A founder I spoke to recently had been using ChatGPT for about six months. He’d tried it on client proposals, found it useful, then largely left it alone. When I asked why it hadn’t gone further, he said something I hear often: “I’m not sure if we’re ready.” He had a 22-person marketing services firm, clear workflows, reliable clients, and a team that was visibly stretched. He wasn’t behind on AI. He just hadn’t framed the question properly yet.
What choice does a 20-person firm actually face?
For a 20-person firm, the decision splits into two paths: run a deliberate, governed pilot now, or spend the next few months getting your data and processes into better shape first. Which path makes sense depends on conditions, not timing. Around 68% of small businesses under 50 staff now use AI regularly, but 77% have no formal policy in place, suggesting that many firms have moved on the first question without addressing the second.
The UK government’s own data adds useful context. In 2023, 15% of UK businesses reported using AI in some form, compared with 68% among large firms. The gap is real and widening. For a 20-person business, doing nothing carries a genuine competitive cost. But the high number of firms adopting without governance suggests that the constraint for many is knowing where the sensible entry point is, and how to test it without creating new problems.
When does adopting AI now make sense for your firm?
Adoption pays off early when your firm runs repeatable, text-heavy workflows: proposals, customer email replies, marketing content, HR communications, or basic documentation. Pilots in these areas consistently deliver 30 to 50% reductions in first-draft time. For a 20-person services firm where two or three people handle marketing and customer service, freeing five to ten hours a week across the team compounds into something material over a quarter.
Three indicators suggest “act now” is the right call.
First, you already use SaaS tools with AI built in. Microsoft 365 Copilot, Google Workspace, HubSpot, Zendesk, Xero, and QuickBooks all carry AI features that many small businesses are paying for but not yet using. A 30-day inventory of your existing tools often surfaces capability you already own.
Second, your sector is low to moderate regulatory risk. A B2B consultancy or marketing agency faces different obligations from a regulated financial adviser. The NCSC guidance explicitly supports using generative AI for internal drafting and documentation with basic safeguards in place.
Third, you can run a time-boxed pilot. OpenAI’s published playbook and the Digital Applied guide for sub-50-person firms converge on the same starting pattern: one or two narrowly defined use cases, a 60 to 90 day window, and clear metrics before you start. McKinsey’s 2023 State of AI survey found that the firms extracting the most value from AI focused on a small number of high-value use cases rather than experimenting broadly. Narrow and deliberate is consistently the pattern that works.
When should you slow down or wait?
Slowing down is rational when regulatory exposure is high, your data is disorganised, or the firm is mid-way through another significant change. Financial services, clinical practices, and legal firms using AI in client-facing or decision-making processes face obligations under FCA guidelines, ICO rules, and the EU AI Act that require documented governance before deployment, not as an afterthought once the tool is live.
Four conditions make a pause the better call.
Your data environment is disorganised: multiple systems, inconsistent naming, no clear record of what personal data you hold or where it lives. McKinsey identifies poor data quality and unclear ownership as the primary reasons AI projects fail. AI applied to bad data produces unreliable outputs faster, and in a professional services firm that can reach clients.
Your firm is mid-way through a major systems change. Adding AI during an ERP or CRM implementation typically leads to change fatigue, poor adoption, and wasted spend on subscriptions nobody actually uses.
Your sector uses AI in high-stakes client decisions. FCA-regulated firms must demonstrate senior manager accountability and consumer-outcome focus for any AI model, bought or built. ICO guidance warns that automated candidate screening can produce discriminatory outcomes if not properly monitored and explained to candidates. Anything touching special-category data requires a Data Protection Impact Assessment and meaningful human review.
Some firms are also beginning to see client contracts that prohibit AI use for confidentiality or IP reasons. If your contracts are moving that way, unmanaged adoption becomes a commercial risk ahead of any efficiency gain.
What does getting the call wrong actually cost?
Under-adoption and over-adoption both carry real costs for a 20-person firm. Move too slowly and you start losing bids to competitors who can turn work around faster, offer 24/7 support, or price lower through AI-driven efficiency. Move too fast without governance and you face ICO fines, contractual liability for AI-generated errors, and staff using unmanaged tools that expose client data without your knowledge.
KPMG UK found that 65% of UK executives expect AI to be embedded in most business processes within three years, which shapes what clients expect in terms of speed and responsiveness. Microsoft’s 2024 Work Trend Index reported that 75% of knowledge workers already use AI at work, frequently without official approval. For a 20-person firm with no policy, this means your staff are likely already using tools you have not assessed for data risk.
The regulatory cost of getting it wrong is documented. The ICO fined Experian £650,000 and ordered data deletion for unlawful profiling practices. The ICO fined Clearview AI £7.5 million for unlawful data collection. Both decisions reiterate the same principle: deployers of AI remain responsible for outcomes regardless of whose model they are using. UK GDPR allows fines up to £17.5 million or 4% of global turnover for serious breaches. Real SME fines sit well below those ceilings, but an ICO investigation carries reputational costs beyond the financial penalty.
The NCSC’s 2024 guidance warns that public generative AI tools can expose sensitive information when staff paste client data into prompts. A one-page acceptable-use policy addresses this risk directly and costs almost nothing to produce.
What should you ask before you decide?
Five questions will tell you whether your firm is ready to run a pilot or needs a few months of groundwork first. They cover your workflows, your data risk, your existing tools, your governance readiness, and your metrics for success. Firms that can answer all five clearly tend to run more productive pilots. Firms that cannot answer three or more usually benefit from getting organised first.
What are your top three time-sinks measured in hours or cost, and are they primarily text or data tasks? Generative AI performs reliably on drafting, summarising, and categorising. It performs poorly on specialist judgement calls or tasks with no digital record to work from.
What personal or client data will the AI see, and where does it go? Read your vendor’s data processing terms and check whether they use your inputs to train their models. The ICO’s AI and data protection risk toolkit is designed for organisations without specialist legal resource and is worth an afternoon of a director’s time.
Which of your existing tools already have AI built in? A 20-person firm conducting a basic audit often finds the fastest gains are in software they already pay for.
Can you write a one-page acceptable-use policy this week? It needs to state what staff can and cannot put into AI tools, when human review is required, and who is accountable for AI decisions internally. The Lloyds Bank Digital Index 2024 found that only 10% of SMEs feel confident about their AI skills. A policy is the first practical step toward closing that gap.
For each proposed use case, what is the baseline time or cost today, and what will tell you the pilot worked? Define both before you approve any spend. If you cannot answer this, you will not be able to evaluate the outcome.
If you can answer all five with confidence, a 60 to 90 day pilot in one or two workflows is a reasonable next move. If three or more have no clear answer, spend a month on the groundwork. The AI will still be there, and you will be in a much better position to use it well.
