How do you bring AI into your business, step by step?

Why one task at a time

It is tempting to try AI everywhere at once. That usually leads to a pile of half-finished experiments and no clear sense of what helped. One task at a time lets you learn how the tools behave, set sensible rules, and show your staff a real example before asking them to change how they work.

NIST, the U.S. standards agency, published a voluntary framework for managing AI risk that is built around four ongoing activities: Govern, Map, Measure and Manage [1][2]. NIST describes it as flexible for organizations of all sizes and sectors [2], and the ideas translate well to a business owner's week:

• Govern: set the rules and decide who is responsible.
• Map: understand the task, who it affects and what could go wrong.
• Measure: test and track how well it works.
• Manage: act on what you learn, and plan for problems.

NIST says the process should be iterative and that attention to governance is continual, so treat it as a cycle you repeat, not a one-time checklist [2]. The steps below follow the same pattern in plain terms.

Step 1: Choose one task

Pick something that repeats often, takes real time and has low risk if a mistake slips through. Lesson 7 covers how to spot good candidates. Drafting replies to common questions, summarizing notes and sorting inquiries are typical first choices.

Write one sentence: "We are using AI to [task] so that [result]."

Step 2: Set simple rules

Before anyone starts, write a one-page policy. Keep it short enough that people actually read it:

• Approved tools. Which tools and which accounts or plans may be used for work.
• Never paste. Passwords, account numbers, ID numbers, keys and anything confidential (Lesson 4).
• Always check. Facts, numbers, names and sources before anything goes out (Lesson 3).
• People decide. What stays with a person: refunds, pricing, hiring, promises, legal matters (Lesson 5).
• Be honest. Disclose AI where it matters, such as chat assistants and realistic images (Lessons 6 and 8).
• Who to ask. One named person for questions and problems.

NIST's framework describes governance as the function that enables the others, and expects it to be in place before most organizations move on to mapping, measuring and managing [2].

Step 3: Measure before and after

Pick one or two simple numbers that match your goal, and record them for a couple of weeks before you start. For example:

• Minutes spent per day on the task
• Time from inquiry to first reply
• Number of drafts that needed major corrections

Then track the same numbers after you start. NIST's framework advises testing AI before it is put to use and checking it regularly while it is in operation [2]. A simple spreadsheet is enough. Without a "before" number, you are guessing whether anything improved.

Step 4: Train the people involved

Tools only help if people use them well. Keep training practical and short:

• Show the task done start to finish, using real examples.
• Share the prompts that work (Lesson 2), saved in a shared document.
• Walk through the one-page rules and why each one exists.
• Explain "automation bias," the tendency NIST describes of trusting automated output too much [3], and why every reviewer must actually read what they approve.
• Invite questions and concerns openly. Concerns raised early are easier to address than quiet doubts later.

Step 5: Review and decide

After a set period, such as 30 or 60 days, sit down with the numbers and the people involved. Ask:

• Did the numbers move in the right direction?
• What went wrong, and how often?
• What do the people using it think?
• Should we keep it, change it or stop it?

Write down the decision. Then, and only then, choose the next task. Each round goes faster because the rules, habits and training are already in place.

Common mistakes

Starting everywhere at once. Too many changes make it impossible to tell what helped.

No rules until something goes wrong. A one-page policy written on day one heads off many problems before they start.

No "before" number. Without a baseline, success is a feeling, not a fact.

Skipping training. Handing someone a tool without guidance leads to poor results and quiet abandonment.

Never reviewing. A task that was set up well can drift. Regular reviews keep it on track.

Worked example

An HVAC company's office manager spends about two hours each day writing replies to service inquiries.

Choose: "We are using AI to draft first replies to service inquiries so that customers hear back faster."

Rules: one approved business account; no customer phone numbers or addresses pasted in; every reply read and edited by the office manager before sending; no quotes or prices from AI.

Measure: for two weeks beforehand, she logs her daily time on replies and the average time to first reply.

Train: the owner and office manager spend one hour together writing three saved prompts for the most common inquiry types and testing them on last month's messages.

Review: after 30 days, they compare the numbers, look at the drafts that needed big corrections, and adjust one prompt that kept producing replies that were too long. They decide to keep it and pick the next task: summarizing technician notes at the end of each day.

The result was not dramatic, and it did not need to be. It was measured, understood and owned by the people doing the work.

Checklist

• I chose one task and wrote down the goal in one sentence.
• I have a one-page AI policy covering tools, never-paste items, checking, decisions and disclosure.
• I recorded "before" numbers.
• Everyone involved has been shown the task, the prompts and the rules.
• I have a review date on my calendar.
• I will not add a second task until the first one has been reviewed.

Try it

Write your one-page AI policy today using the six headings from Step 2. Then choose your first task, write its one-sentence goal, and put a review date 30 days from now on your calendar.

Tips

• Pick a low-risk, high-repetition task to start.
• Keep the policy to one page so people actually read it.
• Record a "before" number, even a rough one.
• Treat each review as a real decision: keep, change or stop.

Sources

1. National Institute of Standards and Technology, "AI Risk Management Framework," https://www.nist.gov/itl/ai-risk-management-framework
2. National Institute of Standards and Technology, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)," NIST AI 100-1, January 2023, https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
3. National Institute of Standards and Technology, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile," NIST AI 600-1, July 2024, https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf