How to adopt AI in a small business
Key Takeaways
- Where should a small business start with AI?
- What should be written down before a tool is bought?
- Does using your own documents remove the need to check the answer?
Where should a small business start with AI?
With the purpose and the context, before a tool. NIST AI RMF 1.0, released January 26, 2023, is voluntary. Its core is four functions: GOVERN, MAP, MEASURE, and MANAGE. NIST says those actions are not a checklist and not necessarily an ordered set of steps. It also says that after the GOVERN outcomes are in place, most users start with MAP, which frames the purpose, the context, and the risks.
NIST's framework page says AI RMF 1.0 is being revised, so this page uses the 1.0 text and does not describe the revision (NIST AI RMF 1.0, NIST framework page). On this page, a practical first list is recurring work such as email, quotes, scheduling, data entry, and reporting, with a person who can check the output.
Drafts, summaries, and first-draft quotes are the low-risk start when a staff member approves every final output. The related service is AI consulting.
What should be written down before a tool is bought?
The purpose, the legal requirements you can identify, who oversees the system, and what third parties are involved. In the 1.0 GOVERN function, policies and processes for mapping, measuring, and managing risk are in place. Legal and regulatory requirements involving AI are understood, managed, and documented. Policies define roles for human-AI configurations and oversight.
Policies also address risks from third-party software, data, and the supply chain (NIST AI RMF 1.0). For each use, write the problem, the data involved, how you will know it worked, and the owner. Check that provider's current terms, including whether a business tier says customer data is not used for training and how long it is kept. This page does not quote a vendor's current clause.
HIPAA-covered work needs a BAA with any vendor that touches protected health information. That requirement is explained on the HIPAA compliance guide. Buying a tool before this note usually produces a pilot nobody uses. This page does not require a full software replacement.
Does using your own documents remove the need to check the answer?
No. This page uses retrieval-augmented generation to mean indexing your own documents and retrieving them when a question is asked, so the draft can point at those documents. Retrieval should follow each person's existing access. NIST's MEASURE function is how you assess the system after MAP, and GOVERN calls for human oversight. Neither function says an indexed document makes the draft final.
A person still approves the output. Messy source files still produce messy drafts, so the files need a consistent format before you expand to the next process.
References
- NIST. Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST.AI.100-1, January 26, 2023. GOVERN, MAP, MEASURE, and MANAGE. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
- NIST. AI Risk Management Framework page. States that AI RMF 1.0 is being revised. https://www.nist.gov/itl/ai-risk-management-framework
- Related pages: AI consulting and HIPAA compliance guide.