Insights · Agentrix

By Agentrix · Updated 20 October 2026

A safe first AI project for a small firm: start with one repetitive process

For most small firms, the question isn't whether AI works. It's where to start without making a mess of it: what to try first, which tool to use, and what happens if someone pastes client details into the wrong place.

Our answer is nearly always the same. Pick one repetitive process, run it on tools you already pay for, and get the safety basics sorted before AI touches real work. This article explains why, and how to choose the process.

Are other small firms actually using AI yet?

Some are, but fewer than the headlines suggest. The Office for National Statistics found that 29% of UK firms with fewer than 10 staff used at least one AI technology in September 2026 (ONS, 8 Oct 2026). That's up sharply from a few years ago, but it still means most small firms haven't started.

The reasons are telling. In the government's own AI adoption research, the most common barrier was having no identified use for AI (71%), followed by a lack of AI skills or knowledge (60%) (DSIT, AI adoption research). Firms in that research also asked for "tried-and-tested use cases". In other words, the hold-up isn't the technology. It's knowing what to point it at, and feeling confident it's being used properly.

Why start with one process, not an AI strategy?

Because a strategy is hard to test and a process isn't.

If you set out to "bring AI into the business", you'll end up with a pile of tool trials, a few keen staff using different things, and no clear answer a few months later about whether any of it helped. If you pick one process, you can time it today, change it, and time it again. Either it got quicker and stayed accurate, or it didn't.

It also keeps the risk small. One process means one set of data to think about, one group of people to train, and one person who signs off the output.

Do we need to buy new AI software?

Usually not for a first project. Many small firms already pay for tools with AI built in: Google Workspace with Gemini, Microsoft 365 with Copilot, or a business plan for Claude. Starting there means no new supplier to vet, staff already know where to find things, and you work within accounts and admin settings you control.

The bigger risk is the opposite: staff using free AI tools on their own, with client or staff data. The Department of Health and Social Care's guidance for care providers puts it plainly. If you use a free or online tool, you shouldn't put in personally identifiable information, because you have no contract with the supplier and no way of guaranteeing what happens to it (DHSC, 29 Sep 2026). That guidance is written for care, but the logic applies to any firm handling personal data.

What has to be in place before AI touches real work?

Four things, and none of them needs to be long or complicated.

• An AI policy. A short document saying which tools staff can use, for what, and what must never go into them. DHSC suggests every organisation should consider one, "even if your policy is that staff cannot use AI for work purposes".
• A DPIA where personal data is involved. A data protection impact assessment records the privacy risks and how you're reducing them. If the process touches customer, patient or staff data, you'll want one. CQC lists a DPIA among its principles for providers using AI (CQC, updated 21 May 2026).
• A named person reviewing the output. AI drafts, matches or summarises. A person checks it before it counts. DHSC recommends always including a human review of AI-generated outputs.
• UK GDPR basics. Know where the data is processed, and tell people how their data is being used.

This isn't box-ticking. When the Federation of Small Businesses surveyed its members, 92% had concerns about AI, with inaccurate answers (54%) and security (39%) near the top of the list (FSB, 16 Jun 2026). A policy and a reviewer deal with both.

How do you pick the right first process?

Look for work with these traits:

1. It repeats. Weekly or daily, done the same way each time.
2. It eats a known amount of time. You can say roughly how many hours it takes, even if it's a guess to start with.
3. The right answer can be checked. Matching, reconciling, summarising and drafting are good candidates, because a person can see whether the result is right.
4. Someone owns it. There's a clear person who does it now and can sign off the new version.

Avoid anything where a mistake would be hard to spot or would land directly on a customer or service user without a check. Those can come later, once you trust the set-up.

What does a good first project look like in practice?

GK Healthcare, a UK recruitment company, is the example we know best, because we did the work. Their Director of Finance was spending about two days a week on reconciliation. We mapped how it was done, then set it up on Axis, our reconciliation software, using fixed rules plus AI. The Director of Finance checks the output before it counts. It's now one 30-minute run each week.

What made it a good first project was that it ticked every box above. It repeated weekly, the time cost was clear, the result could be checked, and the Director of Finance checked the output before it counted. You can read the full case study on GK Healthcare, a UK recruitment company.

How will you know if it worked?

Write down the starting point before you change anything. How long the process takes, who does it, and how often it goes wrong. Then measure the same things afterwards. Without that baseline, nobody can say three months later whether the project paid off. We use a five-stage maturity ladder to score each process before and after, so the change is on paper.