How to adopt AI in your business: a 6-step method

Many leaders of SMEs and mid-sized companies ask the same question: how do you adopt AI in your business without piling up useless subscriptions or exposing your data? The answer lies less in the tool than in the method. This article sets out a six-step approach, from identifying use cases to scaling up, with the pitfalls we consistently see in practice. For an overview of our work, see our page on generative AI for business.

What generative AI actually changes in a business

Real gains, to be measured on your own processes

Generative AI is useful for three families of tasks:

• Drafting and rewording: meeting notes, emails, standard replies, product sheets, first drafts of documents.
• Summarising: condensing a case file, extracting the key points of a contract, comparing two versions of a procedure.
• Finding information: querying an internal document base in natural language, with sourced answers.

The RAG guide published by the DGE (the French Directorate General for Enterprise) sums up the expected benefits well: time savings, better quality of work when information searches are broad, and a tool for internal training. Note the word “expected”. A gain is measured on your processes, from a quantified baseline. That is the purpose of step 4.

Limits to understand before you start

• Hallucinations: a language model can produce an answer that is plausible and wrong. The CNIL, the French data protection authority, recommends never reusing the outputs of these systems as they stand without review.
• Data: a general-purpose model knows neither your procedures nor your contracts. Without controlled access to your documents, its answers will remain generic.
• Costs: usage-based billing (tokens, requests) can drift if nobody tracks it. It calls for the same oversight as any other cloud spend.
• Confidentiality: what is entered into a consumer tool may, depending on its terms, be reused by the provider.

Step 1: start from business pain points, not from the tool

The CNIL’s first recommendation for deploying generative AI is to “start from a concrete need”. That matches our experience: projects that begin with “we have bought licences, let’s find some uses” quickly run out of steam.

Use case workshop: the value, feasibility, risk grid

Bring together business managers, IT, the data protection officer (DPO) and, if possible, the chief information security officer (CISO) for half a day. List the tasks that are repetitive, time-consuming or error-prone, then score each idea on three axes.

Criterion	Questions to ask	Positive signal
Value	How many people, how many hours a month, what customer impact?	High volume, a pain point everyone knows
Feasibility	Do the documents or data exist, are they up to date, accessible via API?	Identified corpus, clear owner
Risk	Personal or health data? A decision affecting a person? Impact of an error?	Assisting a human who validates
Measurability	Can the current situation be measured (time, lead time, error rate)?	Indicator already tracked

Keep one or two use cases that combine high value, reasonable feasibility and controlled risk. High-risk cases (recruitment, credit scoring, decisions about people) are not prohibited, but they fall under specific rules in the EU AI Act and do not make good first projects.

Examples by function

• Human resources: an assistant that answers employees’ questions based on internal agreements and procedures.
• Customer service: a draft reply for the agent based on the knowledge base, validated before sending.
• Legal and procurement: extracting the key clauses of a contract and comparing them with a reference template.
• Finance: preparing management commentary from existing tables, reviewed by the financial controller.
• Engineering and maintenance: searching equipment documentation and the history of interventions.

Step 2: review your data

Where the useful documents and data are

For each selected use case, draw up a simple sheet: sources (SharePoint, file server, ticketing tool, ERP, email), volume, format (scanned PDFs, Word, web pages), update frequency, owner and current access rules. The DGE guide stresses pre-processing: conversion, cleaning, and removal of duplicates and contradictory documents. A poorly maintained corpus produces an unreliable assistant, whatever the model.

Sensitive data, GDPR, health data

Identify what is personal, confidential or regulated. Three questions shape what follows:

1. Can the data leave your information system, and to which country?
2. Can the provider reuse the data entered for its own purposes? The CNIL asks organisations to check this in the contractual terms.
3. Is a data protection impact assessment (DPIA) required? Involve your DPO from this stage.

For health data, hosting in France is subject to a specific framework, HDS (Hébergement de Données de Santé, the French certification for hosting health data): the architecture must be designed accordingly from the outset, not added afterwards.

Step 3: choose the right type of solution

Off-the-shelf tool or integrated solution

Off-the-shelf assistants (ChatGPT, Microsoft Copilot, Claude and their enterprise plans) suit general drafting and summarising tasks. They deploy quickly, but how much control you have depends largely on the provider. The question “can we use ChatGPT at work?” therefore calls for a nuanced answer: yes for non-confidential uses, with a business account, data reuse turned off where the plan allows it, and a clear list of what must never be entered. That is the CNIL’s position in its questions and answers on generative AI.

An integrated solution becomes necessary when you need to work on your internal documents, respect fine-grained access rights or take actions in your business applications.

An assistant over your documents (RAG)

Retrieval-augmented generation connects a language model to your document base: it first searches for the relevant passages, then writes an answer citing them. It is often a good first custom project. We explain how it works in our article RAG for business: definition and use cases, and in our AI assistant over your internal documents service.

AI agents that act in your tools

An AI agent does more than answer: it chains actions (creating a ticket, updating a record, preparing an order) through your tools’ APIs, under defined rules. More powerful, it requires more safeguards: limited permissions, human validation for sensitive actions, logging. Our page on AI agents for business describes how we design and deploy them.

Step 4: a 6 to 8 week pilot, with indicators

A pilot is not a demo. It must answer one question: does this use case deliver on its promise in real conditions?

• Scope: one team, one process, a clearly bounded document corpus.
• Baseline: measure before you start (average handling time, response time, rework rate).
• Reference question set: a few dozen real questions with expected answers, written by the business teams. It is used to evaluate each version.
• Indicators: answer quality (accuracy, correct sources), adoption (active users), measured gain, cost per request.
• Decision criteria written in advance: continue, adjust or stop. A documented stop is a useful result.

The DGE recommends involving future users in every phase: defining use cases, writing typical questions, progress reviews. They are the ones who will keep the tool alive.

Step 5: move to production

This is where many projects stall, because they were not designed to last. A serious move to production covers:

• Security: company authentication, access rights inherited from the sources, encryption, private networking where possible, secrets kept out of the code.
• Monitoring: logs of requests and answers, quality tracking over time, alerts on drift.
• Continuous evaluation: rerun the reference question set whenever the model, prompt or corpus changes.
• Costs: budget, alerts, tracking by use case and by team.
• Operations: infrastructure as code (Terraform, OpenTofu), separate environments, update and rollback procedures.

These topics belong to LLMOps, which we cover on our page on putting AI into production.

Step 6: set rules for usage

A short, workable AI policy

The CNIL recommends an internal charter or policy that sets out permitted and prohibited uses, the data that must not be entered and the approved tools. Keep it short (two to three pages), concrete (examples of permitted and prohibited uses) and name a point of contact for questions.

Training your teams: an obligation, not an option

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures to support AI literacy among their staff. This obligation has applied since 2 February 2025. Regulation (EU) 2026/1744, in force since 27 July 2026, reworded the article: it states that the obligation does not require ensuring a specific level of literacy for each individual. The European Commission states that no certificate is required. In practice: training tailored to roles, and a record of what has been done.

Placing your uses within the EU AI Act

An internal drafting assistant and a CV screening tool are not subject to the same rules. Our article EU AI Act: obligations for businesses and timeline gives an overview, and our AI governance and EU AI Act compliance service helps you classify your uses.

For SMEs: where to start on a small budget

With limited resources, the order matters more than the amount:

1. Bring existing use under control: your employees are probably already using AI tools. A policy, business accounts and short training reduce the risk immediately.
2. A single high-value use case, measured, rather than five scattered experiments.
3. A well-configured off-the-shelf tool for general uses, and custom work only where your documents make the difference.

Public support for companies based in France

• Diag Data IA (Bpifrance, the French public investment bank): under the French “Osez l’IA” plan, an 8 person-day diagnostic to identify and prioritise use cases, 40% co-funded by France 2030. According to the France Num page (the French government programme for the digitalisation of small businesses) updated on 25 June 2026, it is open to SMEs and mid-sized companies with 10 to 2,000 employees registered with the French Trade and Companies Register (RCS). Check the conditions in force when you apply.
• DGE RAG guide: a free, educational resource from the French Directorate General for Enterprise to understand integration and hosting choices.

Checklist before launching your first AI project

• One or two use cases scored on the value, feasibility, risk grid
• A measurement of the current situation (time, lead time, errors)
• Data sources identified, with their owner and access rights
• The DPO involved and the DPIA question settled
• The provider’s data reuse terms checked
• A reference question set written by the business teams
• Decision criteria written before the pilot
• An AI policy circulated and training scheduled
• Someone responsible for tracking costs

What next?

Adopting AI in your business is a process transformation project, not a software purchase. The method fits in a few words: a real need, controlled data, a measured pilot, monitored production and trained teams. Based in Villeneuve-d’Ascq, in the Lille metropolitan area (northern France), Feekr supports SMEs and mid-sized companies along this path, from scoping to industrialisation, with the aim of making your teams self-sufficient. To go further, read about our approach to AI agents for business or our full generative AI for business offering. You can also book a 15-minute call.

[ YOUR QUESTIONS ]

Frequently asked questions

How do I introduce AI in a small or medium-sized business?

Start with one or two specific business pain points, review the data involved, then test a solution on a narrow scope with indicators defined in advance. Set rules for usage from day one with an AI policy and short training. Only scale up after a successful pilot.

What are the benefits of generative AI for businesses?

The gains are mostly in drafting, summarising and finding information in internal documents. It can also improve service quality by giving teams fuller access to information. These gains should be measured on your own processes, not assumed.

Should companies ban ChatGPT at work?

An outright ban often pushes employees towards personal accounts, outside any control. The CNIL, the French data protection authority, recommends setting rules instead: a business account, turning off data reuse where possible, a list of data that must never be entered, and user training. For sensitive documents, an integrated, controlled solution is preferable.

Does a company need an AI usage policy?

Yes. The CNIL recommends an internal charter or policy that defines permitted and prohibited uses and the data that must not be entered. It is also a natural vehicle for the AI literacy obligation in Article 4 of the EU AI Act.

How much does an AI project cost?

The cost depends on the type of solution (licences for an off-the-shelf tool, an assistant over your documents, an agent integrated into your tools), the volume of usage and the level of integration. We do not quote a flat fee without a scoping phase. As a public reference point for companies based in France, Bpifrance’s Diag Data IA is listed at 6,000 euros excluding VAT after 40% funding from France 2030 (France Num page updated on 25 June 2026).

Sources

• CNIL: How to deploy generative AI? The CNIL provides initial guidance (18 July 2024, in French)
• CNIL: Questions and answers on using a generative AI system (in French)
• EUR-Lex: Regulation (EU) 2026/1744 (digital omnibus on AI), new Article 4
• European Commission: AI Literacy, Questions & Answers
• DGE: Guide to retrieval-augmented generation (RAG), November 2024 (in French)
• France Num: Diag Data IA, Bpifrance support programme (updated 25 June 2026, in French)