The tell at 25 people: three apps already have AI turned on, and nobody decided that
A 25-person company is a specific animal. There's no CISO, no IT director, often no full-time ops lead. The owner is usually the approval layer for pricing, hiring, refunds, and anything that smells like risk. So when AI shows up, it doesn't arrive through a procurement process — it arrives because the CRM shipped a "summarize this thread" button, the help desk added a draft-reply suggestion, and someone on the sales team is pasting customer emails into a free chatbot to write proposals. None of that was a decision. It's the default state, and it's exactly what the San Francisco Fed analysis of AI and small businesses and the OECD report on AI adoption by small and medium-sized enterprises keep circling: at this size, outcomes hinge on readiness, skills, source quality, and one clear use case — not on tool count.
So Days 1–30 are not a strategy offsite. They're a walk-through. Open every app the team uses and write down which ones already have an AI feature live and who's clicking it. List every place customer, employee, or financial data lives, and who can see it. Then ask one question of each manager: "What do you redo by hand every single week?" You're not hunting for the most exciting use case. You're hunting for the most repetitive, lowest-blast-radius one that a single named person can own end to end.
Pick that one. A 25-person team that tries to launch three workflows at once doesn't get three wins — it gets three half-built things and an owner approving all of them. Use the SMB AI readiness assessment to confirm the workflow you picked is actually mature enough to pilot, not just the loudest complaint.
Month two: write rules a 25-person team will actually follow on a Tuesday
Governance at this scale fails when it's photocopied from a Fortune 500. You can't assign a control owner if you only have one person per function. So shrink it. The NIST AI Risk Management Framework collapses into four lines you can fit on a whiteboard: what is this workflow doing, what mistake here would actually hurt us, what's the control, and whose name is on it. For a proposal-drafting workflow, the mistake that hurts isn't a clumsy sentence — it's quoting a price the owner never approved. So the control is: the tool drafts, the account manager edits, the owner still signs the number. Nobody automates the signature.
The data rules come from the CISA AI Data Security Best Practices, but again, translated for a company where the "approved source set" is three shared folders and a CRM. Days 31–60: decide which folders the tool is allowed to read, fix the embarrassing permission problems first (the all-hands folder that contains payroll, the client folder everyone can edit), turn off any AI feature that's quietly training on customer data, and write the one rule everyone repeats — "the tool drafts, a human approves before it leaves the building."
Then test it with the manager who owns it, on real-but-internal cases, before a single customer sees an AI-touched output. If the workflow touches money or people's records and the review path isn't airtight yet, it stays inside the building until it is. Use the 90-day AI implementation plan to keep the sequence honest: inventory, govern, pilot, train, decide.
Month three: the only output that counts is the owner approving less
The Deloitte State of AI in the Enterprise 2026 is built for companies a hundred times your size, but it lands one point that's brutally relevant here: an experiment creates zero value until it becomes a workflow people run without being reminded. At 25 people, "running without being reminded" has a precise signature — the owner's inbox gets quieter. The whole reason this company has a bottleneck is that one or two people approve everything. If the AI workflow worked, that should show up as fewer things bouncing to the top.
So Days 61–90 measure the operating change, not the novelty. Say a 25-person agency piloted AI-drafted client proposals: did the owner go from rewriting eight proposals a week to spot-checking the price on two? Did first-response time to a new lead drop from a day to an hour? Did the account managers stop rebuilding the same scope doc from scratch? Adoption stats — "the team used it 200 times" — mean nothing if none of that moved. People love a new toy for three weeks.
At day 90 you make one call: stop it (the rework didn't drop, kill it cleanly), change it (the workflow was right but the source set or the review step was wrong), or scale it (it worked — now copy the exact pattern to the next repetitive workflow you flagged in month one). Use the no-fake-savings AI ROI model so the day-90 number is a real operating change you can defend, not a hand-waved "hours saved." Then start the next 90 days — same narrow shape, next workflow.
