AI in business: where to start
How an SME chooses its first process, puts rules and data in order and decides with a pilot whether AI pays.
Where do you start when bringing AI into a company?
From a process. Whoever starts from the tool, a subscription to an assistant or a platform seen at a trade fair, then looks for a problem for it to solve, and often finds the wrong one. Whoever starts from the process already knows what to measure at the end.
A good first process repeats often, every day or every week, so the time saved shows. It follows rules a person could explain to a colleague who has just joined. It works on data that already exist in digital form, even if spread across several archives. And an error can be stopped before it reaches a customer, because a person checks the result: this is what is called human in the loop, a person in the loop on the decisions that matter.
In this guide AI mostly means language models (LLM), which read and write text and today fit into a process without a research department. Here are four typical first processes for an SME, with what each one needs.
| Process | What the AI does | What it needs | Who checks |
|---|---|---|---|
| Incoming documents: orders, invoices, delivery notes | reads the document, extracts the data and proposes it for the management system | digital documents or readable scans, the booking rules | whoever books them today, on the exceptions |
| Assistant on internal procedures | answers questions citing the document the answer comes from | up-to-date manuals and procedures, each with an owner | whoever wrote the procedure, by sampling |
| Requests from customers and suppliers | classifies the request, assigns it and drafts a reply | the history of requests, with the categories used today | whoever replies, before sending |
| Draft offers | puts the draft together from price lists, terms and similar past offers | price lists and past offers in one place | the salesperson, who signs it |
Two processes are not a good first step. A decision about people, such as selecting candidates or evaluating employees, because the AI Act treats it as a high-risk use, with obligations of its own. And a process that does not work even by hand today: AI makes it faster, not clearer.
When you bring us an idea that started from a tool, the first thing we do is go back to the process: how long it takes today, who runs it, where it goes wrong.
How many SMEs already use AI, and what holds them back?
Few, but the number doubled in a year: according to ISTAT, in 2025 15.7% of Italian SMEs with at least 10 employees use at least one AI technology, against 7.7% in 2024. Among large companies it is 53.1%. The Artificial Intelligence Observatory of Politecnico di Milano counts projects instead: 71% of large companies have started one. Among SMEs experiments reach 15% of medium-sized companies and 7% of small ones, and 20% of SMEs are considering starting projects soon.
Italian companies using AI in 2025
% of companiesIn 2024 SMEs were at 7.7%. Source: ISTAT, “Imprese e ICT, anno 2025” (Enterprises and ICT, 2025), 15 December 2025
Italian companies using AI
% of companiesThe chart’s data
| Year | % of companies |
|---|---|
| 2023 | 5 |
| 2024 | 8.2 |
| 2025 | 16.4 |
All companies with at least 10 employees, SMEs and large ones together. Source: ISTAT, “Imprese e ICT, anno 2025” (Enterprises and ICT, 2025), 15 December 2025
The two figures do not contradict each other. ISTAT counts those who use an AI technology, even inside a tool they bought; the Observatory counts those who have started a project. Using a tool and putting AI inside a process are two different steps, and this guide is about the second.
Among companies that do not use AI but have considered it, ISTAT asked what stopped them. The first five reasons have a practical answer.
| Barrier | How many cite it | What you do |
|---|---|---|
| Lack of skills | 58.6% | start from one process and train whoever runs it: the skills are needed on that process, not on AI in general |
| The rules are unclear | 47.3% | for those who use AI the obligations are few and written down, and you find them further on |
| Data unavailable or of poor quality | 45.2% | look at the data of the chosen process, before the pilot: they do not all need to be in order |
| Privacy and data protection | 43.2% | use tools with a business contract and decide yourself where the data stay |
| High costs | 43.0% | start with a pilot that has a written maximum, and with the running cost estimated before signing |
None of these barriers goes away by buying one more tool. The feasibility study we start with is there to remove them one by one on your process, before you spend on the rest.
The figures in this guide
Prices and durations are those of Volcanic Minds, current at the date at the top of the page. Figures from others come from the sources listed at the bottom.
What do you do right away, before any project?
