Start with AI by choosing one frequent, rule-shaped process, checking its data, agreeing simple rules for AI use, trialling a small build with a person checking the output, and measuring the result before you scale.
In short: start with one process, not a technology. Check your data, name an owner for AI use and keep a list of the tools in play. Build the smallest version that does real work, keep a person in control, and compare the result with your starting point before you do more. Australia's business.gov.au says to trial AI in one or two areas first. UK guidance sits across several regulators, mainly on data protection and security, and it is worth reading together.
The UK's Office for National Statistics reports that in September 2026 "3 in 10 (30%) businesses reported use of at least one type of AI technology". That covers private-sector businesses of all sizes, but not every industry. Agriculture, finance and insurance and public administration, among others, are outside the survey (ONS, Business insights and impact on the UK economy, 8 October 2026). In Australia, the Australian Bureau of Statistics reports that "Around 12 per cent of Australian businesses reported the use of AI in their workplace" in the 2024-25 financial year. Uptake among small and micro businesses was "lower, at around 11 per cent" (ABS, Business adoption of Artificial Intelligence accelerates in 2024-25). The two surveys differ in timing and method, so do not compare the figures directly. On both surveys, most businesses did not report using AI. This guide gives the practical order, with the official sources linked so you can read them yourself. We last checked every source on 20 October 2026.
What is the first step to starting with AI?
The first step is to pick one process to improve, not to pick a tool. Choose work that is frequent, follows clear steps and has an owner who wants it improved. Everything else in the plan below follows from that choice.
What is a sensible plan for starting with AI?
Six steps, in this order. Each one is small, and each one makes the next safer.
Step 1: pick one process
Choose one frequent, rule-shaped process with a named owner, and leave everything else for later. Look for work that is frequent and irritating: the same information typed into two systems, a shared inbox that backs up whenever someone is away, a report rebuilt by hand each month. Australia's business.gov.au advises: "Start by trialling AI in 1 or 2 areas of your business" (business.gov.au). For a ten-minute scoring method, see which business process to automate first.
Step 2: check your data
Know what data the process uses, where it lives and whether you may use it, before anything is connected. AI is only as useful as what it reads. Australia's National AI Centre asks: "Is our data accurate and relevant?" (Get ready for AI). Write down where the data lives, who can see it and whether it includes personal information. In the UK, the ICO's AI hub offers a risk toolkit for assessing the risks to individuals' rights and freedoms from your own AI systems. See our guide to using AI safely with business data.
Step 3: set rules for AI use
Name one owner, write a one-page policy and keep a list of the AI tools in use, before the trial starts. The National AI Centre's foundations guidance, written for teams "starting to use AI", says to "Assign a senior leader as the overall AI governance owner" (Guidance for AI adoption: foundations). It also lists "Create an AI policy" and "Create and maintain an AI register" as getting-started actions. In practice that means one named owner, a one-page policy on what staff may put into AI tools, and a list of the tools in use. The register should also cover AI "embedded in other systems", such as human resources and customer engagement tools. Our guides to writing an AI policy and handling AI tools your team adopts on their own cover both.
Step 4: try a small build with controls
Build the smallest version that does real work, with a person checking its output. Connect it to the systems your team already uses. Decide in advance what it may do, what it must hand to a person and what gets recorded. The National AI Centre's foundations guidance asks you to "Ensure meaningful human oversight". It also says to test before you deploy and, if you are buying an AI system, to ask the developer or supplier to show proof that it has been properly tested. In the UK, the NCSC says security should be part of an AI project from the start, and asks whether you can put the right questions to suppliers about their own security. We would start by asking how any supplier protects your data.
Step 5: measure against where you began
Record how the process runs before the trial, then compare the same measures afterwards. Before the trial, note the time it takes, how often it goes wrong, where it sticks and who deals with the exceptions. Write down what success would look like in plain terms, such as fewer errors or less time spent re-keying, so you are not judging the result by how impressive it feels. Run the trial for long enough to cover an ordinary spell of work, including the awkward cases, and keep a person reviewing a sample of what the system produces.
The foundations guidance says to "Monitor your system after you deploy it", because behaviour can change over time, so measuring does not stop when the trial ends. At the end, compare the same measures with the same starting point, and include the time your people spend checking the output. Then make one of three decisions: extend it, change it or stop. Stopping is a legitimate result if the figures do not justify going on. For a fuller method, see how to tell if an automation actually paid off.
Step 6: scale one process at a time
Scale only after the first process has an owner, a record and a measured result. Then choose the next process and repeat the same six steps. The foundations guidance makes the same point about governance: begin with the "getting started" actions and add the "next steps" as your use grows. "You don't need to do everything at once." Add each new tool to your list as you go, and raise the level of testing and review as the stakes rise.
This guide is about the first project. When you are ready to plan beyond it, our guide to building an AI roadmap for a small business covers scoring a longer list of candidates, grouping them into horizons and setting a review cadence. And when a new tool reaches the wider team, how to roll out AI to a small team covers bringing people with you, from owners for each tool to a short retrospective.
Where should you start, by problem?
