Which AI projects should a small business do first?

By Hugh Donatello, LAN Service Group · Published October 20, 2026 · Updated October 20, 2026

✓ Checked against Microsoft's Data, Privacy, and Security for Microsoft 365 Copilot page on October 20, 2026 (the Copilot comparison row). No other vendor terms or prices are stated on this page.

Short answer

Start with the use case that scores highest on value and readiness and lowest on data sensitivity, effort and risk: usually a frequent, internal task such as drafting from your own templates, done in an approved tool, with a person checking every output. Score value, sensitivity, effort and risk 1 to 5, answer five readiness checks, and set aside anything touching regulated data or decisions about people until its prerequisites are in place. CIO Support's free Excel worksheet does the scoring.

Free AI use-case prioritization worksheet

Score each candidate AI use case from 1 to 5 on value, data sensitivity, effort and risk, answer five readiness checks, and the sheet works out a score out of 100, flags use cases that need prerequisites first and ranks the rest. Worked example included. No form or sign-up. General guidance, not legal advice; not published or endorsed by NIST.

Download Excel (.xlsx)

Score every candidate on the same five factors

Most small companies have more AI ideas than time. The fastest way to pick is to write every candidate down as one row, one use case per row, and score each on the same five factors. Two factors count in its favour: value, meaning how much time or quality it gives back on work you do often, and readiness, meaning whether the tool, data, owner, policy and a baseline measure are already in place. Three count against it: data sensitivity, effort and risk.

This is CIO Support's method, not a standard, but the scores give evidence for outcomes in NIST AI 100-1, the AI Risk Management Framework (AI RMF 1.0). MAP 1.4 asks that the business value or context of business use is clearly defined. MAP 3.1 asks that potential benefits are examined and documented, and MAP 3.2 asks the same of potential costs, including non-monetary costs, which result from expected or realized AI errors. MANAGE 1.2, which is about treating risks rather than choosing projects, asks that treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods; weighing effort against risk borrows the same idea. Readiness corresponds most closely to GOVERN 1.3, processes to determine the needed level of risk management activities, and to the pilot decision in MANAGE 1.1, described below. Scoring the candidates side by side records that evidence in one place.

Score with the people who do the work, not only the people who want the project. The AI RMF Playbook's suggested actions for MAP 3.1 include engaging with system end users to understand potential benefits and considering performance against human baseline metrics, which in a small company usually means: how long does this task take today, and who would check the AI's output?

The five scoring factors and what 1 and 5 mean (CIO Support scale)
Factor	Scores 1 when ...	Scores 5 when ...	How it counts	Source
Value	The task is rare or a nice-to-have, and saves little time.	The task is frequent, done by several people or central to serving customers, and the gain can be measured against today's time.	Higher is better	[1] [2]
Data sensitivity	The tool sees only public information.	The tool would see regulated data, such as health information, including protected health information (PHI) and clinical-trial participant data, Controlled Unclassified Information (CUI), GxP records or payment card data, or data a contract restricts.	Higher counts against	[1] [6] [7]
Effort	It runs in a tool you already license, with no integration or data clean-up.	It needs a custom build, model training or major data work.	Higher counts against	[1] [2]
Risk	A wrong output stays internal and is easy to spot and fix, and the tool cannot show data to the wrong person.	The AI makes or materially shapes a decision about a person, such as hiring, credit or care, creates or changes a GxP record, or acts without a person approving it.	Higher counts against	[1] [3] [8] [9] [10]
Readiness	None or only one of the five readiness checks is in place.	All five are in place: an approved tool on company accounts, the data in known places with reviewed permissions, a named owner, a policy that covers this use, and a baseline measure.	Higher is better; the worksheet counts the checks for you	[1] [2]

Scale definitions and the five factors are CIO Support guidance, not a NIST scale. NIST does not prescribe a scoring method or risk tolerance; the Scales tab of the worksheet lets you change every definition and weight.

How the score is worked out

Value, data sensitivity, effort and risk are scored by hand from 1 to 5. Readiness is worked out for you: it is the number of the five readiness checks answered Yes, with a minimum of 1, once all five are answered. The worksheet flips the three factors that count against a project, so a data sensitivity of 2 counts as 4, then adds the five numbers and scales the total to a score from 0 to 100. With every factor at 5 in the project's favour the score is 100; with every factor at its worst it is 0. All five factors carry equal weight unless you change the weights on the Scales tab, for example to give value double weight if your main goal is saving time.

Two more rules sit on top of the score. First, a gate. Any candidate scored 5 for data sensitivity, 5 for risk, or 1 for readiness is marked Prerequisites first, whatever its score. The gate is modelled on the AI RMF Playbook's suggested action for MAP 1.5, to identify a maximum allowable risk tolerance above which the system will not be deployed. A gated use case is not banned; it means the compliance or governance work comes first, and the use case is not deployed until it is done. If you are a HIPAA covered entity or business associate, then among other things a business associate agreement with the AI vendor generally has to be in place before protected health information is entered (45 CFR 164.502(e)). If your DoD contracts include DFARS 252.204-7012, NIST SP 800-171 applies to any contractor system that processes, stores or transmits covered defense information, including an AI tool, and a cloud AI service that stores, processes or transmits that information must meet security requirements equivalent to the FedRAMP Moderate baseline. If the AI's output becomes or changes a GxP record, such as an SOP, batch record, deviation or study report, whether, and how far, the tool must be validated for that use depends on a documented risk assessment of its effect on product quality, safety and record integrity. The predicate rules that require the record apply, and FDA's 21 CFR Part 11 or EU GMP Annex 11 may also apply. Score its risk 5, even when the drafting looks routine; once your quality unit has made and recorded that decision, it signs off the row in the Prerequisites signed off column, and the score stays at 5. AI that informs patient care can be regulated by FDA as a medical device, and only some clinical decision support software is excluded, so get regulatory advice before any pilot.

The sensitivity and risk gates do not lift on their own, and a score should not be lowered to clear them: regulated data stays at 5. Instead, once the prerequisites are in place and documented, a named approver enters their name and the date in the worksheet's Prerequisites signed off column. That lifts the sensitivity and risk gate for that row, which is then ranked on its score like any other. The readiness gate still applies until at least two readiness checks are in place. The approver should have authority for that area, such as the quality unit for GxP records or the privacy or security officer for PHI, and should not be the person proposing the project. A typed name in a spreadsheet does not meet the 21 CFR Part 11 requirements for electronic signatures and is not a validation record; keep the real approvals in your own quality or compliance system. If the tool, the data or the use changes, clear the sign-off and re-score the row. Do not raise the gate settings on the Scales tab to get one row past the gate.

Second, a suggested order. Ungated candidates scoring 70 or more are marked Do first, 50 to 69 Next, and under 50 Later. The worksheet also ranks the ungated candidates from highest to lowest score. These thresholds are our suggestion for a small company, not a NIST rule; move them on the Scales tab if they put too many or too few projects in the first group. The point of the numbers is not precision, it is making the trade-offs visible so the team argues about the right things.

A worked example, and three candidates to compare

The rows below describe a hypothetical professional-services company of about twenty people that already licenses an AI assistant on company accounts. The scores are illustrations of the method, not measurements, and your own will differ with your data, customers and contracts.

The worked example is drafting first versions of routine proposals and client emails from the company's own templates. Value is 4 because several people write these every week and the time spent today can be measured. Data sensitivity is 2: client names and scope are internal business information, with no regulated data. Effort is 2: the tool is already licensed and the templates exist. Risk is 2 because a person reads and edits every draft before a client sees it. Readiness is 4: the tool, the template folder, the owner and the policy are in place, but nobody has yet timed how long a proposal takes today. Flipping the three negatives gives 4, 4, 4, 4 and 4, a total of 20. Totals can range from 5 to 25, so the score is (20 - 5) / 20 x 100 = 75. It is not gated, so it is marked Do first. Before the pilot starts, time a few proposals so there is a baseline to compare against.

The comparison rows show why readiness and the gate matter. Asking Microsoft 365 Copilot to summarise and find content across all SharePoint and OneDrive files has real value, but Microsoft states that Copilot only surfaces organizational data to which individual users have at least view permissions, so files that are over-shared become easy to find. With the permissions not yet reviewed, readiness is low and the score lands in Later. Reviewing the permissions lifts it to 45, still Later; extending the AI policy to cover Copilot as well lifts it to 50, which moves it to Next. AI screening of job applicants scores 5 for risk because it shapes decisions about people, so it is gated, and NIST AI 600-1 lists harmful bias or homogenization among the risks of generative AI.

Worked example plus three comparison candidates (illustrative scores, hypothetical company)
Candidate use case	Value	Data sensitivity	Effort	Risk	Readiness (checks in place)	Score / 100	Result	Source
Worked example: draft routine proposals and client emails from our own templates in the approved AI assistant; a person edits every draft	4	2	2	2	4 (tool, data, owner, policy; no baseline yet)	75	Do first (rank 1)	[1] [2]
Website chatbot answering customer questions from published FAQs	3	2	3	3	3 (data, owner, policy; no approved tool or baseline yet)	55	Next (rank 2)	[1] [3]
Microsoft 365 Copilot summarising and finding content across all SharePoint and OneDrive files	3	4	3	3	2 (tool, owner; permissions not reviewed, no policy or baseline)	40	Later (rank 3): review permissions first	[5] [1]
AI screening or ranking of job applicants	3	4	3	5	2 (owner, baseline)	30	Prerequisites first (gated: risk 5)	[3] [1]

Example rows and scores are CIO Support illustrations for a hypothetical company, not data from any client. They are the same four rows that come pre-filled in the worksheet, where the score, gate, result and rank are calculated by formulas. The Copilot statement is from Microsoft's Data, Privacy, and Security for Microsoft 365 Copilot page, checked October 20, 2026.

Turn the top score into a pilot

A high score is a reason to try a use case, not proof that it works. Run the top one or two as a small pilot with willing users, real work and low-risk data, and decide in advance what result would make you expand, change or stop. NIST's MANAGE 1.1 outcome is exactly that decision: a determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.

Keep a person reviewing every output during the pilot. NIST AI 600-1, the Generative AI Profile, names confabulation, the production of confidently stated but erroneous or false content, as a generative AI risk, and lists over-reliance among its human-AI configuration risks. Record the time saved against the baseline, the review effort the output needed, and any wrong answers or data-handling problems.

Re-score the list after each pilot and at least every quarter. Readiness changes as you fix permissions, approve tools and write policy, so a project can move up a group, for example from Later to Next, without anything else changing, and one held back only because its readiness was 1 joins the ranking once a second check is in place. If a use case moves into everyday use, add it to your AI risk register and your inventory of AI tools, with its owner and the data it touches.

List the candidates. Ask each team which repetitive tasks they would hand to AI and which AI tools they already use. Write one row per use case, not per tool.
Score the five factors. Score value, data sensitivity, effort and risk from 1 to 5 using the Scales tab, and answer the five readiness checks Yes or No. Score with the people who do the work.
Read the result. The worksheet calculates the score out of 100, applies the gate, marks each row Do first, Next, Later or Prerequisites first, and ranks the ungated rows. For a gated row, do the prerequisite work and have a named approver sign it off; never lower a score to clear the gate.
Pilot the top one or two. Measure today's time first, run a short pilot with a person checking every output, and decide in advance what result means expand, change or stop.
Re-score. Update readiness as gaps are fixed, re-score after each pilot and at least quarterly, and move use cases that go live into your AI risk register.

What the free Excel worksheet contains

The workbook opens on a How to use tab. The Worksheet tab has one row per candidate with drop-downs for the 1 to 5 scores and the Yes or No readiness checks, a Prerequisites signed off column for gated rows, and formulas that work out readiness, the score out of 100, the gate, the result and the rank. The worked example and the three comparison rows from this page are pre-filled, marked as examples, ready to overwrite. A Scales tab holds the definitions of every score, the five weights, the gate settings and the Do first and Next thresholds, so you can change them in one place.

The worksheet pairs with CIO Support's free AI readiness checklist, which checks the company-wide foundations such as permissions, identity, shadow AI and governance, while this worksheet ranks individual use cases. Both are general guidance, not legal advice, and neither is published or endorsed by NIST. NIST says AI RMF 1.0 is being revised; the subcategory numbers on this page and in the worksheet are from version 1.0.

Common follow-up questions

What is a good first AI project for a small business?

Usually a frequent internal task, such as drafting from your own templates, summarizing internal documents or first-pass research, done in a business-grade tool you already license, using internal rather than regulated data, with a person reviewing every output. Score your own candidates rather than copying a list: the best first project depends on your data, tools and readiness.

Which AI projects should a small business avoid at first?

Anything that makes or materially shapes decisions about people, such as hiring, credit or care, anything that acts without a person approving it, and anything that touches regulated data like PHI or CUI before the compliance prerequisites are in place. The free worksheet marks these Prerequisites first. They can come later, once the governance work is done and a named approver has signed off the prerequisites in the worksheet; do not lower a score to get past the gate.

Is the AI use-case prioritization worksheet free?

Yes. Download the Excel worksheet on this page with no form, email or sign-up. It is general guidance, not legal advice, and it is not published or endorsed by NIST.

Does NIST tell you how to prioritize AI use cases?

Not with a scoring method. NIST AI 100-1 describes outcomes, such as documenting business value, benefits and the costs of AI errors, and prioritizing the treatment of risks by impact, likelihood and available resources. It does not prescribe a scale or a risk tolerance. The five-factor score on this page is CIO Support's way of recording evidence for the MAP outcomes for a small company; weighing effort against risk borrows the idea of MANAGE 1.2, which is about prioritizing the treatment of documented risks.

How is this different from an AI readiness assessment?

An AI readiness assessment checks the company as a whole: permissions, identity, shadow AI, policy and regulated data. This worksheet ranks individual use cases. Do both: the readiness checklist tells you what to fix, and the worksheet tells you which project to start once enough is fixed.

Can I change the weights or thresholds?

Yes. All five factors have equal weight by default; change the weights, the gate settings and the Do first and Next thresholds on the Scales tab, and the score, result and rank recalculate. Record the change so the team knows why the ranking moved. Do not raise the gate settings to clear a particular row; use the Prerequisites signed off column instead.

Need help with this?

LAN Service Group helps small and mid-size businesses choose and pilot their first AI projects, from scoring candidate use cases and fixing the readiness gaps to running a measured pilot, as a fractional CIO or as their managed IT provider, fully outsourced or co-managed alongside in-house IT staff.

Talk to LAN Service Group LAN Service Group AI services → (888) 281-7243