Choose a workflow worth automating
List recurring tasks that consume time or create avoidable delays: sorting enquiries, preparing weekly reports, moving approved information between systems, summarising research or creating a first internal brief. Favour work with a clear start, repeatable rules and an observable finish.
Avoid beginning with a sensitive or irreversible decision. Hiring, credit, health, legal conclusions and decisions that materially affect a person require far more scrutiny than organising a marketing brief. South Africa's Protection of Personal Information Act specifically addresses certain decisions based solely on automated processing, so a convenient workflow should never quietly become an unreviewed decision maker.
Write the current baseline before changing anything. Record how often the task occurs, how long it takes, common errors, waiting time and the useful business result. Without this baseline, an automation may feel modern while creating no measurable improvement.
- Good first candidate: frequent, rules-based and easy to review
- Weak first candidate: rare, ambiguous or dependent on undocumented judgement
- High-risk candidate: affects rights, finances, employment or access to an important service
Map the workflow before choosing tools
Document the trigger, inputs, steps, owner, systems and intended output. Mark every point where a person currently checks accuracy, applies judgement or communicates with a customer. The automation design should preserve necessary controls instead of deleting them because a tool can produce an answer.
Define the smallest useful version. A first workflow might classify a website enquiry and prepare an internal summary, while a person decides how to reply. That is easier to test than an autonomous agent that changes records, sends messages and makes commercial decisions across several systems.
NIST organises AI risk management around govern, map, measure and manage. A small business does not need a large governance department to apply the principle: name the owner, document the use case, test the output, monitor failures and decide in advance when the automation must stop.
Control data, access and suppliers
Identify every field the workflow receives and remove information it does not need. A reporting summary may need campaign totals but not customer names. An enquiry-routing workflow may need the requested service and location but not a full confidential history.
Check where each supplier processes and retains information, what is used for product improvement, who can access the connected account and how data can be deleted. Use business-controlled accounts, narrow permissions and documented ownership rather than an employee's personal login.
The UK Information Commissioner's Office advises organisations to assess AI data-protection risks in context and take proportionate technical and organisational measures. Its guidance was under review following UK legislative changes when this guide was published, so UK businesses should check the current ICO position before relying on an older interpretation.
Design a real human approval point
Human oversight is useful only when the reviewer has enough information, authority and time to challenge the output. A checkbox at the end of a fast automated process is not meaningful review if the person cannot see the source, correct a mistake or stop the next action.
Decide what the system may do automatically and what requires approval. Low-risk actions can include formatting an internal report or assigning a non-sensitive tag. Public claims, customer messages, budget changes and decisions that materially affect a person should have a clearly named reviewer unless the business has deliberately assessed and justified another process.
Provide an exception route. The system should identify missing data, low-confidence classifications and conflicting instructions rather than forcing every case through the normal path. Keep a log that makes repeated failures visible.
Test accuracy, failure and security
Build a representative test set containing normal examples, edge cases, incomplete inputs and deliberately difficult cases. Check factual accuracy, required format, unsafe disclosure, bias, brand voice and whether the workflow performs the intended action only once.
Test failure outside the model as well. What happens when a form submits twice, an integration times out, a permission expires or a supplier changes a field? Reliable automation depends on the complete chain of systems, not only the quality of an AI response.
NIST's generative AI profile highlights that generative systems can introduce or intensify risks across the lifecycle. Treat testing and monitoring as continuing work: record incidents, investigate their cause and update prompts, rules, permissions or the workflow when evidence changes.
Measure value before expanding
Run the first version alongside a controlled manual review. Compare processing time, waiting time, error rate, rework and the final business outcome with the baseline. For lead operations, this may include response time, qualified-lead rate and missed follow-up rather than the number of automated messages.
Include the cost of tools, implementation, review and maintenance. Saving ten minutes a month does not justify a complicated system. A modest workflow used hundreds of times may create more value than an ambitious agent that requires constant repair.
Expand only after the workflow is stable and the team understands its exceptions. OECD AI principles emphasise transparency, traceability and accountability; in practice, keep a short record of the purpose, owner, connected systems, data used, approval points, key tests and review date.
A launch checklist for the owner
Before launch, confirm the business outcome, responsible owner, legal and privacy review appropriate to the use case, approved suppliers, permissions, test evidence, exception path and shutdown method. Tell staff and affected customers about AI use when context or law makes disclosure necessary.
Schedule an early review after real use begins. Examine incorrect outputs, manual overrides, customer complaints, time saved and business impact. A workflow that repeatedly needs correction should be simplified or stopped rather than defended because implementation effort has already been spent.
Jet Fuel Digital's approach is to automate the busywork while keeping people responsible for strategy and important decisions. The starting point is a clear workflow and evidence, not a commitment to use AI everywhere.
- Purpose and success measure are written down
- Data and permissions are minimised
- A named human owns review and exceptions
- Normal, edge and failure cases have been tested
- Monitoring, incident handling and a stop control exist