AI consulting for SMEs: where AI pays, and where not

Where a small business should start with AI

Adoption is rising fast. The ONS reports that the share of UK businesses with 10 or more employees using at least one AI technology rose from around 12% in late 2023 to around 35% in June 2026. Lack of expertise is one of the most cited barriers, and the ONS had previously listed difficulty identifying use cases among the top ones. That matches what we would expect: the hard part is rarely the technology, it is picking the right problem.

So we start from a process, not a tool. Which tasks take hours every week, involve reading or writing text, and follow rules someone could explain? Those are the candidates. ‘Let's roll out AI across the company’ is not a use case; ‘stop keying 400 supplier invoices a month into Sage’ is.

What an AI readiness assessment covers

An AI readiness assessment looks at your business as it is today. We work with the people who do the work, not only with management:

• Processes: interviews and screen-share sessions with the people who run them, measuring volume and time per task.
• Data: what exists, where it lives, how clean it is and who owns it.
• Systems: which ones have usable APIs, and which would need another route.
• What you already pay for: Microsoft 365 Copilot, Gemini in Google Workspace or AI features in your CRM or accounts package may already cover some cases.
• Risk: personal data, customer-facing use, decisions about people, and what a mistake would cost.
• People: who would use each tool, who would own it and what training it needs.

Choosing the first use case

The first case sets the tone for everything after it, so it should be likely to succeed and easy to measure. We score each candidate on the same criteria:

• Typical strong candidates are AI document extraction for supplier invoices, shared inbox triage and an internal assistant over manuals and procedures.
• Typical weak first cases are anything that makes decisions about people, such as screening job applicants, and projects that need a new system before the AI can do anything.

What you get at the end of the assessment

Concrete deliverables, in writing, that you can use with us or with anyone else:

• Process map of the areas reviewed, with measured volumes and time spent.
• Scored shortlist of use cases, including the ones we recommend you do not pursue, and why.
• Build, buy or configure: for each case, whether an existing tool or licence covers it or bespoke work is justified.
• Data protection notes for each case: what personal data is involved, where it would be processed and which providers would take part.
• Cost and running-cost ranges by type of project, based on published market references, with the method explained in our guide to the cost of implementing AI in a business.
• Roadmap: what to do, in what order and what has to be true before each step.
• Optional proof of concept of the strongest case on your real data, so the decision rests on results rather than slides.

UK and EU rules, without the alarm

UK. There is no single AI law in the UK. The government's 2023 white paper set out five principles (safety, transparency, fairness, accountability and contestability) for existing regulators to apply in their own sectors, and the February 2024 government response confirmed that approach. As of autumn 2026 no general AI bill has been introduced by the government. UK GDPR still applies whenever personal data is involved; the ICO's guidance on AI and data protection is the reference we use to ask the right questions, and the Data (Use and Access) Act 2025 has changed the rules on automated decision-making, with safeguards such as human review.

EU. If you operate in the EU or serve EU customers, the EU AI Act applies to some uses. Three practical points: deployers must take measures to support AI literacy among staff (Article 4, softened by the 2026 Digital Omnibus); people must be told when they are dealing with an AI system unless it is obvious (Article 50, from 2 August 2026); and certain uses, such as recruitment, are high-risk, with the main obligations for those now deferred to December 2027.

This is not legal advice. It is what you need to ask the right questions of whoever advises you. How we handle data sent to AI providers is set out on our private ChatGPT for business page.

How we run the assessment

The scope (areas, people to interview, whether a proof of concept is included) is agreed in writing, with one fixed price for the project. Findings are shared as we go, not saved for a final presentation, and if a proof of concept is included you see a working demo every two weeks. More on how we work.