Integrating AI into an SME: choose your first project, control costs and measure results

Integrating AI into an SME: choose your first project, control costs and measure results

You have tried an AI assistant. It drafts quickly, produces useful summaries and occasionally gets something wrong with complete confidence. The harder question is which application deserves a budget in your business. That depends on the work involved: its volume, the available information, the consequences of mistakes and the cost of checking the output.

To integrate AI into an SME, select a bounded workflow, measure how it operates without AI and fund a reversible pilot. Expand only when usable capacity, output quality and the full operating cost justify it. This guide turns that principle into a project decision, with a worked financial example and a worksheet you can copy.

1. Choose a task with an outcome someone can judge

“Use AI in sales” is not a project specification. “Prepare draft replies to product availability enquiries using the current catalogue, without sending messages” identifies an input, an output and a boundary. A sales manager can assess whether those drafts actually help the team.

Observe a representative week before choosing a system. Record enquiry volumes, end-to-end handling time, corrections, exceptions and delays. Separate working time from waiting time: a reply might take two minutes to prepare but sit in an approval queue for two days. Faster drafting will not necessarily remove that queue.

Compare three options: keep the current process, simplify it without AI, or introduce assistance. An updated FAQ or a mandatory form field might solve the problem more cheaply. If you need a shortlist, these SME AI use cases provide candidates, not evidence that any particular one will pay off in your company.

A selection scorecard, with reasons to reject a project

Give each candidate a score from zero to two on the five dimensions below: zero for unfavourable, one for uncertain and two for favourable. Keep the underlying observations beside the scores. The total helps compare candidates; it is not sufficient approval to proceed.

• Volume and repetition: are there enough comparable cases to test the approach and recover its costs?
• Net value: will useful time remain after checking, corrections and exceptions?
• Data readiness: are the sources accessible, reliable, authorised and maintained by an identified owner?
• Verifiability: can someone judge the result accurately without repeating the whole task?
• Reversibility: can the team return to manual working without losing records or interrupting customers?

Exclude applications where a mistake could have serious consequences and there is no credible control: executing payments, giving medical advice, making recruitment decisions or accepting contractual commitments without review. A high total cannot compensate for unlawful data access or the absence of an accountable owner. Between similar candidates, favour the smaller irreversible commitment and the team that actually has time to run the pilot.

2. Decide whether you need a tool, automation or an agent

Once the task is clear, choose how much autonomy it needs. Extra capabilities create extra permissions, testing obligations and maintenance. They do not automatically create extra business value.

• Assisted tool: an employee submits information and receives a summary or draft while remaining in control. This suits relatively self-contained tasks with outputs that are straightforward to review. Check capabilities already available in your business software before buying another product.
• Workflow automation: an event triggers defined steps, such as classifying an email, extracting fields, preparing a response and opening a task. AI may interpret the text while ordinary rules control recipients, amounts and approvals. For a stable process, this is often easier to control than an agent.
• AI agent: software chooses some of its own steps and uses tools to pursue an objective. It can help when the route genuinely varies, but needs tighter operational controls: least-privilege access, limits on tool calls, action logs and approval before sensitive actions.

Preparing a reply from a product catalogue does not necessarily require an agent with write access to your sales system. Read-only retrieval and human approval may be enough. A case that needs several searches and variable follow-up steps may justify an agent if that flexibility produces a measurable benefit.

No-code platforms, which connect services without conventional programming, still require process design and maintenance. Custom development is not a mandatory next step after a subscription, either. Compare connectors, export options, access controls, support arrangements and exit conditions against the actual workflow. Our guide to business processes scattered across Excel and email helps identify problems that first need clearer rules or information routing.

3. Prepare the information before connecting the model

A polished response can still rely on an obsolete price list. Name the authoritative source before the pilot: which catalogue takes precedence, who updates it, which version is valid and how old documents are withdrawn. A document collection without an owner reproduces internal disagreements faster.

Build a small, representative sample containing ordinary requests, missing attachments, duplicates, alternative wording and cases the system should decline. Remove information that is not needed. Separate public, internal and confidential documents from personal data, then authorise each category explicitly. Connecting an entire shared drive is rarely a sensible starting point.

Retrieval-augmented generation, or RAG, retrieves relevant passages before generating an answer. It can ground responses in company documents without retraining a model. It does not guarantee that the right passage was retrieved or that the answer follows it. Require source references and test what happens when the documents contain no answer.

Permissions must follow the user. An assistant used by a salesperson must not disclose an HR record just because its connector can access the file. Prepare a minimised version of sensitive documents before transmission; replacing names alone may not prevent reidentification. The example of accounting files sent to AI services shows why protection starts before anyone writes a prompt.

4. Budget for the whole service, including internal work

Preparing sources and checking permissions takes staff time before the first productive reply. Ask for two separate budgets: the investment needed to launch and the resources required each month to keep the service useful. A licence price answers only part of that question.

• Initial work: process observation, data preparation, configuration, integration, security checks, testing, training, documentation and time contributed by business users.
• Recurring operation: licences, model usage, automation platform fees, hosting, support, monitoring, source updates, incident handling and access administration.
• Per-case work: reviewing, correcting and dealing with exceptions or later rework. Deduct this from the claimed saving rather than leaving it outside the calculation.
• Exit: exporting records, revoking access, obtaining deletion from suppliers and restoring the manual process.

Clarify what is capped, usage-based or outside the quoted fee. A single document can trigger several model calls, and retries or agent loops also consume resources. Put in both a spending alert and a technical stop; discovering an overrun on the monthly invoice is too late.

Management and subject-matter time has an opportunity cost even when payroll does not change. Equally, avoid double counting: if review time is already deducted from minutes saved per case, do not charge those same hours again in monthly operating costs. When comparing suppliers, a breakdown of business automation costs is more useful than an isolated entry price.

Ask who owns the configuration and documentation, what happens when an integration breaks, and how much support is included. For an agent specifically, these scoping questions before paying for an AI agent help separate a convincing demonstration from a maintainable service.

5. Worked example: gross time saved, net capacity and cash savings

This is a hypothetical example, not a client result or a market price estimate. An SME prepares 1,200 eligible sales replies per month. Each currently takes ten minutes. With AI assistance, preparation takes four minutes plus an average of two minutes for checking and corrections, including exceptions. The business values available staff capacity at a fully loaded cost of €35 per hour.

• Original workload: 1,200 × 10 ÷ 60 = 200 hours per month.
• Gross preparation saving: 1,200 × (10 − 4) ÷ 60 = 120 hours.
• Checking and rework: 1,200 × 2 ÷ 60 = 40 hours.
• Net capacity released: 120 − 40 = 80 hours, valued at €2,800 per month.

Assume a full initial investment of €6,000, including internal time, plus €900 per month for licences, usage, maintenance and administration. The €900 excludes the 40 review hours already deducted. Monthly capacity value after operating costs is therefore €1,900. Over twelve months at steady state from the start, the economic benefit after the initial investment is €16,800. ROI relative to that initial investment is 280%: (€1,900 × 12 − €6,000) ÷ €6,000. Economic payback takes approximately 3.2 months.

That is not a cash-flow return. If payroll stays unchanged and no expenditure is avoided, those 80 hours are available capacity, not €2,800 arriving in the bank. Decide how the time will be used: clearing a backlog, handling additional enquiries or improving follow-up. Additional sales should be valued through the contribution margin actually generated, not hypothetical revenue.

Now suppose 30 of the released hours genuinely replace outsourced work billed at €40 per hour. That avoids €1,200 of monthly expenditure, leaving €300 after the €900 operating cost. If the €6,000 initial investment is also entirely cash expenditure, cash payback takes 20 months. The remaining 50 hours can still create capacity value, but do not count the 30 outsourced hours a second time.

Stress-test the assumptions that change the decision

At four net minutes saved per reply and €35 per hour, approximately 386 eligible cases per month are required to cover the €900 operating cost, before recovering the initial investment. If volume falls to 600 cases and the net saving falls to two minutes, capacity value drops to €700. The project then loses €200 per month before paying back any setup cost.

Use eligible volume, not every enquiry received. Allow for onboarding, seasonal troughs and corrections discovered later. Fixed costs make low adoption expensive, while poor quality increases both review time and risk. If users only trust half the proposed drafts, that has to appear in the observed average rather than being dismissed as a training issue outside the business case.

There is a reason to measure your own baseline instead of importing a productivity percentage. The NBER working paper “Generative AI at Work”, revised in November 2023, studies 5,179 customer support agents and reports an average improvement of roughly 14% in issues resolved per hour, with substantial differences by worker experience. That finding in a specific support setting does not predict your sales productivity or project ROI.

6. Privacy, GDPR and training: check the actual use

A business subscription or European hosting location does not establish compliance on its own. Examine the information actually transmitted, the purpose of processing, who can access it and what suppliers are allowed to do with it. GDPR can apply to prompts, uploaded files, generated responses and logs containing personal data.

The French data protection authority’s AI and GDPR recommendations address issues including minimisation, transparency and individuals’ rights. Much of that guidance concerns model development; it is not approval of your chosen application. For your own deployment, review the lawful basis, contractual roles, retention periods, subprocessors, potential international transfers, rights procedures and whether a data protection impact assessment is needed given the risks.

Before signing, obtain written answers about reuse for training, conversation and log retention, support access, deletion and data export. Test account revocation rather than assuming it works. A confidentiality agreement does not replace these settings or restrictions on what users upload.

The European Commission’s AI literacy FAQ explains Article 4 requirements and an approach adapted to the people, systems and risks involved. It also discusses legislative developments. Check the rules applicable when you launch with an appropriate adviser instead of relying on an old implementation timetable. Do not infer either a blanket SME exemption or a universal obligation to buy certified training. The FAQ says that a specific certificate is not required.

In practice, train people on the workflow they will use: permitted data, plausible mistakes, checking references, escalation and switching the system off. Keep records of the guidance and activities provided. Someone approving a sales draft needs to understand company prices and commitments; interface training alone does not supply that business knowledge. Tailor exercises to the people doing the work, including contractors acting on your behalf where relevant.

7. Run a pilot that can fail safely

A useful pilot tests the business case and its controls, rather than producing an impressive demonstration. The following four-week outline is a planning example. Adjust it to case volume, review availability and the consequences of mistakes.

1. Week one — baseline and boundaries. Measure the existing process, identify eligible cases, assign owners and set decision thresholds. Approve information sources and permissions before connecting systems.
2. Week two — offline evaluation. Use a test sample separate from configuration examples. Include routine cases, missing facts, contradictory documents, out-of-scope requests and malicious instructions embedded in source material. Allow no autonomous sending.
3. Week three — supervised use. A small user group handles real requests with approval. Measure complete handling time and rework. Compare cases of similar difficulty without AI so differences in workload do not masquerade as productivity gains.
4. Week four — decision. Recalculate costs and benefits, interview users, inspect errors and decide whether to expand, correct or stop. Low volume may require a longer measurement period; it does not justify inventing a positive conclusion.

Assess factual accuracy, confidentiality, compliance with instructions and net time separately. A high draft acceptance rate may conceal rushed approval. Classify errors by severity: changing a greeting is not equivalent to quoting an incorrect binding price. Keep only the logging information needed, with controlled access and retention.

Set thresholds before seeing the results. In our example, the business might require an average net saving of four minutes, no incorrect commitments sent, review of every reply during the pilot and spending within the agreed cap. These are proposed criteria for this scenario, not universal standards. A data leak or broken access control should trigger suspension even if time savings look good.

