AI in a Small Business: What Is Actually Worth Using It For?

Much of the confusion about AI in business comes from one word covering very different things. A reminder that fires the day before an appointment is sometimes called “AI”. So is a system that reads a customer's message and drafts a reply. So is software that takes actions on its own across several systems. They carry very different risks, and they should be chosen for different jobs.

Generative AI is strongest at tasks involving language where a person can quickly check the result. For a small business, that typically includes:

• Drafting — first versions of replies, proposals, job adverts or product descriptions, edited by a person before they go out.
• Summarising — long email threads, call notes or documents condensed so the next person can pick them up.
• Classifying and routing — reading an incoming enquiry and suggesting what it is about, how urgent it is and who should handle it.
• Extracting — pulling names, dates, amounts or requirements out of messages and documents into structured fields.
• Answering from approved material — responding to common questions using only content the business has written and checked, with a clear route to a person.

What these share is that the AI prepares and a person decides, or the AI answers within boundaries the business has set. The value comes from time returned to the team, not from removing them.

This is not a bug that will disappear with the next release; it follows from how these models work. They generate plausible language, and plausible is not the same as true. A model asked about your prices, your policies or a customer's order will produce a fluent answer whether or not it has the facts.

Other practical risks follow. Outputs vary, so the same question may get different answers. Customer information pasted into a tool may be stored or processed in ways the business has not assessed. And staff can come to trust fluent output more than it deserves. NIST's broader AI Risk Management Framework describes trustworthy AI as valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed ^[1] — a useful checklist even for a very small deployment.

1. 01Can a person check the output quickly?

   If reviewing the answer takes as long as producing it, the time saving disappears.

2. 02What does a wrong answer cost?

   A clumsy draft costs a minute. A wrong price, dosage, legal statement or promise to a customer can cost far more.

3. 03Is there an approved source of truth?

   AI that answers from your own checked content is far safer than AI answering from general knowledge.

4. 04Who is accountable?

   Name the person who reviews, owns and can switch off each use. If nobody is, it is not ready.

The single most important design decision in a business AI system is where a person reviews, approves or can take over. Decide it before choosing a tool. In practice this means: AI drafts, a person sends; AI suggests a category, a person can correct it; AI answers a customer, and says it is automated, and hands over to a person when the question leaves its approved material.

Kenya's Data Protection Act, 2019 applies to personal data whether it is processed by a person or by software. Its principles — lawful, fair and transparent processing, explicit and legitimate purposes, and data limited to what is necessary — are a sensible test for any AI use involving customers ^[4]. In practice: know what data goes into each tool, why, where it is processed, and who can see it.

At the national level, the government launched Kenya's Artificial Intelligence Strategy 2025–2030 in March 2025, built around digital infrastructure, data and AI governance, and research, innovation and commercialisation ^[3]. A strategy is not a regulation, but it signals the direction of policy, and businesses building on AI should expect governance expectations to mature.