AI strategy for a small or mid-sized business
An AI strategy for a small or mid-sized business is a short, written plan for where AI will save time or improve work, what data it may use, which tools are approved, who is responsible, and how results will be measured. It starts from the work the business does, not from a product.
Start from the work, not the tool
The question is not "should we use AI?" but "which of our work is slow, repetitive or error-prone in a way AI can help with?" Today's AI is strongest at reading, writing, summarising, classifying and searching; agents that take actions across systems are arriving fast, and they make the next point more important, not less.
List your processes, note where time goes, and look for the steps that are really document handling or judgement on text. The same map tells you where plain automation is enough and where AI earns its cost. Most valuable uses combine the two: AI reads and decides, automation moves the data and does the rest.
Get the data and permissions ready
AI assistants that work across company data inherit its permissions. If an old folder was shared with everyone, an assistant can surface it to anyone who asks the right question. Before switching on tools such as Microsoft Copilot: review who can see what, remove old open sharing links, apply sensitivity labels to the data that matters, and decide what the assistant should not index. This is managed IT work, and your MSP should lead it.
Set the rules
- Approved tools, and the accounts people must use them under (business, not personal).
- Data rules: what may never go into an AI tool, such as personal data without a lawful basis, client confidential information, credentials.
- Accountability: people remain responsible for what they send, publish or decide.
- Ownership: one named person for AI decisions, and a short review every quarter.
- Regulation: UK GDPR applies whenever personal data is involved. If you sell into the EU, the EU AI Act applies in stages, starting in 2025 with a duty to make sure staff using AI understand it.
Pick a few uses and measure them
Choose three to five uses, each with a measure and a baseline: minutes per proposal, first-response time on support, errors in data entry. Pilot with the people who do the work, compare, and keep what works. Expand from evidence, not from enthusiasm.
A strategy that fits on two pages and is reviewed every quarter beats a long one that is never read. Most of it is the list of processes and the rules.
What to ask your IT provider
- Are you offering AI or automation services, piloting them, or still exploring?
- Can you run a permissions and data review before we switch on AI assistants?
- Can you help us find which processes are worth automating or augmenting first, and value them?
- How would you monitor and support what you build?
Is your MSP offering this?
Most businesses already pay a managed IT provider that holds the keys to their systems, their data and their Microsoft 365. It is often the best-placed partner for AI and automation, and many are starting to offer it. 6 providers have told the register where they stand so far: 0 exploring, 0 piloting and 6 offering a named AI or automation service.
Ask your MSP where it stands Two minutes. We write the email; you send it from your own mail.
Quick answers
What should an AI strategy for a small business include?
The three to five processes where AI should help first and why; the rules for which data may go into which tools; the approved tools; who owns AI decisions; what training people get; and how success is measured.
Where should a business start with AI?
With the work: list the tasks that take the most time or cause the most errors, and ask where reading, writing, summarising, classifying or searching is the bottleneck. Those are where today's AI helps most.
Do we need to prepare our data before using AI tools like Microsoft Copilot?
Yes. Assistants that search company data, such as Copilot for Microsoft 365, can see what each user can see. Files shared too widely become visible in answers. Tidy permissions, sharing links and retention first, and label sensitive data.
Do we need an AI policy?
Yes, even a one-page one: which tools are approved, what may never be pasted into them (personal data, client data, credentials), who to ask, and that people stay responsible for what they send. UK GDPR applies to personal data used with AI, and the ICO publishes guidance on AI and data protection.
How do you measure whether AI is working?
Pick a measure per use before you start, such as minutes per task, response time, errors or customer satisfaction, take a baseline, and compare after a pilot. Licences used is not a measure of value.
Written 5 November 2026. General guidance, not legal advice.
From the publisher: OurIdea.ai, which publishes this register, makes abi., which maps how a business actually runs and finds the automation worth building. It is not a listed company, no provider pays to appear in these guides, and nothing on the register depends on using it.
More on AI and automation: What is business process automation? · Automation as a service: what it is and what to ask · AI implementation: from pilot to everyday use · Is your MSP offering AI and automation?