Adopting AI in an SME: the roadmap for the first 90 days
Adopting AI in an SME means settling three things in parallel: a tool, a rule and a handful of use cases that genuinely hold up in daily work. Between unframed individual experiments and a large project with a requirements specification sits the pragmatic route – a structured rollout in three phases of 30 days each.
The roadmap does not assume an in-house IT department. It assumes one responsible person with a mandate, three to five clearly named use cases, and the willingness to provide the tool first and write the rule second.
This article describes the three phases, the roles, the typical pitfalls – and what should be documented by the end of the 90 days.
Days 1 to 30: laying the groundwork
Three questions come first. One: where does the team stand today? The inventory has to capture actual usage, including private accounts, and it has to be free of sanctions – otherwise it stays incomplete.
Two: which rules apply? A short AI policy with concrete data classes is enough to start; it can be sharpened after the pilot. Three: which tool will be provided officially? That decision comes before the rule, not after it.
In parallel the contractual layer needs settling: data processing agreement, processing location, contractual exclusion of training. Tackling this only after rollout means documenting retrospectively – and usually finding gaps.
Days 31 to 60: a pilot with real use cases
The pilot works best with a motivated team of five to fifteen people and three to five concrete use cases from their daily work – drafting correspondence, summarising longer documents, or searching internal templates.
Selecting the cases matters: high benefit, low data sensitivity, a clearly checkable result. Cases where nobody can judge whether the output is correct are unsuitable as a starting point.
The pilot ends with three outputs: a list of cases that hold up, a list of cases that do not, and a collection of examples from your own organisation that will carry the later training.
Days 61 to 90: rollout and embedding
The findings from the pilot drive the rollout: training for everyone – short, practical, and built on the examples proven internally – prepared assistants for the most frequent tasks, and clear responsibilities for operation and questions.
This is also when the documentation is completed: an entry in the record of processing activities, an updated privacy policy, the contract filed, the training documented. The last of these also addresses the AI literacy obligation in Art. 4 of the EU AI Act.
Finally, set a date for the first review. Without a fixed date the policy stays in whatever state it was in on day 90.
Use cases by suitability as a starting point
The choice of first use cases determines acceptance. This ordering works as a starting point and can be adapted to your sector.
| Use case | Everyday benefit | Data sensitivity |
|---|---|---|
| Searching internal templates and guidance notes | High, because people search daily | Low |
| Summarising longer documents | High | Medium, depending on the document |
| Drafting correspondence and quotations | High | Medium to high |
| Turning notes into minutes | Medium | Medium |
| Analyses involving personal data | Varies | High – not suitable as a starting point |
Who carries the rollout
AI adoption rarely fails on the technology and frequently on unclear ownership. Three roles are enough; in small companies one person can hold more than one.
- One responsible person with a mandate and a fixed time budget – without both, adoption stays a side project.
- One contact per business unit who collects use cases and bundles questions.
- One owner for data protection and contracts who checks the processing location and maintains the documentation.
The most common pitfalls
Five mistakes recur in SME projects.
- Introducing the tool without rules – or rules without a tool. Either way private usage continues.
- Too many use cases at once instead of three that land. Breadth before depth costs acceptance.
- Training as a one-off mandatory session rather than an ongoing exchange with examples from your own organisation.
- No owner: adoption needs a person with a mandate, not a working group without decision-making authority.
- Documentation last: the record, the privacy policy and the contract belong in phases one and three, not in a later clean-up project.
What should exist after 90 days
By the end of the three phases it should be possible to evidence how the company uses AI without going looking for it. These six items are that evidence.
- An approved tool with centrally managed access and a clarified processing location.
- An AI policy in force with concrete data classes that also covers auxiliary staff.
- A data processing agreement, filed and findable.
- An entry in the record of processing activities and an updated privacy policy.
- Documented training with a record of attendance.
- A date for the first review and a named contact for borderline cases.
Frequently asked questions
What does AI adoption cost in an SME?
Licence costs are usually calculated per person per month. The larger item is normally internal time: taking stock, the policy, the pilot and training. Realistically that is several person-days spread across 90 days, shared between the responsible person and the business units.
Which use cases should we start with?
Ones that come up daily, carry low data sensitivity and produce a checkable result – searching internal templates, summarising, drafting correspondence. Analyses involving personal data do not belong in the first round.
Does an SME need external consultants for this?
Not necessarily. Tool selection, pilot and training can be handled internally where one person holds the mandate. External support pays off most in the data protection assessment and wherever professional secrecy or supervisory law comes into play.
Are 90 days really enough?
For tool, policy, pilot, training and documentation, yes, provided the scope stays tight. Ninety days are not enough for deep integrations into existing line-of-business applications, or for use cases that feed into decisions about individuals.
Do we have to involve the works council?
In Germany regularly yes, as soon as the system is capable of monitoring behaviour or performance – Section 87 (1) no. 6 BetrVG turns on capability. In Austria, Sections 96 and 96a ArbVG apply. Switzerland has no comparable co-determination. Settle this in phase one, not at the end.
How do we measure whether adoption succeeded?
Use measures you can observe without setting expectations: share of active users, number of covered use cases, decline in private account usage, and completeness of the documentation. Claims about time saved are not defensible without a clean baseline measurement.
Sources
Related reading
Bring AI into your company securely.
Try Custodos with your team – and see how quickly secure AI becomes productive.
- Try it with the whole team
- Set up in minutes
- Productive from day one