Four things, without suppliers and without a project: a written rule on data, a rule on checking, a business tool in place of personal accounts and training. Your people already use AI, whether the company knows it or not. According to the Politecnico di Milano Observatory, 47% of Italian workers use AI tools at work, and only 19% of them use exclusively those provided by the company. The rest also goes through personal accounts: this is shadow AI, the use of AI tools outside the company's control. It means offers, contracts and customer data can end up in services you have no contract with. Banning it does not solve it: according to the same research, companies know a ban would push use outside their control.
You can do them this week.
The first is a written rule on data: which information never goes into an AI tool that is not the company's, and what can be used freely instead. For example, personal data of customers and employees, contracts, confidential prices and customers' projects never go in.
The second is a rule on checking: whoever signs a document answers for it, even if a model wrote it. Generated text is reread before it leaves the company, and extracted data is checked before it enters the management system.
The third is a business tool in place of personal accounts: a business plan, with accounts in the company's name and a contract that excludes using your data to train the models. You read it in the contract, not on the sales page. If personal data go into the tool, the supplier processes them on your behalf, and the GDPR requires a contract that says so (article 28).
The fourth is training. Article 4 of the AI Act, rewritten by Regulation (EU) 2026/1744, asks those who use AI systems to take measures to develop the AI literacy of their staff and of anyone using the systems on their behalf. It sets no level to reach, but the measures must be there. We run training even without a project, and it is given by the people who design AI systems and put them into production: the programmes start from your team's real tasks.
Ready-made tool or custom software?
It depends on how much the process is yours: a task every company does the same way is almost always solved by a ready-made tool. A process that follows your rules, touches your systems or confidential data and has to answer to a control needs a solution built on top.
| Solution | When it is enough | How you pay | Where it stops |
|---|---|---|---|
| General-purpose assistant on subscription | writing, summarising, translating, with non-confidential data | a fee per user | it does not work inside your systems: a person copies and pastes the data |
| AI feature of the management system or CRM you already have | when the supplier has already foreseen the case you need | often an extension of the fee | it does what the supplier foresaw, on the data of that system |
| No-code automation platform | simple flows between widespread services, with few exceptions | a fee plus usage | exceptions, permissions and traceability, as the flow grows |
| Custom solution | your own process, several systems, confidential data or controls | from 10,000 € for the first process, plus model usage | it takes a pilot to know whether it pays |
Take a case that comes up often: a mechanical engineering company that works to order and spends hours reading customer requests and preparing quotes. If the parts are in a catalogue and the price follows a price list, a ready-made quoting tool may be enough. If instead every request comes with different drawings, materials and machining, and the price follows rules only your technical office knows, you need a solution built on top. It reads the request and drafts the quote from similar jobs already done; a person from the technical office checks it and signs it. The feasibility study, which starts from your real requests, tells you which of the two paths fits.
Custom does not mean training a model from scratch. It uses the models that exist, large and small, from providers or run locally. Around them it builds what makes them reliable in your process: the connections to your systems, permissions, checks, a log of what they do. The model stays replaceable, so a change in a provider's prices or terms does not stop the process.
Many processes, moreover, do not need an agent but a well-made module and a clean database, and in that case we tell you, even if it means a smaller project. If a tool you already pay for solves the problem, the feasibility study says so in writing.
Is your data ready?
It does not all need to be: what must be in order is the data of the chosen process. And consistency counts more than quantity. Incompleteness can be managed, contradiction cannot: the system flags and asks for a missing piece of data. Two archives that say different things, two price lists or two records of the same customer, instead produce answers that are confident and wrong.
That is why the data are looked at before the pilot, with three questions: where they are, who updates them, how much they contradict each other. The article on data quality explains why at length.
Scattered data are not an obstacle, as long as you know which source counts. For a manufacturing company we brought together 4 archives, 225 GB of documents of regulations, HSE documents, safety and operations, into a single archive queried in plain language. Each person sees only the documents their role allows, and every search saves 23 minutes. It is a RAG: the model answers starting from your documents, which it retrieves at every question, instead of from what it learned in training.
In your case, we put the state of the data in writing in the feasibility study, before any development.
How do you run a pilot that helps you decide?
