Put AI first where four things hold at once: the work has a value you can measure, it can run on data you already hold, an error can be caught before it does harm, and one named person will own the result. Score every candidate on those four, record the baseline each one must beat, choose one or two, and give them 90 days to prove themselves.
Why the choice is the hard part
When the ONS surveyed UK firms in 2023 for management practices and the adoption of technology and AI, the most common barrier to adopting AI that firms reported was difficulty identifying activities or business use cases (39%), ahead of cost (21%) and the level of AI expertise or skills (16%). In the EU, Eurostat: use of artificial intelligence in enterprises finds that among enterprises that had considered AI and did not use it, about seven in ten cited a lack of relevant expertise and more than half cited a lack of clarity about the legal consequences.
Company size shapes the starting point too. The OECD discussion paper on AI adoption by SMEs reports that across the OECD, 40% of firms with 250 or more employees used AI in 2024 or the latest year available, against 20.4% of firms with 50 to 249 employees and 11.9% of those with 10 to 49. For a company of 50 to 1,000 people, the first use case is likely to be the one that teaches the organisation how AI work is run, which is a good reason to choose it with care.
Build the long list from the work
Ideas arrive from vendors, staff and board papers, and many are phrased as tools. Rewrite each one as a change to a named workflow. “Use AI in finance” is a theme. “Match incoming supplier invoices to purchase orders and send mismatches to the accounts payable lead” is a candidate: it has a trigger, an output, an exception and a person who owns the process. The GOV.UK Service Manual gives public-sector teams the same instruction: when handed a predefined solution, interrogate it and reframe it as a problem to be solved.
The strongest candidates come from the people who do the work. Ask where work waits for someone, where the same data is typed in twice, where errors are found late and where a decision depends on reading documents.
Published figures give a sanity check on the list. Among EU enterprises using AI in 2025, Eurostat’s data shows about 35% using it for marketing or sales, 31% for business administration or management and 23% for accounting, controlling or finance. In the UK, the ONS: Artificial intelligence in UK businesses, 2023 to 2026 finds that in June 2026 close to 60% of businesses using AI did so to improve business operations. These figures show where tools are already in use. They say nothing about where the value lies in a particular company.
Score four things, and treat ownership as a gate
Score each candidate on four dimensions and keep a one-line note of the evidence behind each score. Three levels (high, medium, low) are enough, plus a fail for a candidate that cannot meet the test at all. Score risk by how well errors are contained, so high is favourable on all four. Decimal scores suggest a precision the evidence does not have.
- Value: what changes in operational terms, such as hours released, errors avoided, cash collected sooner or capacity added, and what that is worth, as a range. The NIST AI Risk Management Framework asks for “the business value or context of business use” to be “clearly defined” (MAP 1.4 in the AI RMF Core).
- Feasibility on data you hold: whether the data exists in systems you control, at the volume and quality the use needs, and whether it may be used for this purpose. The last question belongs to your data protection officer and counsel.
- Risk: what one error costs, who it affects, how errors are caught and how much human review the use needs. NIST asks organisations to determine and document their risk tolerances (MAP 1.5) and the potential costs of AI errors (MAP 3.2).
- Owner: one named person who runs the process and will accept the result.
Treat the four as multiplied: a fail on any one removes the candidate, however well it scores elsewhere. Ownership works best as a gate. A candidate without an owner leaves the list until someone takes it on, because a system nobody runs will not stay in use. Add one more column for the running cost at full volume, including review time, so that value is always read net of what it costs to run.
Record the baseline each change must beat
Before anything is built, measure the current process: volume per week, time per case, error and rework rate, cost per case, and how each figure is collected. For a process that runs every day, a few weeks of measurement on live work can give a usable baseline, and the first 90 days cannot end in a decision without one.
Record the best change that uses no AI as well: a rule in the existing system, a clearer form, a clean-up of master data. If that change captures most of the gain, make it first. NIST asks for expected benefits and costs to be “compared with appropriate benchmarks” (MAP 3), and for “viable non-AI alternative systems, approaches, or methods” to be weighed (MANAGE 2.1).
Why the first case should run on data you already hold
The first use case tests whether the company can run AI inside a workflow, with an owner, a review routine and a measurement. Making a new data programme a precondition delays that test and mixes two uncertainties into one result.
Data you already hold is data whose quality you can inspect and whose permissions you can check, and the obstacles reported by companies that stopped short of AI point the same way. Among EU enterprises that considered AI and did not use it, Eurostat records more than four in ten citing difficulties with the availability or quality of the data, and about four in ten citing incompatibility with existing equipment, software or systems. The OECD discussion paper names access to AI-enabling inputs, such as quality datasets, as one of four enablers of SME adoption, alongside connectivity, skills and finance.
There is a second reason. In the OECD survey of SMEs, generative AI was used more for simple, one-off tasks than for complex, recurring and important ones, and 29% of users applied it to core activities. A first case built on the transactions the business runs every day, such as orders, invoices, tickets or claims, tests AI in core work and has the volume to measure within 90 days.
The first 90 days
Set the plan on day one, including the date of the decision at the end.
- Days 1 to 30, prepare: confirm the owner in writing, measure the baseline, confirm data access and permission, build a set of real test cases that includes difficult ones, and agree the pass and stop thresholds.
- Days 31 to 60, build: put the smallest working version inside the existing workflow, with a person reviewing every output; measure against the baseline and log every error by type.
- Days 61 to 90, run: send a share of the real volume through it, measure running cost and review time, and decide on the agreed date whether to scale, fix or stop.
The last month runs on real volume because NIST asks for performance to be “demonstrated for conditions similar to deployment setting(s)” (MEASURE 2.3). A test on prepared examples answers a different question.
What this cannot do
Scores rank options under uncertainty and carry no guarantee of value. The method cannot decide whether data may be used for a purpose; that belongs to counsel and the data protection officer. It may show that the best first step uses no AI at all, and then that step should come first. It does not choose a vendor; tools follow the use case. And 90 days cannot absorb a company-wide data programme. If the strongest candidate needs one, it is the wrong first case, and it moves behind work that can show a result sooner.
Further reading: NIST: AI Risk Management Framework; ONS: management practices and the adoption of technology and AI in UK firms; Eurostat: use of artificial intelligence in enterprises; OECD: AI adoption by small and medium-sized enterprises.
The two-week AI strategy discovery applies this method to your own candidates and ends in a one-page decision, with the scored portfolio and the 90-day plan behind it.
