AI Audit for SMEs: What It Should Deliver, and How to Spot One That Is Useless

A small business owner who commissions an AI audit wants to know one thing: where AI would save them time or money, in their own business, and on what condition. Anything that does not answer that question is filler. The problem is that filler sells very well: market trends, tool overviews, "maturity" maps. Here is what an audit should really deliver, and how to recognise one that will be of no use.

The three deliverables that make an audit useful

1. A list of use cases costed in hours, not in promises. For each candidate task: who does it, how many times a week, how long it takes today, and what share AI can reasonably absorb. "Boosting productivity" is not a use case; "drafting the first version of replies to quote requests, 40 a week, 20 minutes each" is one.

2. The state of the data and access. Every use case depends on something: emails, a shared folder, business software, a customer base. The audit says where that data sits, who has access to it, what state it is in, and whether it contains personal data. That is often where the real cost of a project hides.

3. A defined first project, with its success criterion. Not a three-year roadmap: one project, its scope, budget and duration, and the measure that will show in three months whether it worked. An audit that does not lead to a specific first project has left the hard decision to the client.

What to prepare beforehand

An audit moves twice as fast when the business has done three things: listed the repetitive tasks the team hates (they know them all); identified the software used day to day, and who administers it; and named one person able to make decisions and available during the audit. That third point matters more than the other two combined.

Five questions to ask the consultant before you sign

How many interviews, and with whom? An audit that only talks to management describes the work as people imagine it, not as it is done. You need to talk to the people who carry out the tasks.

What exactly does the report contain? Ask for an anonymised example. If it has no hours, no data and no first project, you know what you are buying.

Does the consultant also sell the development, or a specific tool? That is not a deal-breaker, but you need to know: an audit that always recommends the same software is not an audit.

What happens if the conclusion is "not now"? It is sometimes the right answer, when the data is not accessible or the volume does not justify the investment. An honest provider must be able to give it.

How are the AI Act and the GDPR handled? Since 2 August 2026, the AI Act's transparency obligations apply to systems that interact with people. Most internal uses in small businesses go no further, but each use case must be checked, especially if it touches customer or employee data.

Signs of an audit that is useless

• The report opens with twenty pages on the AI market.
• The use cases are the same as for any other business in the sector.
• No figure comes from your business: no volume, no time spent, no current cost.
• The conclusion is a "transformation roadmap" with no dated first project.
• Nobody looked at your data or opened your software.

After the audit

The first project should be small, measurable and reversible. To estimate its budget, our article on the cost of an AI integration for a business details the integration levels and the recurring inference cost. If your most frequent use case is customer service, see also what an AI chatbot costs.

FAQ