AI in a small or mid-sized company: where to start

How do you recognise a good first use case?

Five criteria, all of them checkable without technical expertise.

Frequency: the task comes round every week, not twice a year. Time spent: someone can say how many hours it costs. The rule: there is a way of doing it, written down or dictatable in ten minutes. Tolerance for error: a wrong answer is spotted, corrected, and commits neither safety nor the company’s signature. The data: what is needed to do the work already exists, in a usable form.

A case that ticks all five is rarely spectacular. Incoming requests, meeting notes, quotation drafting, searching internal documents: that is where it starts.

One missing criterion is not disqualifying. Three are.

What should you check before starting?

Four questions, before the first euro is spent. Who decides? A project without a named owner stops at the first trade-off. You need someone who settles matters, and a real user who will say whether it helps.

Which data is involved? List it. Personal data, customer data, information covered by a contract: the regime differs, and it is settled beforehand.

Who may access it — and where is it allowed to go? The tool must not open to anyone what their current access rights refuse them, nor send outside the company what has to stay in it.

What happens if the output is wrong? Who sees it, who corrects it, what it costs. If nobody can answer, the use case is the wrong one.

What sequence actually works?

Four steps. Frame it: one page — the task in scope, who does it today, what counts as a good result, what is out of scope. If that page will not write itself, the project is not ripe.

Try small. A limited version, on a real piece of work, with two or three willing users. Not a demo: a trial in real conditions.

Evaluate on real cases. Take files already handled, where you know the right answer, and compare. It is tedious; it is the only proof worth having.

Decide. Extend, adjust, or stop. The right to stop is part of the method: a trial that concludes “no” has done its job. That is the whole point of starting small.

Which mistakes come up most often?

Four, and they look much the same from one company to the next. Starting with the most visible case rather than the simplest: the topic everyone talks about is usually the most tangled — several departments, scattered data, high exposure. Keep it for the second project.

Confusing a demo with going live. A convincing mock-up says nothing about the work left: access rights, edge cases, error recovery, training.

Planning nobody for upkeep. A tool lives: documents change, rules evolve, models too. With no named owner, it degrades quietly.

Believing you must “train an AI on our data”. Usually not: the system consults your documents at question time, learning nothing from them. Simpler, faster, far easier to correct.

Which rules do you need to know?

Two texts, and they ask for different things.

The GDPR, as soon as personal data is involved — customers, employees, applicants. Legal basis, informing people, retention periods: the usual rules apply, and France’s data protection authority, the CNIL, publishes practical guidance dedicated to AI. An impact assessment becomes mandatory in certain cases, notably where there is profiling or automated decision-making.

The EU AI Act, in application since 2 August 2026, but in stages: a regulation adopted in July 2026 pushed the high-risk obligations back to 2 December 2027, and to 2 August 2028 for AI built into already-regulated products. Two points come sooner. AI literacy: since February 2025 you have to take measures so your teams learn about the tools they use — an obligation of means, not a level you must guarantee. Informing people: a system designed to talk with someone must let them know they are dealing with an AI, unless that is obvious from the context; the duty falls on whoever builds the tool.

Neither text forbids you to start. They require you to know what you are doing.

Do you need an outside partner, and what should you ask?

A first trial on off-the-shelf tools is often run in-house, provided someone is genuinely given the time. As soon as you have to connect your systems, handle access rights or keep the tool alive over time, outside help earns its place.

What you ask of a partner comes down to little: that they tell you where your data goes and under what terms; that they document what they build, so someone else can take it over; that they accept a success criterion written in advance; that they tell you when a case is not worth doing.

Look too at what already exists: France’s Directorate General for Enterprise runs a national plan to spread AI use, with part-funded diagnostics and support schemes open to smaller companies that meet the criteria.

When is it better not to start yet?

There are moments when the honest answer is “not yet”. When nobody has the time: an AI project consumes hours from the business side, not only from an IT person. Without those hours, the tool gets built on guesswork.

When the process is not settled. If the way of working changes every month, or nobody can say what a good result looks like, you will get faster disorder.

When the knowledge is written nowhere. What exists only in two people’s heads cannot be tooled; it has to be written down first.

When the real problem is elsewhere. Many topics presented as AI topics are solved by a form field, a clearer rule or one fewer meeting. We say so when that is the case.