A pilot is the first version in real use: one process, real data and users, a goal declared up front. It differs from a demo because the demo shows what AI can do, while the pilot measures what it does on your work. Many projects stop right in between, between a demo that convinces and a system nobody uses: that is the subject of the article on AI in production.
Before starting, the starting point is measured: how long a case takes today, how many errors it produces, what it costs. Without that number, at the end of the pilot you have an impression and not a measurement. Then the goal is written down, for example the time per case halved at the same quality, together with the criterion for stopping. If the pilot does not reach the goal, we tell you to stop: a programme that concludes AI does not pay is a successful programme, because it cost you little to find out.
| Phase | Duration | What you receive | Cost |
|---|---|---|---|
| Feasibility study | 1-2 weeks | the process measured, the state of the data, the pilot's goal, the quote | up to 2,500 €, deducted from the pilot if you sign |
| Pilot | 4-6 weeks | the process with AI in real use on a narrow scope, and the result measured against the starting point | from 10,000 € |
| Integration | 4-5 weeks | the connection with ERP, MES or CRM and with company permissions | in the quote, with a range and a maximum |
| Governance | 2 weeks | human approval on risky operations, a decision log, spending limits per model | in the quote, with a range and a maximum |
The study also tells you how the solution would be built, what it would cost to run and when to stop. With the integration the AI works with the same roles as people, and every action it takes stays traced.
Adding up the phases, from the first meeting to a process in production takes between 11 and 15 weeks. These are the typical durations of our programme; those of your project are written in the study. On the agentic AI audit platform a first working MVP arrived within six to eight weeks, and each audit saves 4 hours.
Would you rather talk it through?
Book a call with people who work on these topics every day: we will look at your case together.
How much does it cost to start?
There are three items: the feasibility study up to 2,500 €, the pilot from 10,000 € and model usage, which you pay per use.
The feasibility study costs up to 2,500 € and lasts one to two calendar weeks, not weeks on your premises. It includes a meeting with the people who decide, meetings with whoever runs the process to measure its starting point, a reading of the data and a final document. The document sets out the chosen process, the state of the data and how the solution would be built (models, providers, where the data stay, connections to your systems). It also sets out the running-cost estimate, the pilot's goal with the criterion for stopping and the quote with a range and a maximum. The study stays yours even if you do not sign, and if you sign its cost is deducted from the pilot.
The pilot starts at 10,000 €, the same entry threshold as an MVP. How the price of a custom project is formed, and who pays if the work grows, is in the guide how much custom software costs.
Model usage is a recurring cost, yours, pay-per-use: providers bill it in tokens, the units of text the model reads and writes. It cannot be estimated by eye, because it depends on how many cases go through, how long the documents are and which model is needed. For repetitive, narrow tasks, such as classifying or extracting data, a small model is often enough, faster and cheaper. That is why the study estimates it and the pilot measures it as a cost per case, not as a project cost, and in operation it stays visible, with spending limits per model and per period.
Among companies that already have AI projects, according to the Politecnico di Milano Observatory, about one in three struggles to estimate the ratio of costs to benefits in advance. That is what the pilot is for: a small spend with a maximum, which gives you the number to decide on the rest.
What does the law ask of those who use AI?
Few obligations, and almost all concern people more than technology: training for whoever uses AI, transparency on generated content, rules for high-risk systems and protection of personal data. Under the AI Act, whoever uses an AI system under their own authority, in a professional activity, is a deployer. An SME that puts AI into a process is one, even if a supplier built the system.
| Obligation | Since when | What it means for you |
|---|---|---|
| AI literacy (article 4) | 2 February 2025, rewritten by Regulation (EU) 2026/1744 | training measures for whoever uses AI systems on your behalf |
| Transparency on generated content (article 50) | 2 August 2026 | disclosing that realistic images, audio or video were generated or manipulated with AI |
| High-risk systems (article 26) | 2 December 2027 for Annex III, 2 August 2028 for Annex I | use according to the instructions, human oversight assigned to competent people, keeping the logs |
| Personal data (GDPR) | already in force | legal basis, privacy notice and a contract with the supplier that processes the data on your behalf (article 28) |
Among the high-risk systems of Annex III are those used to select staff or to decide on promotions and terminations: that is why a decision about people is not a good first process. In Italy Law 132/2025 also applies, in force since 10 October 2025. The deadlines and what they involve are on the page on the AI Act, which like this guide is a technical contribution, not legal advice.
