The AI conversation in most British firms of ten to two hundred people has been going on for two years and has produced a subscription, an enthusiast, and no change to any process. That is not a failure of ambition. It is what happens when a technology is evaluated as a capability rather than assigned to a job.
Applied AI is the assignment: a model doing one named thing, inside a process that already exists, with somebody accountable for the output. Three processes are worth starting with, in this order.
1. Reading everything your customers write
Reviews across every platform your trade is judged on, inbound emails, form submissions, complaints, the notes your own staff type into a job record. In a firm of fifty, this is thousands of pieces of text a quarter that no single person has ever read end to end.
The value is not in any one item — it is in what recurs, which is invisible at the item level and obvious across the set. This is the clearest case in the whole business for using a model, because the alternative is not a worse analysis. It is no analysis.
One rule makes it safe: the model extracts what was said and where; the counting happens afterwards in code. A model asked how often do customers mention the invoice will answer with a number and the number will be invented.
2. Drafting, with a person in the approval seat
Review replies, quote follow-ups, the letter confirming what was agreed on site. The model writes the draft; a person sends, edits or bins it. Keep the edits — they are the specification for making the drafts better, and they are also the record that a human being was in the loop, which matters if anybody ever asks.
3. The internal summary nobody writes
The weekly operations note, the client handover, the monthly rollup that was supposed to start in January. These are where institutional memory leaks out of a busy firm, and a serviceable automated version beats an excellent one that never gets written.
Where the boundary is a legal one, not a preference
Two things make this different from the same conversation in the United States, and both are worth knowing before a pilot rather than after.
UK GDPR and the ICO
Customer text is personal data whenever it identifies somebody, which reviews frequently do. Putting it through a third-party model is a processing activity: it needs a lawful basis, it belongs in your record of processing, and the transfer arrangements matter. None of that is prohibitive — it is a form of diligence that takes an afternoon and is very awkward to retrofit.
Article 22 is the harder line: a decision producing legal or similarly significant effects on a person, taken solely by automated means, needs a specific basis and a route to human review. This is precisely why the approval seat in process two is not a training wheel.
The EU AI Act, if you sell into the EU
A UK firm with EU customers is in scope. Most of what is described above sits in the minimal-risk band, where the obligation is transparency rather than conformity assessment. Two things are not: anything used in recruitment or worker management, and anything assessing creditworthiness. Those are high-risk and carry real obligations.
Keep the human in the approval seat and most of the regulatory question answers itself. Remove them to save four minutes and it becomes a project.
Why the review step earns its cost
What good looks like after a quarter
- One process measurably faster or more complete, with a before number you wrote down first.
- A stack of edited drafts that shows what the model gets wrong about your business.
- Every number in every output produced by code, and every claim traceable to a source in under a minute.
- A one-page record of what data goes where, which is both good practice and the thing your first enterprise client will ask for.
What to take away
- Assign AI to a named job in an existing process; do not evaluate it as a capability.
- Start with reading customer text at volume — the alternative is not worse analysis, it is none.
- Keep a person in the approval seat for anything customer-facing; it is both the quality control and the legal answer.
- Customer reviews are personal data. Lawful basis, ROPA entry, transfer arrangements — an afternoon now, awkward later.
- Recruitment, worker management and creditworthiness are high-risk under the EU AI Act. Keep the first pilot away from all three.
Written for other markets
United States