AI for Small Business: A Starter Plan for Teams of 5 to 50

Short answer

A small business should start AI with one owner, a one-page policy and two or three repetitive writing or sorting tasks. Use business accounts, keep customer personal data out of public chatbots, and have a person check every output that leaves the company. Measure the time a task takes before and after, then decide what to add next.

You run a firm of 5 to 50 people. Your staff already try AI tools, some on personal accounts. You have no IT department and no budget for a long project. This guide shows where to start, what to write down, which risks matter for a firm in Bosnia and Herzegovina or the Western Balkans, and what to do in the first month.

Do small companies need an AI plan at all?

Yes, but a short one. A plan for a small firm fits on one page and takes an afternoon to write. Without it, each person makes their own rules about client data.

Small firms are behind larger ones. Eurostat found that in 2025, 17% of small EU enterprises used AI, against 55.03% of large ones. Eurostat counts firms with 10 or more staff, so the smallest firms are not in these figures.

The reasons small firms hold back are clear. Among EU firms that considered AI but did not use it, 70.89% named lack of expertise. 52.52% named unclear legal consequences, and 48.83% named data protection. This guide covers all three.

Which tasks should a small team give to AI first?

Start with tasks that are repetitive, mostly text, and cheap to fix if the first draft is wrong. A person still checks the result.

Good first tasks:

Drafts. First versions of offers, emails and job adverts.
Summaries. Long email threads, meeting notes or supplier documents.
Translation. Drafts between local languages, English and German, checked by a fluent speaker.
Sorting. Tagging incoming requests so the right person sees them.
Templates. Turning your best past answers into reusable replies.

Do not start with final prices, contracts, hiring decisions, tax or anything published under your name without review.

At Konzept we are a team of 5, and we use AI tools in daily work. When a task repeats every day and touches your own systems, a manual chat window stops being enough. Our AI automation service builds that kind of workflow, with rules for the fixed steps and a review step for the AI output.

Which AI tools does a small business need?

Most small teams need three tool types, not ten. Pick one of each and add more only when a task needs it.

Tool type	What it does	Check before you buy
General AI assistant	Drafts, summaries, translation	A business plan that does not train on your data
AI inside software you already pay for	Email, documents, accounting or CRM features	Whether it is included or an add-on
Meeting or transcription tool	Notes and action points from calls	Consent from everyone on the call

Prices change often, so check each vendor’s pricing page before you choose. For the cost of a custom workflow rather than a subscription, read our guide to AI automation cost in Bosnia.

What goes in a one-page AI policy?

A one-page policy answers five questions: which tools, which data, who checks, who owns it and what to do when something goes wrong. Copy this outline and fill it in.

AI policy outline

Owner. Name one person who approves tools and answers questions.
Approved tools. List each tool and account type. Personal accounts are not allowed for work.
Data you must not enter. Customer personal data, health data, passwords, contracts and client secrets, unless the tool has a company agreement that allows it.
Human check. A person reads and corrects every output that goes to a client, a public page or a document with legal effect.
Honesty. Staff tell the owner when AI helped with client work, and the company follows client rules about AI.
Mistakes. Report a wrong output or a data mistake to the owner on the same day.
Review date. Check the policy every six months.

Write it in the language your team uses. Ask each person to read it and sign that they did.

What are the real risks for a small firm?

The real risks are data leaks, confident wrong answers and staff using personal accounts. All three are common and all three are cheap to reduce.

Customer data. Bosnia and Herzegovina adopted a new Law on the Protection of Personal Data in January 2025. According to DLA Piper, it “to a large extent” transposes the GDPR, and fines go up to BAM 40 million or 4% of global turnover. Pasting a customer list into a public chatbot is a data protection question, not only a policy question.

Wrong answers. AI can be wrong and still sound sure. The Commission’s AI literacy Q&A names hallucination as a risk that staff should know about. The human check in your policy is the fix.

Personal accounts. The Microsoft Work Trend Index 2024 found that 80% of AI users at small and medium companies bring their own AI tools to work. Give people a business account, and most of this risk goes away.

Does the EU AI Act apply to a small company in Bosnia?

It can. Bosnia and Herzegovina is not an EU member, but Article 2(1)(c) of the AI Act covers providers and deployers in a third country where the AI output is used in the Union. If you deliver AI-assisted work to EU clients, read Article 2 and check your position with a lawyer. This article is not legal advice.

If you are in scope, the main duty for a small firm is AI literacy. Article 4 asks you to “take measures to support the development of AI literacy” of your staff. It names SMEs as a group the Commission and Member States will support. The Commission Q&A says there is “no need for a certificate”. A record of your training session is enough.

What should you do in the first month?

Use the first month to set rules, start two tasks and measure them. This checklist assumes about two hours a week from the owner.

Week 1
– [ ] Name the AI owner.
– [ ] Ask each person which AI tools they already use, and for what.
– [ ] Pick two tasks from the list above.

Week 2
– [ ] Write and share the one-page policy.
– [ ] Set up business accounts and close personal ones used for work.
– [ ] Time each of the two tasks as you do them today.

Week 3
– [ ] Run a one-hour team session on the policy, the two tasks and wrong answers.
– [ ] Keep a note of who attended.

Week 4
– [ ] Time the two tasks again, with AI.
– [ ] List the errors the human check found.
– [ ] Decide: keep, change or drop each task.

When a team grows past 50 people, a one-page policy is not enough. Our guide to an AI enablement program covers the larger version. If finance work takes most of your admin time, read AI for finance teams.

When should you bring in outside help?

Bring in help when a task repeats every day, touches two or more systems, or handles data you cannot paste into a chat. At that point a built workflow is safer and cheaper to run than copy and paste. Ask us for a quote with the task, the systems and the monthly volume, and we will tell you whether it is worth automating.

Sources

Eurostat, Use of artificial intelligence in enterprises — data extracted December 2025
DLA Piper, Data Protection Laws of the World: Bosnia and Herzegovina — current page, checked 28 October 2026
European Commission, AI Literacy questions and answers — last updated 20 October 2026
Microsoft, Work Trend Index 2024: AI at work is here, now comes the hard part — 8 May 2024
EU AI Act Service Desk, Article 2: Scope — consolidated text as at 27 July 2026
EU AI Act Service Desk, Article 4: AI literacy — consolidated text as at 27 July 2026

FAQ

How much does AI cost a small business?

It depends on the number of people and the tool types you choose. Vendor prices change often, so check each pricing page before you buy. A custom workflow is a project, not a subscription. Konzept lists its project prices on the pricing page, and our AI automation cost guide explains what drives the cost.

Can my staff use free AI tools for work?

Not for client work or personal data. Some free and personal plans may use what you type to train the model, so read the terms. You also have no company agreement that covers the data. Give staff a business account instead. Free tools are fine for learning with made-up or public examples.

Do we need AI training certificates for our staff?

No. The European Commission says there is no need for a certificate under Article 4 of the AI Act, and no duty to test staff. Run a short session on your policy and the risks, and keep a note of who attended and what you covered. That record is enough.