Document the fallback in operational terms: who disables the integration, where pending cases are listed and how the team avoids sending duplicate replies. Test it once before relying on the service. An on/off switch without a way to recover unfinished work is not a complete rollback plan.

8. Support adoption, maintain the service and expand cautiously

Involve the affected employees in selecting frustrating tasks and evaluating the pilot. Explain what will happen to released time; otherwise measurement can feel like surveillance or a concealed headcount target. Provide a simple way to report an unusable draft rather than forcing staff to work around the tool in silence.

A business owner maintains sources and quality criteria. A technical owner maintains access, alerts and the manual fallback. One person can hold several roles in a small company, but needs allocated time and a backup. Reassess performance after changes to the model, connector, prices or business procedure. Even a model improvement can change output in ways that invalidate an old approval process.

Expand one boundary at a time. Reliable assistance with ordinary French enquiries does not establish reliability for disputes or another language. Retain a test set, configuration versions, incident records and an accessible shutdown procedure. Check export arrangements before becoming dependent on the supplier.

Expand when quality, sustained use and net value remain acceptable. Correct when a specific, affordable intervention can explain and close the gap. Stop when checking erases the benefit, the information remains unusable or nobody can maintain the service. Ending a bounded experiment is cheaper than indefinitely funding a workflow that does not work.

9. A project worksheet you can copy and complete

Copy this block into your working document and replace each bracketed field. It sends no information and saves nothing on this page. Have the business owner approve it before requesting a supplier proposal.

PROJECT: [name and specific task]
DECISION REQUIRED: [what the pilot must establish]
OWNER / BACKUP: [names and allocated time]
CURRENT PROCESS: [steps, eligible volume, minutes/case, errors]
NON-AI ALTERNATIVE: [possible simplification and cost]
INPUTS AND SOURCES: [documents, owner, version, access rights]
EXCLUDED DATA: [prohibited categories, minimisation method]
EXPECTED OUTPUT: [format and quality criteria]
ARCHITECTURE: [tool / automation / agent and justification]
PERMISSIONS: [read, write, human approval, prohibited actions]
SUPPLIER: [retention, training reuse, subprocessors, export]
INITIAL BUDGET: [external fees + valued internal hours]
MONTHLY BUDGET: [fixed fees + usage + maintenance]
CHECKING AND REWORK: [minutes/case, counted once only]
NET TIME SAVING: [volume × net minutes ÷ 60]
USE OF RELEASED CAPACITY: [specific activity and owner]
CASH AVOIDED: [removable expenditure, evidence, timing]
DOWNSIDE CASE: [volume, saving, costs and outcome]
TESTS: [routine cases, missing data, severe errors, access]
THRESHOLDS: [minimum quality, minimum saving, maximum cost]
TRAINING: [people, exercises, guidance, activity records]
PILOT: [start, end, sample, non-AI comparison]
STOP / MANUAL FALLBACK: [trigger, owner, procedure]
MAINTENANCE: [sources, frequency, alerts, budget, backup]
FINAL DECISION: [expand / correct / stop, date and evidence]

You should now be able to identify a task, an owner, a full cost and a condition for stopping. If those remain unknown, measure them before buying additional autonomy. An AI and automation diagnostic can help frame workflows and priorities; the pilot must then establish results using your own operation and data.

Deciding between several possible AI projects? Bring one example request, its current handling process and your budget constraint. Talk to Say Digital about defining a first measurable scope.

Sources and limitations

Sources used for this guide: NBER, Generative AI at Work, working paper 31161, November 2023 revision; CNIL, AI and GDPR recommendations; European Commission, AI literacy questions and answers. The financial calculation and pilot schedule are teaching examples, not observed outcomes or supplier quotations. Compliance depends on the processing involved and applicable law; this guide is not a substitute for legal advice.