What does AI for business actually mean for a smaller company?
For a company of 5 to 200 people, AI for business mostly means generative assistants doing language work: drafting, summarising, rewriting, extracting and explaining. It rarely means building a model or hiring a data science team. The tool is usually one you can subscribe to this afternoon; the decisions about how it is used are what take time.
That pattern shows up in published research. In the UK government's AI Adoption Research, based on 3,500 business interviews carried out between February and May 2025, 85% of businesses already using AI said they used natural language processing and text generation, far ahead of any other type. The same survey found that around one in six UK businesses (16%) were using at least one AI technology at all. Both figures are self-reported by the person responsible for technology, so treat them as a snapshot rather than a rule for your sector.
The practical consequence is that AI for business is mostly a people and process question. Who is allowed to use which tool, on which tasks, with which information, and who checks the result before it reaches a customer? A company that answers those four questions clearly will get more from a basic assistant than a company that buys an expensive one and leaves everyone to work it out.
Which AI is good for business?
The best starting tool is usually the general assistant that fits the software your team already lives in, on a business plan whose data terms you have read. A company that runs on Microsoft 365 will usually evaluate Copilot first; a Google Workspace company will usually evaluate Gemini; a team that works across many tools, or does a lot of long-form writing and analysis, will often compare ChatGPT and Claude business plans. None of these is the right answer for every team, and plan features change often enough that you should check the vendor's current plan page rather than a ranking article.
Look at the data terms before the feature list. Business and enterprise plans are generally offered with different data handling from free consumer accounts. For example, Anthropic's privacy centre states that by default it does not train its models on inputs or outputs from its commercial products, such as Claude for Work and the API, unless the customer gives feedback or otherwise allows it. Check the equivalent page for whichever tool you choose, and confirm it applies to the plan you are actually buying.
Specialist tools come later. A transcription tool, an AI feature inside your helpdesk or an image generator can be worth it for one team, but each one is another place where company information goes and another set of terms to read. Start with one general assistant, learn how your team reviews its output, then add specialist tools where a clear task justifies them. Our guide to choosing AI tools for work covers the approval questions in more detail.
| If your team mostly works in | Start by evaluating | Check before you buy |
|---|---|---|
| Microsoft 365 (Outlook, Word, Excel, Teams) | Microsoft Copilot on a business plan | Which apps and data Copilot can reach under your licence and permissions |
| Google Workspace (Gmail, Docs, Sheets) | Gemini for Workspace | Which Workspace edition includes it and what admins can switch off |
| A mix of tools, or heavy writing and analysis | ChatGPT or Claude business plans | Data training defaults, retention, admin controls and seat terms |
| One narrow task, such as call notes or images | A specialist tool, after a general assistant | Where files are stored, who can see them and how to delete them |
How do you implement AI in business, step by step?
Implement AI the way you would introduce any new working method: one owner, a short list of approved tasks, written boundaries, a review step and a date to decide whether to continue. The steps below suit a company without an IT department, and they take weeks rather than months.
1. Name an owner
One person decides which tools are approved, answers questions and keeps the list current. In a small company this is often the operations lead or a founder, not a committee.
2. List repeated language tasks
Ask each team for three tasks they do every week that involve reading or writing: supplier emails, meeting notes, first drafts of proposals, product descriptions, policy summaries. Repetition matters more than size.
3. Score each task for consequence
Mark what happens if the output is wrong. An internal meeting summary is low consequence; a quote to a customer or a payroll explanation is high. Start with low and medium tasks that have an obvious reviewer.
4. Choose one tool and one plan
Pick the assistant that fits your existing software, on a business plan, and read its data terms. Do not let each person choose their own free account.
5. Write the boundaries on one page
Which information can go into the tool, which must not (client records, personal data, unreleased financials, passwords), who reviews what, and who to tell if something goes wrong.
6. Teach the review, not just the prompt
Show people how to supply context, then how to check facts, figures and tone before anything leaves the building. Practise on fictional or approved examples first.
7. Review after four to six weeks
Look at real work samples, ask what people stopped using and why, and decide which tasks to keep, change or drop. Expand only the routines that held up.
What does this look like in a real team?
Take a fictional company, Brightwater Interiors: 22 people selling furniture online, with a small customer service team, two marketers and an operations lead. The operations lead becomes the owner, picks one business-plan assistant and approves two first tasks: drafting product descriptions from the supplier spec sheet, and drafting replies to delivery questions from the order notes. Customer names and addresses stay out of the tool; agents paste only the order status and the question.
A marketer's first prompt is: 'Write a product description for an oak dining table.' The output is fluent and wrong in useful ways. It calls the table 'solid oak' when the spec sheet says oak veneer on engineered board, claims it 'seats eight comfortably' when the spec lists six, and promises 'free next-day delivery', which Brightwater does not offer.
The reviewed version of the prompt supplies the spec sheet text, the brand's tone notes and three rules: use only facts in the spec, flag any missing detail instead of guessing, and never mention delivery terms. The new draft says 'oak veneer', 'seats six', and ends with a note: 'Spec sheet does not give the table's weight; please confirm before publishing.' The marketer checks every factual phrase against the spec and publishes. The time saved is real but modest; the bigger gain is that the team now has a repeatable prompt and a check that catches the kind of error a customer would complain about.
What Brightwater deliberately did not do: let the assistant send replies to customers directly, paste whole order exports into it, or announce a company-wide rollout before the two tasks had been reviewed. Those decisions can come later, once the review habit exists.
What should an AI strategy for a small business contain?
An AI strategy for a small business can fit on one page: why you are using AI, which tools are approved, which tasks are in and out, what information must stay out, who reviews what, how people will learn, and how you will decide whether it is working. Anything longer is usually a sign that the decisions have not been made yet.
