AI tools for small business:
choose the job first.

01 / Choose the method

Does this task need AI at all?

If the right action follows a clear rule, start with ordinary automation: a form creates a record, an approved template acknowledges receipt, or a reminder follows a confirmed date. An existing mailbox rule, spreadsheet formula or CRM workflow may already be enough.

Consider AI when the input varies and needs interpretation, such as summarising a free-text enquiry or drafting a reply from approved information. Keep fixed calculations, permission checks and final actions outside the model where possible. A plausible answer is not the same as a verified answer.

Compare the task, not the software category. On smaller screens, scroll the table sideways.

02 / Shortlist by fit

Ask what happens on an ordinary working day.

Compare a small number of options against the same task and sample inputs. Check the current plan, not a feature mentioned somewhere on a vendor's website. An existing tool with a suitable workflow may be easier to operate than another subscription.

• Connection: Does the actual plan support your mailbox, CRM, phone system or export format? Check which records it can read and which actions it can take.
• Review: Can a person see the original input, edit the proposed output and approve the action? A “human in the loop” claim needs a visible, usable approval step.
• Exceptions: What happens when data is missing, a connection fails or the request is outside scope? Look for a queue, an owner and a way to retry without duplicating work.
• Control: Can you limit permissions, pause the workflow and inspect its activity? A draft-only pilot should not need unrestricted sending or deletion access.
• Exit: Can you export records and remove access if you stop using the tool? Check what happens to stored inputs, outputs and backups.

For response workflows, the lead follow-up guide helps you think through ownership and the next action. For support boundaries, compare AI chatbots with live support before deciding which conversations can stay automated.

03 / See the decision in context

Three possible workflows.

These are illustrative examples, not client case studies, live systems or measured results. Each shows a small starting scope and a boundary to test.

04 / Prepare the inputs

A tool cannot supply missing business rules.

Before connecting anything, identify the source of truth, its owner and how often it changes. A current service list, approved reply examples and a consistent customer record can be more important than a more capable model. Resolve conflicting prices, duplicate records and unclear handoffs first. The CRM cleanup guide covers the record-quality side of this work.

• Limit the data: Start with redacted or synthetic examples. Use real information only when the purpose, permissions and provider's handling are appropriate. Do not copy entire inboxes merely because a connector allows it.
• Limit the access: Use a dedicated connection with the smallest necessary permissions. Keep credentials in the platform's protected connection settings, not in prompts, documents or chat messages. Remove unused access.
• Inspect provider terms: Check retention, deletion, model-training use, storage locations, subcontractors and administrator controls for the exact product and plan. Do not assume every business-labelled plan has identical protections.
• Separate content from instructions: Incoming messages and uploaded documents are untrusted inputs. A request embedded in them must not grant new permissions or authorise a payment, record deletion or disclosure.
• Name the owner: Assign someone to review exceptions, update source material, handle access changes and stop the system when it behaves unexpectedly.

If you cannot identify a safe data source, a responsible reviewer and a clear allowed action, keep the workflow manual while you resolve those gaps. Sensitive or regulated information may need a separate privacy, security or professional review.

For broader context, the NIST AI Risk Management Framework provides voluntary guidance on managing AI risks across design, use and evaluation. It is a reference, not a certification of any tool or this guide.

05 / Look beyond the plan price

Compare the ongoing workload and bill.

A subscription is only one part of operating a workflow. Ask each provider to show the current billable units, included allowances, overage terms and cancellation conditions. Compare the same quiet, normal and busy-month usage assumptions for every option.

• People and seats: Who needs a paid account or an administrator role?
• Usage: Are model requests, phone minutes, messages, workflow runs or retries charged separately?
• Connections: Does the required integration, API access or export need another plan?
• Operations: Who pays for hosting, storage, monitoring, updates and support?
• Review time: Who checks drafts, resolves exceptions and corrects mistakes?
• Changes: What happens when your process, provider or data format changes?

Do not equate time returned with cash saved. Someone may use that time for other work without reducing any bill. Put your own assumptions into the automation time-and-cost calculator, then use the result as a discussion aid, not a guaranteed return or a supplier quote.

06 / Prove one limited workflow

Test before expanding access.

A demo with one perfect example does not show how a tool handles your work. Run a small pilot with a defined owner, limited permissions and a manual fallback.

1. Record the baseline. Observe the current task's volume, handling time, common errors and handoffs. Include the time spent fixing mistakes.
2. Write acceptance criteria. Define required fields, approved actions and stop conditions before testing. Decide which errors are unacceptable, not just which outputs look polished.
3. Build a representative test set. Include ordinary cases, missing details, duplicates, conflicting information, requests for a person and instructions that try to push the system outside its allowed task.
4. Run without external actions. Keep outputs in a test queue or draft state. Compare each output with the source and the expected handling. Repeat important cases to check consistency.
5. Test the failure path. Disconnect a permitted test integration, supply malformed data and verify the owner gets a useful alert. Check that retries do not create duplicate records or messages.
6. Review the complete cost. Count review and correction time as well as provider usage. If the added work offsets the benefit, simplify the flow or stop.
7. Roll out gradually. Approve a limited live scope, retain the pause control and manual route, and schedule a review. Re-test after material changes to the model, source data, permissions or workflow.