In the systems we build, compliance is a requirement of the architecture, from the first line of code: human control where needed, a log of what the AI does, data within the perimeter you choose.
What should you ask an AI supplier?
Where the data are and whether they train third-party models, which models the supplier uses and what they cost to run. Then who approves before the AI acts, what stays recorded, what the pilot must show, when the code passes to you and what you receive if you change supplier. Ask these questions before signing and get the answers in writing. A vague answer is a cost you discover later.
| Question | What the answer must say |
|---|---|
| Where the data are | on which infrastructure and in which country, chosen by you: European cloud, private or your own servers |
| Training | that your data do not train third-party models, written into the contract |
| Models | which ones, why, and how they are replaced if a provider changes prices or terms |
| Running cost | an estimate per case before signing, and the spending limits in operation |
| Human control | at which steps a person approves before the AI acts, and who |
| Traceability | what stays recorded: the request, the answer, who approved it |
| Criterion for stopping | what the pilot must show to go on, and what happens if it does not |
| Code ownership | when it passes to you, with repositories, access and documentation |
| Exit | what you receive if you change supplier |
For the rest of the quote, the items of the guide on costs apply. What we guarantee on data, code and exit is written in the Trust Center commitments.
Sources and further reading
- ISTAT, “Imprese e ICT, anno 2025” (Enterprises and ICT, 2025), 15 December 2025istat.it, in Italian, accessed 22 October 2026
- Artificial Intelligence Observatory of Politecnico di Milano, “Il mercato dell'AI in Italia cresce del 50% nel 2025, 1,8 mld di euro” (The AI market in Italy grows by 50% in 2025, 1.8 billion euro), 5 February 2026osservatori.net, in Italian, accessed 22 October 2026
- Regulation (EU) 2024/1689 on artificial intelligence (AI Act), articles 3, 26 and 50eur-lex.europa.eu, accessed 22 October 2026
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), which rewrites article 4 of the AI Acteur-lex.europa.eu, accessed 22 October 2026
- Regulation (EU) 2016/679 on data protection (GDPR), article 28eur-lex.europa.eu, accessed 22 October 2026
Do you need to hire an AI expert to start?
No. For the first process you need a person who knows it well and has the time to follow it. The supplier brings the technical skills, and training gives your people those needed to use the system and check its results.
Which AI is best for a business?
There is no single one that fits everything, and you choose the model after the process. For writing and summarising with non-confidential data, a general-purpose assistant on a business plan is enough. Inside a process, repetitive tasks such as classifying or extracting data often need only a small model, faster and cheaper, while a large model serves where there is reasoning to do over long documents. What matters is that the model stays replaceable, so a change in a provider's prices or terms does not stop the process.
Can I use ChatGPT with customer data?
Only with a business plan whose contract excludes training on your data, and with the contract on processing personal data that article 28 of the GDPR requires. Not with a personal account, because that data leaves your control.
How long does it take to see a result?
Between 5 and 8 weeks. The feasibility study lasts 1-2 weeks and the pilot 4-6, and at the end you have a result measured on your process, which tells you whether to go on.
How much does a first AI project cost?
The feasibility study costs up to 2,500 €, deducted from the pilot if you sign, and the pilot starts at 10,000 €. Model usage is a recurring cost, estimated in the study and measured in the pilot as a cost per case.
Want to know which process to start from?
Tell us about the work that costs you most time today: we tell you whether AI is really needed, before proposing a pilot.
- You won't talk to a salesperson
- NDA before we get into the details
- The code stays yours
Articles on the same topics.
Data quality: data decides, not the model
When AI gets it wrong, blame the data, not the model. How to identify, sanitize and refresh your sources so AI actually works in your next business project.
Read
Small is the new big: SLM for enterprise
Enterprise AI doesn't need giant models. Learn how Small Language Models (SLMs) cut inference costs, reduce latency, and ensure complete data sovereignty.
Read
AI agents: development lifecycle
Gartner expects AI agents in 40% of enterprise apps by 2026, yet only 11% of companies run them in production. Three architectural patterns to get yours there.
Read