The first step is not a tool. It is three decisions, written on one page: who in your company already uses AI tools and for what, the one rule about data that everyone can repeat, and what the company will never let a machine do alone. Only then do you pick one small piece of work, with a named owner. This article is for the owner or CEO of a company with roughly five to fifty million dollars of revenue who has been told to do something about AI and does not know the first step.
I was COO and then President of a public company that closed more than 40 acquisitions, and I ran the integration on most of them. I am a lawyer by training, and I now write fixed-fee AI plans for CEOs of private-equity-backed and owner-led mid-market companies through 013 Labs.
Why the first step is a decision, not a purchase
When an owner asks "should my company use AI?", the usual next move is a meeting with a vendor. The vendor shows a demo, and by the end of the hour the question has changed from "what should we do?" to "which product should we buy?". Nobody has answered the first one.
A vendor's demo is the wrong first meeting because the vendor knows the tool and not your company. It cannot tell you who on your staff is already using something similar, what data you cannot let leave the building, or which jobs you would never hand to a machine. Those three facts decide which tools are safe and useful for you, so they come first.
Somebody on your team almost certainly has an AI tool open right now. The question is not whether to start. It is whether to start on purpose.
Decision one: find the people already using it
Ask, do not audit. A short, friendly note to your leadership team works: "Who here uses AI tools for work, and what for? I am not looking for anyone to be in trouble. I want to know what is already helping." The people who use these tools on their own are often your most capable, and they have simply never been asked.
For each person who answers, write down five things:
- The tool. The name, and whether it is a personal account or one the company pays for.
- The task. What they do with it, in their own words.
- The data. What they paste into it, such as customer names, prices, contracts or nothing sensitive at all.
- The time it saves. A rough guess is enough.
- The worry. Anything that makes them nervous about it.
Two things usually come out of this list. You learn what staff already value, which tells you where a first project could pay off. And you find the one or two people others already go to with questions. The free guide to spotting your AI champion explains how to recognize that person and what to write down before anyone builds anything. Once you have found them, who owns AI in a company covers their one-page scope.
Decision two: the one data rule everyone can repeat
You need one rule about what may go into a tool, short enough that a new hire could say it back after a single reading. For example: "Nothing that identifies a customer or an employee goes into any tool the company has not approved."
A rule beats a policy for a company your size: a long policy is signed and forgotten, and a rule can be said in a hallway. Pick the categories that would hurt most if they leaked, such as customer names, employee records, pricing and contracts. Write one sentence and send it to everyone over the CEO's name.
The rule has a second half that owners forget: a way to say yes. Name the person who approves a new tool and how quickly they answer. If the answer takes a month, people will stop asking and carry on without approval.
Decision three: the never-build list
It holds the few things no machine is allowed to do alone, whatever a vendor promises. Three lines are enough. For each, write one example so nobody has to guess what you meant.
Never let a machine move money alone. Picture a distributor whose staff use a tool to draft payment reminders. The draft is welcome. Releasing a payment, changing a credit hold or writing off a balance always waits for a named person's approval.
Never let a machine make a promise to a customer alone. Picture a service company that lets a tool suggest replies to complaints. A person reads the reply before it goes. A refund, a deadline or a guarantee is always a human decision.
Never let a machine decide about a person alone. Picture a firm that uses a tool to summarize job applications. Who gets an interview, a raise or a warning is decided by a manager who can explain why.
Your three lines will differ. What matters is that they exist in writing before the first project does.
The first piece of work
With the three decisions on one page, you can choose a first project with some confidence. Choose one recurring task. Four tests keep the choice honest:
- It repeats. It happens every week or every day, so a small saving adds up.
- A mistake is cheap. If the tool gets it wrong, someone fixes a draft. Nobody loses a customer or a payment.
- A person checks it. A named human looks at the output before it goes anywhere that matters.
- You can measure it. You write down how long it takes today, then compare after a few weeks.
Give the project one owner, by name, who reports back on a set date. Not a team and not a committee. Picture a regional contractor whose office manager spends part of every Monday assembling a status update from several sources. A tool drafts it, the office manager corrects it, and the owner compares the time before and after. That is a first project. A customer-facing assistant on the website is not.
The reasoning behind these tests is in picking your first AI project. For the bigger question of how much a tool can eventually take on, see can AI run my business.
What to tell the team
A message that only prohibits sends the use underground, so tell people what they may do first.
Say that they may work with the approved tools for everyday drafting, summarizing and tidying, as long as the data rule is followed. Say who to ask when they are unsure. Say that anyone who realizes they made a mistake should tell the named person the same day, and that telling will never be punished. Then say the data rule and the never-build list out loud, in person, and answer questions before you send anything in writing.
When the bank, a buyer or the board asks
Sooner or later, someone with money at stake will ask what your AI plan is. It may be a lender at renewal, a buyer doing diligence, or a board member. If you have the three decisions and the first project on one page, you can answer in a few minutes.
The page tells them what is already happening, who is accountable, and what will never be allowed. That is nearly everything they want to know, and a page with names on it reads as control. The agenda and the ten questions a board tends to ask are on one page: AI board briefing template.
Mistakes that repeat
- Starting with a purchase. Buying a tool before the three decisions means the tool sets the rules.
- Banning first and asking later. The use moves to personal phones, out of sight.
- Choosing a showpiece first project. A website assistant that talks to customers is risky and hard to measure. Start with something dull and internal.
- Handing it to a committee. One named person can be asked a question on Monday morning. A committee cannot.
- Skipping the never-build list. The limits are what protect the company when the enthusiasm fades.
Frequently asked questions
Do I need an AI strategy for a small business?
You need a short plan, not a long strategy. For a company your size it is three decisions and one first project on a page: who already uses AI, one data rule, and what a machine never does alone. A strategy can come later, once the first project has shown what works.
What is the first thing to do with AI in my company?
Ask your leadership team who already uses AI tools and for what. Do it without blame. The answers show you where value already exists, what data is at risk, and who the natural leader is.
Is it safe to use AI with customer data?
Not by default. Safety depends on which tool, which account and what the provider does with what you type. Until you know, keep anything that identifies a customer out of tools the company has not approved. Make that your one data rule, and have your lawyer review the final wording.
How much should a small business spend on AI?
Start with almost nothing. The first project should fit inside tools you already pay for or low-cost business accounts, plus a few hours of one person's time. Spend more only after the before-and-after measure shows a result worth repeating.
Who should be in charge of AI in a small company?
One named person, with the owner or CEO still deciding the rules. Often it is the operations lead or the colleague people already ask about these tools. Avoid a committee, and avoid giving it to IT alone. Whoever it is needs the authority to say no.
No IT department? There is a week-by-week version of this for you: AI for a small business with no IT department: a thirty-day plan.
Not sure where you stand? Take the 3-minute AI readiness scorecard.