Where should a small business start with AI?

By LAN Service Group · Reviewed October 4, 2026

Step 1: Decide the rules before the tools

Your employees are probably already using AI tools, some with personal accounts. A one- or two-page policy that says which tools are approved, what data may and may not be entered, and who to ask is the fastest risk reduction available.

NIST's AI Risk Management Framework, released in January 2023 and intended for voluntary use, organizes AI risk work into four functions: Govern, Map, Measure and Manage. NIST also published a Generative AI Profile, NIST AI 600-1, in July 2024. You do not need to implement either in full, but Govern is the right place to start.

Step 2: Choose business-grade tools

Consumer AI accounts and business plans can differ on data use, retention and admin control. Read the vendor's commercial data terms before rollout.

If you already use Microsoft 365, Microsoft states that for Microsoft Copilot, prompts, responses and data accessed through Microsoft Graph are not used to train foundation models, and that Copilot only surfaces organizational data to which the individual user has at least view permission.

Step 3: Fix permissions first

That last point matters. An AI assistant that respects permissions will still find every file that was shared too broadly. Before a wide rollout, review sharing on SharePoint, OneDrive and Teams, remove 'everyone' access to sensitive sites, and label confidential data.

Step 4: Pilot on real work

• Pick two or three repetitive tasks: drafting proposals, summarizing meetings, answering internal policy questions, preparing first-pass reports
• Choose a small group of willing users and a baseline measure, such as hours spent per week
• Run the pilot for a defined period and record time saved, quality issues and data concerns
• Keep a human reviewing outputs; generative AI can produce confident errors
• Scale what works, drop what does not, and update the policy with what you learned

Step 5: Then consider custom AI

Custom AI, such as connecting models to your ERP, building agents that take actions, or training on proprietary data, can deliver more value but needs stronger data, security and governance foundations. Start it once the basics are in place and you know which problems are worth solving.

Whatever you build, keep an inventory of the AI tools and agents in use, who owns each one and what data it can reach. That inventory becomes the backbone of your governance as adoption grows, and it makes later questions from customers, insurers or auditors much easier to answer.

Common follow-up questions

Sources

• NIST: AI Risk Management Framework
• Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot