Most AI advice for small businesses is written for companies with an IT department. If you run a firm of five to fifty people, you do not have one. You have a bookkeeper, someone who “does the website”, and a shared inbox. This is a playbook for that kind of business: where automation pays off first, where it does not, how to find out before you spend anything, what UK data protection law asks of you, and what a sensible first project looks like.
I’m Wayne George, a software engineer in London. I have spent more than a decade building bespoke control systems for large corporate clients, which is still my day job, and in 2024 I founded Frontier Consulting to build custom software and AI systems for UK businesses.
Where automation pays off first
The best candidates share three traits: the work happens often, the steps are broadly the same each time, and somebody already knows what a correct result looks like. Five areas pass that test in most owner-managed firms.
Document handling
Supplier invoices, delivery notes and signed forms arrive as PDFs and photographs. Reading them, pulling out the fields that matter and typing them into your accounts package is work a language model does well and a person does badly at four o’clock on a Friday. It is also easy to check: a total matches the invoice or it does not.
Quoting
Most firms quote from a handful of patterns: read the enquiry, pick the pattern, adjust a few numbers, send a document. A system drafts the quote from the enquiry and your price list; a person approves it. The gain is speed, and the first sensible quote often wins the job.
Scheduling
Bookings, site visits and rotas are mostly plain rules that software you already own may cover. A model earns its place at the messy edge: turning “any afternoon next week except Thursday” into a booking request a person can confirm with one click.
Customer replies
Not a website chatbot, but drafting replies to the emails you already receive, using your own past replies as the reference, with a person pressing send. Sorting the inbox is the same job: “where is my order” and “can you quote for a new roof” should not land in the same pile.
Reporting
Two hours every Monday pulling figures from three systems into a spreadsheet is an obvious payoff, and most of it does not need AI at all. A model adds the two paragraphs on top that explain what changed.
Where it does not pay off
Rare work comes first: automating a task that happens twice a year costs more than it saves. Next is work where nobody can say what “correct” looks like; if two people would give different answers and defend them both, a model will not settle it.
Then there is anything where a wrong answer is expensive and hard to reverse: pricing a large tender, a safety decision, a regulatory filing. AI can help prepare; it should not decide. And the phone call to the client who has been with you for fifteen years is not a process at all. Leave it alone.
Finally, do not automate a broken process. Automating chaos gives you faster chaos.
AI features versus systems that do the work
Nearly every product you pay for has grown an “AI” button. That is a feature: it helps the person doing the task go a little faster, it is cheap, and it is worth switching on. But it does not change who does the work.
A system that does the work is different. It watches the inbox, reads the attachment, extracts the fields, checks them against your rules, posts the result into your accounts package, and raises the ones it is unsure about for a person. The person’s job shifts from doing the task to handling exceptions. That is where the return is, and the engineering: connecting to the tools you actually use, coping with odd cases, failing safely.
I wrote about this in You’re asking AI the wrong questions. The useful question is not “how can AI help me write this email?” but “why does a person need to be involved at all?”
How to run a discovery exercise
Discovery should take a week or two of part-time effort, not a quarter.
Follow the work, not the org chart. Ask each person to list, over five working days, every task that is repetitive, dull and involves moving information from one place to another. Do not ask what AI could do; ask what they would be glad never to do again.
For each candidate, note how often it happens, how long it takes, which systems it touches, what “done” looks like and what happens if it goes wrong. Then check where the data lives: a system with an export or an API is good; people’s heads and paper mean the first job is not AI but getting it into a system at all. Rank by frequency, time and how easy the result is to check, and pick one. Not three.
Imagine a twelve-person accountancy practice where clients send receipts by email and as WhatsApp photographs, and a junior spends part of each day re-keying them into the bookkeeping software. Frequent, unambiguous, already digital: it would top almost any list.
For an outside view, Frontier Consulting runs a free discovery test: a couple of minutes, no sign-up to start, and then, if you want it, an emailed PDF with “your score, category, and recommended next steps”. Treat it as a prompt for the five-day list, not a substitute.
Data protection basics
UK GDPR applies as soon as the automation touches personal data, which means anything that identifies a person: customer emails, employee records, the contact name on a supplier invoice. I am an engineer, not a lawyer, so I will point you at the Information Commissioner’s Office rather than paraphrase it. Several of the pages below now carry an ICO banner saying: “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change”, so read the live version rather than a printout from last year.
You need a lawful basis for the processing: the ICO’s guide to lawful basis lists seven, and says you “must determine your lawful basis before you start using the personal information and you must document it”.
You will probably need a data protection impact assessment. The ICO’s AI guidance says that “in the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals’ rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA”, and that if you decide otherwise you still have to document how you reached that view. Its DPIA guidance recommends doing one whenever you are in any doubt. For a small first project this is a few pages: what data, why, what could go wrong, and what you are doing about it.
You decide what data is processed and why, so you are the controller; the model provider and anyone building for you are usually processors, and the ICO is clear that “every time a controller uses a processor to process personal data, there must be a written contract” (ICO guidance on contracts). Read the provider’s data processing terms and check whether your data trains their models.
Keep a person in significant decisions. The rules on solely automated decisions with a “legal or similarly significant effect” now sit in Article 22A of the UK GDPR, and the ICO’s guidance on automated decision-making was updated on 31 March 2026 to reflect the Data (Use and Access) Act 2025. That update is still marked draft: the consultation on it closed on 29 May 2026, and the ICO says it will withdraw the older version “when we’ve finalised the updated guidance after the consultation”, so check which version is live before you rely on the detail. The principle is not in doubt. A hiring, credit or dismissal decision needs meaningful human involvement and a route to contest it. An invoice queue does not raise this; screening job applicants does.
Finally, organisations that use personal information, including sole traders, must pay the ICO’s data protection fee unless exempt, and its advice for small and medium organisations hub is worth an hour of your time.
Build or buy
Buy when the task is generic, a product already fits your systems, and the monthly cost is clearly less than the time it saves: transcription, document scanning, meeting notes, drafting inside your email client.
Build when the value lies in the join between your systems, when the product would make the business change to suit it, or when the configuration effort is so large you are building anyway. A “build” at this size is rarely a product; it is usually a modest amount of code around a model, connected to your accounts package and inbox, with a queue for a person to check.
Most projects are a mixture: buy the components, build the workflow that joins them. Either way, insist that your data stays yours and exportable, that the system can switch models without a rewrite, and that someone other than the original builder can understand it.
What a good first project looks like
Small, measurable and reversible.
Small means one process, one team, one kind of input, one kind of output. Measurable means you record a baseline (hours per week, or turnaround time) and measure again six weeks later with the same ruler. Reversible means the old way still works: the new system runs alongside it, a person checks every result until the error rate is known, and you can switch it off on a Tuesday afternoon without anyone noticing.
It should also be a little boring. Picture a building services firm with eight engineers and an office of three: supplier invoices go from the inbox into the accounts package, anything uncertain lands in a check queue, and the office manager records how many hours a week the re-keying used to take. That is a first project. A customer-facing chatbot is not.
How Frontier Consulting works
Frontier Consulting takes UK businesses from discovery to deployment, and its site puts that in three words: “Discover, deploy, thrive.”
It is a sequence, and the order is the point. Discovery is the cheap part and the part that decides everything else, which is why it starts with a free discovery test or a 20-minute strategy session, with, as the site says, “No obligation. No sales pitch.” Deployment means one small, measured, reversible project of the kind described above, rather than a platform. Thrive is the part that usually gets cut: documentation, handover and training, so the system belongs to the business rather than to whoever built it.
Where to start this week
Ask your team to keep the five-day list. Take the discovery test if you want a second opinion in a couple of minutes, or book a strategy session if you already know which process is eating your week. And if you would rather see what I build when I am my own client, that is what the work page is for.
Then choose one process, and choose the dull one. The firms that get real value from this in the next year will not be the ones with the cleverest model. They will be the ones that picked a frequent, checkable, thoroughly boring job, handed it to a machine, and kept somebody watching the queue.