This table is our own approach, drawn from how we run first projects. It is not government guidance.
| Your situation | A sensible first move | Watch for |
|---|---|---|
| Staff already use free AI tools on their own | Write a short AI policy and a list of tools before building anything | Personal or client information going into public tools |
| Enquiry emails pile up | Sort and draft replies, with a person approving what is sent | Wrong answers reaching customers unchecked |
| The same data is typed into two systems | Plain workflow automation, with AI only where a step must read documents or emails | Using AI where a fixed rule would do. See why simple automation often beats AI |
| Calls go unanswered out of hours | Trial a packaged AI receptionist, then see whether a custom build is justified. See AI receptionist or custom voice agent | Hand-over rules, and the rules on recording calls |
| Month-end reporting takes days | Automate pulling figures from your accounting software into one report that your finance lead reviews. See month-end close automation | Every figure must trace back to its source |
| No spare time and no technical person | An outside assessment that ranks the options and says what to leave alone | Advice that starts with a product |
A one-page readiness checklist
Answer these before you build anything. If you cannot answer one, that is the next thing to find out.
- Can you describe the process in one sentence?
- Who owns it, and do they want it improved?
- How long does it take today, and how often does it go wrong?
- What data does it use, where does that data live, and may you use it for this purpose?
- What may the build do, and what must it hand to a person?
- Who will review the output, and how often?
- Which systems does it touch?
- What result would make you stop?
What do the Australian and UK governments say?
Australia. The government's guidance for businesses starting out sits mainly with the National AI Centre. Its foundations guidance (published 5 May 2026) sets out six essential practices. They are: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. Teams that build or customise AI systems should move on to the implementation guidance. The same goes for teams that manage higher-risk uses. On privacy, the Office of the Australian Information Commissioner (OAIC) states that "The Privacy Act applies to all uses of AI involving personal information" (OAIC).
United Kingdom. There is no single start page, so read the regulators' pages together.
- Data protection. The Information Commissioner's Office (ICO) AI hub explains how data protection applies to AI and includes an "AI and data protection risk toolkit". Its guidance on AI and data protection is "under review and may be subject to change" following the Data (Use and Access) Act, so check it is current.
- Security. The National Cyber Security Centre (NCSC) page AI and cyber security: what you need to know is written for managers without a technical background. It says "Security should be integrated into all AI projects and workflows in your organisation from inception."
- Governance. The Department for Science, Innovation and Technology (DSIT) has said it "will not be publishing AIME", its AI Management Essentials tool, and that it plans future guidance that will "specifically target SMEs" (GOV.UK government response, updated 6 February 2026). Until that arrives, the Australian six practices are a useful checklist, though they are not UK guidance.
What should you avoid when starting with AI?
- Starting with the tool. If the first conversation is a demo before anyone has described the process, the answer was chosen before the question.
- Putting personal information into public AI tools. The OAIC recommends that organisations "do not enter personal information, and particularly sensitive information, into publicly available generative AI tools". For the UK, read the ICO guidance linked above.
- Treating the purchase as the finish. The OAIC says due diligence on an AI product "should not amount to a 'set and forget' approach". Someone has to keep checking.
- Having no owner. If nobody is accountable for a tool, nobody notices when it goes wrong.
- Trialling on your most sensitive process. Begin where a mistake is an inconvenience, not a risk to a customer.
How do we help businesses start with AI at GME Solutions?
We follow the same order, whatever the technology. First we map how the process runs today, step by step, and write down who touches each step and which system holds each piece of information. Then we decide whether it needs AI, plain automation or a simpler fix. We build the smallest version around your own systems, agree in writing what it may do and what it must hand to a person, and keep a record of each step so a reviewer can trace it. We work with your data ourselves, or alongside your own data or tech team, and we record the starting point so the result can be measured. If AI is the wrong answer, we say so.
GME Solutions designs and builds custom AI solutions and workflow automation for growing businesses in Australia and the UK. GME Solutions was founded by Greg East, a chartered accountant, whose audit training taught him how businesses run, how to improve processes and how controls work. Every number we report traces back to its source.
If you would rather have part-time senior help setting the roadmap and the rules, that is what a fractional Chief AI Officer does. For the supplier choices, see what an AI consultant does and how to choose one. If you have a process in mind, get in touch.
Frequently asked questions
How can a small business start with AI? Pick one frequent, rule-shaped process with a named owner. Check the data it uses, set simple rules for AI use, then trial the smallest version that does real work with a person checking the output. Measure the result against where you began and scale only if it paid off.
What is a good first AI project for a small business? One that is frequent, follows clear steps, has an owner who wants it improved and uses data you may use for the purpose. A process where a mistake would harm a customer is a poor first choice.
Do you need an AI policy before you start? Australian guidance lists creating an AI policy and an AI register among its first actions, and a short policy is sensible in the UK too. It can be one page: who owns AI use, what staff may put into AI tools and which tools are approved. Your legal adviser can confirm any obligations specific to your business.
Is it safe to put customer information into AI tools? Not into public tools without care. The OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. In the UK, the ICO publishes guidance on AI and data protection. Check what any supplier does with your data before you connect it.
Does a small business need an AI consultant to start? Not always. Many businesses can run a first trial with tools they already have, using the government guidance linked in this guide. A consultant helps when you cannot spare the time, the process touches several systems or you want the controls designed in from the start.
General information, written to be useful. It is not financial, tax, investment or legal advice. For decisions specific to your business, take advice from a suitably qualified professional.