Getting started with AI in a small business: your first 30 days

Start small on purpose

The Australian Government’s Guidance for AI Adoption has a “foundations” version written for organisations that are new to AI or using it in low-risk ways. Its advice is to begin with the basic actions and add more as your use grows. You don’t need to do everything at once.

That suits a small business. A short trial on a few everyday tasks teaches you more than a long planning exercise. It also keeps the risk low while you learn what the tools are good and bad at.

Week 1: pick two or three tasks

Look for work that is repetitive, text-heavy and easy for a person to check. Write down roughly how long each task takes now. You’ll need that number later.

Leave out anything where a mistake would seriously affect a person, such as hiring decisions, credit, health or legal advice. The government guidance makes this point too: the same tool carries different risks depending on what you use it for. Drafting a marketing email is not the same as assessing job applications.

Week 1: choose the right account

Use a business plan, not staff members’ personal free accounts. The main providers make specific commitments for their business products:

• Microsoft 365 Copilot: Microsoft says prompts, responses and data accessed through Microsoft Graph aren’t used to train its foundation models. Copilot only shows staff the content they already have permission to see.
• ChatGPT business plans: OpenAI says it doesn’t train its models on data from ChatGPT Business, Enterprise and its API platform by default.
• Gemini in Google Workspace: Google says your content isn’t human-reviewed or used to train generative AI models outside your organisation without permission.

These terms change, so read the current privacy page for the exact plan you buy. Then make sure everyone signs in with the business account you provide. If you already pay for Microsoft 365 or Google Workspace, start by checking what AI features your plan includes.

Two settings are worth a look on day one:

• Chat history and retention. The Australian Signals Directorate suggests tools that let you delete history or limit data storage.
• Where your data is processed. ASD also notes that different privacy laws may apply if data is stored or processed outside Australia.

Week 1: set simple rules for what goes in

Before anyone starts, agree in writing what must never be pasted into an AI tool. A short list is enough:

• Customer, patient or staff personal information, unless the approved tool and purpose allow it
• Passwords, keys, bank and card details
• Client documents you’ve agreed to keep confidential
• Unreleased financials and HR matters

The Office of the Australian Information Commissioner recommends that businesses don’t put personal information, especially sensitive information, into publicly available AI tools. It also points out that privacy obligations apply to both what goes into an AI system and what comes out, where it includes personal information.

For a fuller version, see our traffic-light rule for AI at work. When you’re ready to make it official, use our guide to writing an AI use policy.

Weeks 2 and 3: use it, and check every output

Use the tool on your chosen tasks every day. Keep a simple rule: AI writes the first draft, a person owns the final version.

• Check facts, figures and dates against your own records, especially in quotes.
• Check names and commitments in emails before they’re sent.
• Compare meeting summaries with your own memory of the meeting. If you record calls, read our guide to AI meeting notes and privacy first.
• Keep good prompts. When a request works well, save it so others can reuse it.

Note each time the tool gets something wrong. This shows you where it needs a closer look, and where it’s not worth using at all.

Week 4: measure what you saved

At the end of the month, compare each task with the time you wrote down in week 1. Count the checking and fixing time as well, not just the drafting.

Keep the tasks that clearly save time. Drop the ones that don’t. A short honest list is more useful than a long one.

The government’s guidance also suggests keeping an AI register: a simple list of which AI tools you use, what for, and who is responsible. Your week 4 table is a good start, and there are templates on ai.gov.au.

When to connect AI to your business systems

Once the basics work, it’s tempting to let AI read your inbox, update your CRM or reply to customers. Some of this is built into the tools you already use. Some of it needs proper integration work.

ASD calls tools that act on your behalf “AI agents”. Its advice is to limit their access from the start, check what apps and data they can reach, and not let them send messages, approve transactions or change business data without your review. Review those permissions regularly and turn off anything you no longer need.

Two things to sort out before connecting AI to your data:

• Permissions. Built-in assistants such as Copilot show people what they already have access to. If everyone can open every folder today, AI will make that easier to find. Tidy up access first. Our guide to customer data in a CRM covers roles and exports.
• Hidden instructions. Emails and documents can contain text meant to trick an AI tool. The more an AI tool can do, the more this matters.

If a connection needs custom work, treat it like any other IT project: a clear purpose, a test before it goes live, a person who can switch it off, and a way to keep working if it breaks. NovaSoft helps businesses scope this kind of integration if you’d rather not do it alone.

Common questions

Keep reading

Related help