This is a smaller version of what risk frameworks describe. NIST's AI Risk Management Framework, which NIST describes as intended for voluntary use, groups its guidance under Govern, Map, Measure and Manage, and its Govern guidance asks for documented roles and responsibilities, training so that people can perform their duties under the organisation's policies, and clear paths to escalate concerns. A 20-person company does not need the full framework, but the same four habits apply: know who is responsible, know what tools are in use, train people for the tasks they actually do, and make it easy to raise a problem.
Purpose
Two or three sentences on what you want AI to help with, such as faster first drafts in marketing or quicker summaries of supplier documents.
Approved tools and plans
The named tool, the plan, who administers it and how people get access.
Tasks in and out
A short list of approved tasks, and the tasks that are not allowed yet, such as anything that makes a decision about a person.
Information boundaries
What may be entered and what may not, with examples people will recognise from their own work.
Review and sign-off
Who checks which outputs before they leave the company, and what they check for.
Learning
How people will practise, and who they ask when they are unsure.
Review date
When you will look at the evidence and decide what to keep.
Want to see how this connects to a role?
Explore the planned team trial ↗What are the main risks, and who checks the output?
The everyday risks are confident errors, sensitive information going into the wrong tool, and people trusting the output because it reads well. NIST's Generative AI Profile names confabulation, which it defines as the production of confidently stated but erroneous or false content, as one of the risks specific to generative AI. It also describes automation bias, or excessive deference to automated systems, and notes that it can make other risks worse. In plain terms: the tool will sometimes be wrong, and people are inclined to believe it.
UK guidance points the same way. The NCSC recommends not including sensitive information in queries to public large language models, and Acas advises employers that outputs should be checked for accuracy, tone and bias, that existing data privacy policies apply to AI use, and that staff may need training to get the best outputs. If personal data is involved, the ICO's guidance on AI and data protection covers accountability, lawful basis and data protection impact assessments. This guide is general information, not legal advice; take advice for your own situation.
The fix is boring and effective. Every approved task has a named reviewer, the reviewer knows what to check (facts against a source, figures recalculated, promises the company cannot keep, tone for the audience), and anything consequential is signed off by a person who understands the subject. Our guide to fact checking AI output turns this into a routine people can practise.
Why do people stop using AI after the launch?
People stop when they cannot see which of their own tasks AI helps with, when they are unsure what they are allowed to paste in, or when an early bad output convinced them it is not worth checking. Buying seats does not solve any of these. In the DSIT research, businesses already using AI reported that on average 30% of their staff were using it, and 77% said fewer than half of their staff were. In the same survey, the most commonly cited reasons for not adopting AI at all were a lack of identified need and limited AI skills and expertise.
The remedy is specific. Give each role two or three approved tasks with an example prompt and a review checklist, make the boundaries short enough to remember, and give people a safe place to practise where a bad first attempt costs nothing. Our guide to AI adoption covers the low-use-after-rollout problem in detail, including what a manager can do in the first month.
How do you know whether AI is working in your business?
Measure a few named tasks, not AI in general. Before the rollout, note roughly how long a task takes and how often the reviewer sends it back. After four to six weeks, look at the same task: is the first draft closer to usable, are the reviewer's corrections smaller, and are errors being caught before they reach a customer? Those observations are more useful than a count of logins.
Be careful with self-reported gains, including your own. In the DSIT survey, 56% of businesses using AI reported an increase in employee productivity, while 77% reported no change in revenue yet, and the report itself notes these figures are self-reported estimates. Inside your company, keep the evidence close to the work: a few before-and-after samples, the reviewer's notes and a short conversation with the people doing the task.
When is AI the wrong answer for a business problem?
AI is the wrong first move when the underlying process is unclear, when nobody can check the output, or when the task is a decision about a person. If your quoting process is inconsistent, an assistant will produce inconsistent quotes faster. If nobody in the company can tell whether a tax explanation is right, the tool should not be writing it. If a task decides who gets hired, promoted, disciplined or refused a service, it needs a much more careful approach than a general assistant and a quick review.
It is also the wrong answer when the volume is tiny. Writing one supplier email a month does not justify a new tool, a policy and training. And it is not a substitute for expertise you do not have: AI can help a qualified person work faster, but it cannot make an unqualified person's output safe to rely on. Saying no to a use case is a perfectly good outcome of the review.
Where does training fit, and where does Tosheo.ai come in?
Training is the step most small companies skip, because the tools look easy. The gap is rarely knowing which button to press; it is knowing what context to give, what to keep out and how to check the result for a specific job. That is easiest to learn by practising real tasks with feedback, rather than by watching a general course.
Tosheo.ai is being built to do exactly that for teams of 5 to 200 people. At launch, a manager is planned to pick roles and the AI tools the team uses, and each person takes a short diagnostic, then works through 10 to 15 minute lessons that end in a hands-on task with a real AI tool, graded against a visible rubric. Managers are planned to see skill progress and completion, never raw chat logs. The product is pre-build, so there are no customer results to show. Planned prices are on the pricing page, and if you only need a policy or a first task list, the free guides on this site may be enough.
Sources and scope
DSIT, AI Adoption Research report (fieldwork February to May 2025), published January 2026 ↗
GOV.UK, AI Adoption Research publication page, revised February 2026 ↗
NIST, AI Risk Management Framework overview, January 2023 ↗
NIST, AI RMF Playbook: Govern ↗
NIST, AI 600-1 Generative AI Profile, July 2024 ↗
NCSC, ChatGPT and large language models: what's the risk?, 14 March 2023 ↗
Acas, One third of employers think AI will increase productivity, 15 May 2025 ↗
ICO, Guidance on AI and data protection, dated 15 March 2023 ↗