You have 25 people, no data team, and a name on every invoice
Picture a 25-person consultancy or agency on a Wednesday afternoon. A senior associate has eight billable hours to log, three client deliverables due Friday, and a proposal that needed to go out yesterday. Someone suggests AI could draft the first cut of the status report. Good idea — until you notice that nobody in the building owns "data quality," there's no security review function, and the only person who can vouch for whether the draft is correct is the same partner whose name is on the engagement letter.
That's the actual readiness question for a firm this size. Not "are we innovative enough" — it's whether a workflow you already repeat every week can absorb AI without quietly creating review work that nobody has time to do. The RSM middle-market AI survey shows leaders moving fast; the OECD report on AI adoption by small and medium-sized enterprises is more sobering for your scale: it names process ownership, data quality, skills, and governance as the conditions that make adoption stick — and in a 25-person firm, all four usually live in the same two or three heads.
So don't run an abstract maturity survey. Pick one client-delivery workflow and score it across eight dimensions: how much value the workflow throws off, whether the source material is clean enough to trust, whether the tool can reach the systems it needs, where the permission boundaries sit, what the review rule is, whether the team will actually adopt it, how you'll measure it, and who owns it. Use the SMB AI readiness assessment as your baseline, then run it against work your associates touch every single week.
The first workflow needs a reviewer who can't pretend not to see it
At 25 people, your candidate workflows are obvious because they're the ones eating your associates' evenings: intake summaries, weekly project status reports, research briefs, knowledge search across past engagements, proposal assembly, and client-update drafts. The trap is picking the flashiest one instead of the one with a clear owner. A research brief AI gets 80% right is a gift — a partner skims it in five minutes. A client deliverable AI gets 80% right is a liability, because the 20% is the part that ends up in front of the client with your firm's logo on it.
The deciding test is simple: who reads the output before it leaves the building, and can they actually catch an error? In a firm this size, that reviewer is rarely a dedicated QA role — it's a partner or a senior lead squeezing it between their own billable work. That's fine, as long as you build the workflow around their real attention budget. The NIST AI Risk Management Framework gives you the discipline without the bureaucracy: govern the context, map where the workflow can fail, measure those failure modes, and keep accountability after launch — not a binder, just a named reviewer, an exception rule for the cases they must escalate, a log they can audit, and one weekly number.
Reject any pilot where the output owner is vague or the source trail can't be reconstructed. If you can't trace a sentence in the brief back to a document an associate can open, you can't defend it to a client. Use workflow discovery to find the handoff where better preparation lifts delivery quality without dragging the whole firm onto a new platform.
The output is a go / fix / kill decision — not a maturity grade
A readiness assessment that ends in a score out of 100 is useless to a 25-person firm. The Deloitte State of AI report points to the real bar: can one repeated client-delivery workflow move from "someone tried it once" to a controlled, repeatable rhythm? So your assessment should produce one of three answers. Go: name the first workflow owner, the pilot scope, and the weekly value check. Fix: list the specific gaps — clean sources, a willing reviewer, a logging step — that have to close before launch. Kill: if there's no clear client-delivery value, say so and move on. No fourth option, no "explore further."
And resist the pull toward autonomy. The Gartner agentic AI project forecast warns that a large share of agentic projects will be scrapped — and a small services firm is exactly where that goes wrong fastest, because you don't have the spare capacity to babysit an agent that books a meeting or edits a client file unsupervised. Prove that reviewed assistance saves your associates real hours first. Coordinating work across people and systems is a problem you earn the right to solve later.
Here's your Monday move: name one workflow, name its reviewer, and write down the single number you'll check next Friday. If you can do all three before lunch, you're ready to pilot. If you stall on the reviewer, you've found your first gap. Use the 90-day implementation plan to turn that into an owner, a control path, and a weekly value check.
