recommendation

AI organizes or recommends; a person approves.

Level 3: Limited Automation

AI may complete a low-risk action under defined rules with monitoring and reversal.

Level 4: High-Impact Decision

Do not deploy without specialized governance, testing, professional review, and appropriate authority.

How do you run an AI pilot in a small business?

Run an AI pilot on one defined workflow with an established baseline, approved data, named human review, and measurable results. Keep the pilot small enough to stop, revise, or scale deliberately.

1. 01

   Define one workflow

   Choose a single, well-scoped workflow to pilot.

2. 02

   Establish the current baseline

   Understand how the workflow performs today.

3. 03

   Define approved information

   Decide what information the system is allowed to use.

4. 04

   Create the prompt or system instructions

   Write the reusable instructions that guide the system.

5. 05

   Define human review

   Specify who reviews and approves the output.

6. 06

   Measure the pilot

   Track the workflow against your chosen measures.

7. 07

   Decide whether to stop, revise, or scale

   Use the results to make a deliberate decision.

Suggested measures:

• Time required
• Rework
• Error rate
• Completeness
• User adoption
• Cost
• Escalations
• Quality-review result

Do not promise savings.

What data should never be put into an AI tool?

Before implementation, classify data by what the AI workflow is approved to use, what requires restrictions, and what requires specific approval and controls. Do not put sensitive or regulated information into a tool until the business has an approved process for it.

Approved

Examples:

• Public information
• Approved templates
• Non-sensitive internal procedures
• Sanitized test data

Restricted

Examples:

• Client-confidential information
• Internal financial information
• Employee records
• Nonpublic strategy
• Credentials

Prohibited Without Specific Approval and Controls

Examples:

• Passwords
• Authentication codes
• Highly sensitive personal information
• Protected health information
• Payment-card data
• Bank credentials
• Legal-privileged information
• Regulated records

Actual classifications depend on the business and professional advice.

What should you ask an AI vendor before signing?

Before signing with an AI vendor, ask how it collects, retains, processes, protects, and deletes business information. Also confirm account administration, logs, export, availability, changes, and contractual limits so the workflow can be governed after launch.

Do not answer these questions for any vendor unless verified.

How do you govern AI once it is in production?

Govern AI in production by assigning accountability, mapping the workflow and its risks, measuring quality and business value, and managing problems as they arise. The business should be able to improve, pause, or stop a use case when controls or results are inadequate.

Govern: Define responsibilities, policies, approved uses, and accountability.

Map: Understand the workflow, people, information, context, and risks.

Measure: Test quality, errors, consistency, and business value.

Manage: Prioritize and address risks, improve the system, or stop the use case.

This article is not an official NIST implementation guide.

What does a successful small-business AI rollout look like?

A successful small-business AI rollout is a defined workflow with a clear owner, approved data, reusable instructions, visible sources, human review, error escalation, measurement, and a manual fallback. It should be documented and periodically reviewed so the business can stop or adjust it when needed.

What should you check before going live with AI?

Before going live with AI, confirm the workflow, data boundaries, review and approval responsibilities, error handling, vendor terms, documentation, measures, and manual fallback. The business should also set a decision date for continuing, revising, or stopping the use case.