Where should I start with AI in my company?

With a list of repetitive tasks, not with a tool. For a week or two, note which tasks keep coming back, who does them and how long they take. The best candidate is usually a frequent task based on text or documents, with fairly clear rules, where a mistake is easy to spot and fix.

How long does a first AI pilot take?

It depends on the process and the integrations, but a well-scoped pilot is measured in weeks, not months. If a proposal talks about many months before you see anything working, the scope is probably too wide for a first step. A small pilot that works beats a large project that never finishes.

Do I need to comply with GDPR if I use AI with customer data?

Yes. If the AI processes personal data, the GDPR applies: a legal basis, information to data subjects, agreements with every provider that processes the data and control over transfers outside the EU. In Spain, the data protection authority (AEPD) has published specific guidance on processing that involves AI.

Will AI replace my staff?

In practice, in SMEs and professional firms AI replaces tasks rather than jobs: sorting emails, pulling data from documents, drafting replies. The time freed up goes into higher-value work. And for sensitive processes, we recommend that a person reviews the output before it has any real effect.

How do I know whether the AI project worked?

By measuring before and after. Before building, record how long the task takes, how often it happens and how many errors occur. After the pilot, measure the same things for a few weeks of real use. Without a measured starting point, you cannot be sure anything has improved.

How to implement AI in a business: 7 realistic steps for SMEs and professional firms

By Laszlo Brusa · BL Diseno · Updated 27 September 2026 · 6 min read

To implement AI in a business successfully, follow a short, measurable path: identify repetitive work, measure how it is done today, choose a single pilot, check data and privacy, build it with human review, measure the hours saved, and only then scale up. Starting from a fashionable tool rather than a concrete problem is the most common reason AI projects go nowhere.

This guide walks through those seven steps with SMEs, law and accounting firms, estate agencies and clinics in mind, including international companies operating in Spain, where there is no dedicated IT team and every hour counts.

Step 1. Identify repetitive work

The right question is not "what can we do with AI?" but "what do we do over and over that does not need expert judgement?".

For a week or two, ask each team member to note the tasks they repeat. Typical examples:

Sorting and forwarding incoming emails.
Copying data from invoices, contracts or forms into another program.
Answering frequent customer questions.
Drafting documents from templates.
Searching for information in case files or shared folders.

The best candidates are frequent, text- or document-based, follow reasonably clear rules and produce errors that are easy to spot.

Step 2. Measure the starting point

Without a baseline you cannot prove any result. For the chosen task, record:

How many times a month it is done.
How long it takes each time.
Who does it.
How many errors or delays occur.

You do not need scientific precision. An honest estimate, checked with the person who does the work, is enough to compare against later.

Step 3. Choose a single pilot

Resist the urge to automate everything at once. A good pilot meets four conditions:

Criterion	Good pilot	Poor pilot
Frequency	Daily or weekly	A few times a year
Error risk	Low and easy to correct	Serious legal or financial consequences
Data	Accessible and digital	On paper or spread across many systems
Outcome	Measurable in hours or errors	Hard to quantify

A small pilot that works builds trust in the team and teaches you more than any strategy document.

Step 4. Check data and privacy (GDPR)

Before building, check what data the solution will handle and where.

If it involves personal data about customers, patients or employees, the General Data Protection Regulation applies. In practice, that means reviewing the legal basis for processing, updating privacy notices if needed, signing a data processing agreement with every provider that handles the data (including the model provider) and checking for transfers outside the European Union. For high-risk processing, the GDPR also requires a data protection impact assessment.

Spain's data protection authority, the AEPD, has published useful guidance, including a guide on GDPR compliance for processing that embeds AI (available in English) and another on agentic AI (in Spanish).

Separately, the EU AI Act asks companies using AI systems to ensure a sufficient level of AI literacy among their staff, and requires people to be told when they are interacting with an AI system, such as a chatbot.

In law firms and clinics, pay particular attention to professional secrecy and health data, which enjoy stronger protection.

Step 5. Build with human review

In the first version, the AI proposes and a person decides. For example:

The system categorises an email and drafts a reply; an employee checks it and sends it.
The system extracts data from an invoice; someone validates it before it is booked.

This design has three advantages: it lowers risk, it exposes model errors on real cases and it gives the team confidence. Over time, tasks where the system is consistently right can move to spot checks.

During the build, insist that accounts, automations and code are in your company's name, and that the system keeps logs of what it does.

Step 6. Measure the hours saved

After a few weeks of real use, repeat the measurement from step 2:

Time per task before and after, including review time.
Number of errors before and after.
Cases the system could not handle, and why.

Be honest about the result. If the saving is small, the task may have been the wrong one or the design may need adjusting. Both lessons are cheaper to learn from a pilot than from a large project.

Step 7. Scale what works

Only once the pilot has proven its value does it make sense to expand:

Reduce human review where the system is reliable.
Apply the same pattern to similar tasks in other departments.
Connect more systems, one at a time.

Each expansion should go through steps 2 to 6 again, in a lighter form.

Who needs to be involved

An AI project in an SME does not need a large team, but it does need three clear roles:

An internal owner. Someone in management who sets priorities, signs off the scope and unblocks access. Without this person, the project stalls at the first question.
The person who does the task. They know the exceptions, shortcuts and odd cases. Their involvement in steps 1, 2 and 5 is the difference between a solution people use and one they abandon.
Whoever builds it. An external provider or an in-house technical profile who designs, builds, documents and maintains the solution, and explains in plain language what it does and does not do.

If personal data is involved, bring in whoever handles data protection at your company from the start, whether that is your data protection officer or your usual adviser.

Also set aside some time to train the team: what the system does, when to trust it and how to flag a mistake. This fits with the AI literacy obligation mentioned in step 4.

Checklist before you start

I have identified one concrete, repetitive task.
I know how often it is done and how long it takes today.
The pilot has a low, correctable error risk.
I know which personal data will be processed and by which providers.
It is clear who reviews the output and how.
Accounts and code will be in the company's name.
There is a date set to measure the result.

Common mistakes

Starting with the tool. Signing up for a platform before knowing which problem it solves.

A pilot that is too big. Trying to automate a whole department in the first project.

Not measuring. Without a baseline, there is no way to know if it was worth it.

Leaving out the person who does the task. Whoever does the work every day knows the exceptions better than anyone. Involve them from the start.

Leaving GDPR until the end. Checking it afterwards means rebuilding parts of the project.

How we work at BL Diseno

At BL Diseno, a technical studio in Barcelona, we follow this same path: we start by listening to how your team works, propose one concrete, measurable pilot and agree the price in writing before we start. Everything stays in your company's name, and you deal with a single point of contact from start to finish.

Sources (4)