At ten people, the roadmap that works is the one nobody has to babysit
Picture a ten-person shop: two founders, four billable people, an ops lead who also does payroll, someone in sales, a part-time bookkeeper. There is no IT department. There is no "AI champion" with slack in their week. If your roadmap assumes any of those roles exist, it dies in week two — not because the tools failed, but because nobody owned the result long enough to see if they worked.
So the first move is brutally narrow: pick one repeated workflow and ignore everything else. Not a "platform." Not "AI across the business." One workflow — the meeting follow-up that the ops lead writes by hand every afternoon, the new-lead research the salesperson does before every call, the Monday status email someone reassembles from four threads. McKinsey's State of AI 2025 is worth reading here because it shows the gap is no longer awareness — plenty of small teams are using AI — it's that usage rarely converts into a workflow that runs the same way every time. A ten-person team can't afford to be in that gap. You don't have the headcount to absorb a tool that helps sometimes.
The owner is the person who lives with the output, not whoever is most excited about the technology. If the ops lead currently writes the follow-ups, the ops lead owns the AI version and decides whether it's good enough to send. IBM's Institute for Business Value research frames real AI capability as a stack — data, adoption, measurement, operating ownership — and in a small team those four things collapse onto one named human. Name them. If you can't say who owns the workflow result, you don't have a roadmap; you have a subscription.
The thing that bites ten-person teams: the assistant can already read everything
Here's the trap specific to your size. A 200-person company has folders, groups, and access tiers built over years. A ten-person company keeps everything in three shared drives because that was faster, and everyone can see almost everything because trust was cheaper than structure. That worked when only humans were browsing. The moment you point an assistant at those drives, it inherits that same wide-open access — and it will happily surface the salary spreadsheet, the cap table, and the client's contract in answers to a casual question.
That's why permission cleanup comes before the assistant goes live, not after. Microsoft's Copilot data protection architecture is blunt about this: the assistant operates within the access the user already has, so loose permissions become loose AI answers. The fix is unglamorous and takes an afternoon — move payroll, cap tables, and signed contracts out of the general drive into something only the people who need it can open. Do that one cleanup and you've removed the single most likely way a small AI rollout embarrasses you.
Then keep the whole thing disciplined with four words from the NIST AI Risk Management Framework: map, measure, manage, govern. For a ten-person team that's not a compliance program — it's a one-page check. Map: which workflow, what data does it touch. Measure: is the output actually better, and where could it be wrong. Manage: who reviews before anything leaves the building. Govern: who decides to expand. If you can't fill in those four lines on a single sheet of paper, you're experimenting, and you should call it that.
What day 90 has to prove — and how to know you're not fooling yourself
Set the bar before you start, because at ten people it's easy to convince yourself something works when it just feels novel. Day 90 should answer four questions with evidence, not vibes: Did the owner spend less time on this workflow than they did in week one? Did rework go down — fewer corrections, fewer "actually, redo that"? Did the output get more consistent across the team, not just better on a good day? And did it stay inside the access boundary you set in the cleanup? If you can answer all four yes, expand to the next workflow. If even one is a maybe, fix it before you touch anything else. The fastest way to lose a small team's trust in AI is to scale a workflow that was only working in the demo.
Concretely, Monday: write your one-page map for a single workflow, name the owner, and put 30 minutes on the calendar to do the access cleanup. That's the entire start. If you want a sharper read on which of your workflows is actually the right first one, start with the AI Opportunity Score, then use a QuickStart AI Audit to turn that pick into a governed 90-day plan you can hand to the owner.
