Which business processes can AI automate without losing control?

What does automating a process with AI mean?

It does not mean installing a chatbot and letting it run the business. It means connecting specific steps in a process: receiving information, checking it, classifying it, preparing an action and recording the outcome.

Rules handle anything with an exact answer. AI is reserved for language and unstructured documents: it can identify the subject of an email, extract fields from a PDF or prepare a draft. The system then applies its validations, and a person approves any action with material consequences.

Which processes are suitable for automation?

A good candidate occurs frequently, has recognisable inputs and outputs, uses available data and has an objectively testable result. Errors must be detectable and reversible, and a named person must own the process.

Under those conditions, examples include:

• classifying emails, forms and documents;
• extracting data and transferring it under supervision to a CRM, ERP or case-management system;
• preparing responses, reports, quotations or tasks for review;
• appointment reminders, document requests and sales follow-ups;
• reconciliation, stock alerts and operational summaries based on first-party data;
• searching and summarising an authorised knowledge base while displaying sources.

In a law firm, this can reduce manual case opening, document chasing and the preparation of routine client updates. In a clinic, it can help with scheduling, confirmations, administrative paperwork and patient reactivation. It does not turn AI into a lawyer, dentist or practice manager.

Those are two examples, not a closed specialism. A process can be assessed in any sector: retail, industry, education, property, membership organisations or professional services. Feasibility depends on the process, its data, its risk and the available integration routes, not on the company’s line of business.

What conditions must be met?

The process needs an owner, written acceptance criteria and a representative set of ordinary and exceptional cases. The source software must offer an API, export or authorised integration route; we do not force access to a closed system or circumvent its security.

Testing starts with synthetic or minimised data, followed by a controlled sample. