The 50-person trap: too big to wing it, too small to govern it
Picture a 48-person firm — say a regional accounting or engineering shop. Six partners, thirty-odd billable staff, a handful of admins. Someone pastes a client's prior-year workpapers into a chatbot to speed up a memo, the memo reads beautifully, and it ships to the client before any partner sees the part where the model confidently invented a depreciation schedule that doesn't exist. Nobody was reckless. The firm just had no point in the workflow where AI output met a human who was accountable for it.
That is the actual readiness question at this size, and it is specific to this size. A 5-person firm reviews everything by reflex. A 500-person firm has a risk function. At 50, you have enough work product flowing — proposals, SOWs, deliverables, client correspondence — that informal review breaks, but not enough headcount to have built anything formal. The RSM middle-market AI survey and the OECD report on AI adoption by small and medium-sized enterprises land on the same unglamorous finding: value shows up when the workflow, the source material, and the owner of the outcome are nailed down before anyone buys a license — not after.
So skip the generic "are we innovative" survey. Pick one billable workflow and interrogate it. Proposal and SOW drafting. Engagement intake. Deliverable QA. Knowledge reuse from past engagements. Internal status rollups. For each, you are asking one thing: would running this through AI move utilization or cut write-offs without a partner having to redo the judgment that justifies the fee? Most firms find that exactly one workflow clears that bar on the first pass. That one is your starting point. The SMB AI readiness assessment gives you the dimensions to score it against.
The honest test: can you find the source material in under a minute?
Here's a diagnostic you can run this afternoon. Ask a senior associate to produce the firm's three best examples of the deliverable you want AI to help draft — the model proposals, the templates you'd actually want it learning from. Time it. If it takes longer than a minute, or if the answer is "it depends who did it," you are not ready, because whatever you feed the model will be whatever happened to be on someone's desktop. The CISA AI Data Security Best Practices guidance frames this as source governance — approved libraries, client-data boundaries, role-based access, retained logs — but at 50 people the practical translation is simpler: a single curated set of approved reference material that isn't living in personal drives, plus a rule about what client-confidential content is allowed to touch a model at all.
The second half is ownership. The NIST AI Risk Management Framework reads as abstract until you reduce it to a name on a wall: for this one workflow, who is the partner that signs off before AI-touched work reaches a client? Not "the engagement lead generally" — a designated review owner who knows the output passed through a model and is accountable for the failure modes. Engagement intake is forgiving; a hallucinated meeting summary gets caught. A client-facing tax position or an engineering spec is not forgiving, and that's exactly where a 50-person firm's reputation lives. Match the rigor of the review to the cost of being wrong, and write it down once.
Get those two things — findable sources and a named reviewer — and most of "readiness" is done. The 90-day AI implementation plan walks the rest: curate the library, set the review rule, prototype the one workflow, train the people who'll use it, all without standing up a firmwide program you'll regret.
Earn the second workflow before you ask for it
The failure mode at this stage isn't picking the wrong tool. It's declaring victory off a demo and rolling AI into five workflows at once because the proposal draft looked impressive in a partner meeting. The Deloitte State of AI in the Enterprise 2026 read is blunt on this: the returns come from a small number of governed workflows that survive real conditions, not from breadth of experimentation. The San Francisco Fed analysis of AI and small businesses echoes it from the other end — smaller firms that adopt narrowly and measure honestly outperform the ones chasing the whole menu.
So instrument the one workflow before you touch a second. Track draft-to-partner-review time. Track write-offs on engagements that used it versus the ones that didn't. Track rework after review — if partners are rewriting the AI draft more than they'd rewrite a junior's, the workflow is costing utilization, not buying it. And watch the exception rate: did deliverables actually move faster, or did they just generate more things for the reviewer to flag? If the workflow can't hold up under a busy-season week of normal delivery pressure, it doesn't scale, no matter how good the demo was.
When the numbers hold for one workflow, you've earned the right to add a second — and you now know exactly what "ready" looks like for the next one. Run the no-fake-savings AI ROI model on the first before you green-light the next, so the second decision is grounded in what actually moved the P&L.
