How to implement AI in a small business: a 30-day plan

A ten-person business can roll out AI properly in 30 days. Week one finds out what your team already uses and what AI is for. Week two settles the tool and the rules. Week three tests three concrete tasks with a small group, and week four brings in everyone, with training and documentation. You don't need an IT department. You do need one person who owns it.

This article is not legal advice. It shows what European regulators recommend and how a small business puts that into practice in four weeks.

Why 30 days and not six months?

Because your team isn't waiting. Anyone who works at a desk has tried AI already, often on a personal account. Every week without a clear answer is a week in which client emails end up in tools nobody approved. How to spot that is covered in the article on shadow AI in the workplace.

And because a small business doesn't need a big project. This isn't about your own models or custom integrations. It's about one tool, a handful of rules and three tasks that run differently afterwards. Anything that takes longer than a month loses attention along the way.

One example runs through this article: a marketing agency with ten people. Two account managers, three designers, two copywriters, a project manager, finance and the founder. Briefs, proposals and monthly client reports fill the week.

Week 1: What does your team already use, and what is AI for?

Ask openly, without blame: who uses which AI tool, on which account, for what work? At the agency it turns out that four people use free personal accounts, one of them to draft client reports with real campaign figures.

Then write down the purposes. Germany's data protection authorities (DSK) make this the first step in their guidance on AI and data protection: decide before deployment which fields of use and purposes the AI is meant for (section 1.1). Only then can you check whether personal data is needed at all. Spain's AEPD goes the same way in its January 2026 summary for generative AI, written for its own use: keep a register of the AI systems in use and approve each use case before it starts.

Pick three tasks for the pilot. Good candidates come back every week, and a person can check the result quickly:

• drafting proposals from past proposals and the rate card
• asking questions of your own documents, such as brand guidelines, contracts or the agency handbook
• summarising long email threads and meeting notes

And name the person who owns it. At the agency that is the project manager, backed by the founder.

Week 2: Which tool, and which rules apply?

The tool has to answer three questions. Where is the data processed? Does the provider train on what you type? Is there a data processing agreement under Article 28 GDPR? The DSK considers closed systems, where inputs are not used for training, preferable from a data protection view (section 1.7). It also recommends that employers provide accounts, so nobody has to work on a private one (section 2.4).

Check whether you need a data protection impact assessment as well. The DSK writes that with AI this will often be the case (section 2.3). If you have a data protection officer, bring them in now.

What the common business plans cost and where they fall short is in What does ChatGPT Business cost? and Copilot vs ChatGPT for business (as of October 2026).

In parallel, you write the rules. One or two pages are enough: approved tools, which data may go in, the duty to check results, and who to ask. There is a template in the article on the AI policy for employees. If you have a works council or employee representatives, tell them now, not in week four. In Germany, for example, Section 90 BetrVG names the use of AI explicitly.

Week 3: How do you test AI with a small group?

Two or three people who are keen, and the three tasks from week one. No more. At the agency that's the project manager, one account manager and one copywriter.

For each task, set up fixed instructions instead of everyone inventing their own prompt. For the proposal that means: the rate card, three good past proposals and the payment terms as the basis, plus the instruction never to invent a line item. The output is a draft that a person checks and sends.

Write down two things that week. Where did the AI save time? And where was it wrong? The second list is worth more, because it becomes the checking rules for everyone. The DSK requires results to be checked for accuracy (section 3.3), and after a week your pilot group knows exactly where: campaign figures, deadlines, client names.

Week 4: How do you bring the whole team in?

With a team session, not an email. The pilot group shows the three tasks on real examples, mistakes included. That convinces sceptics more than any presentation about what AI could do.

Combine the session with training. Since February 2025, Article 4 of the AI Act has required companies that use AI to take measures for their staff's AI literacy. Since 27 July 2026 the new wording applies: what's required is measures, not a set level for every person. According to the European Commission, no certificate is needed; internal records are enough. What belongs in them is in the article on AI literacy under Article 4.

On the same day, everyone gets their company account, and personal accounts are done for work. Write down who was trained, which rules apply and when you'll review them.

How do you know after 30 days whether it works?

Not by the number of chats. Three questions tell you more:

• Do the three pilot tasks now run regularly through the approved tool?
• Are more people using it in week four than in week one?
• Is any work still going through personal accounts?

If the answers look right, add the next two tasks. If not, it's rarely the tool. Usually one task was too big, or a checking rule was unclear.

Where does Verselo help with the rollout?

Verselo is an AI workspace for small and mid-sized businesses, and it covers the tool side of the four weeks:

• Week 2: as admin, you invite your team and assign roles. Admins set the allowed models, how long chats are kept, a monthly budget and per-person caps; see Admin & security. EU-hosted models from leading providers; your data stays in the EU, and it is never used for training. One exception: web search sends the search terms to Google, and admins can switch it off. Details on the Security page. The data processing agreement comes at launch.
• Week 3: the fixed instructions become an agent with instructions, knowledge and examples that you share with the team. Questions about your own documents get an answer with the document and passage, in Company knowledge.
• After 30 days: the usage dashboard shows who uses the tool and how, and the audit log keeps twelve months of activity.

What no tool does for you: picking the three tasks, writing the rules and naming someone who sticks with it. That part is yours, and it decides whether the rollout runs after 30 days.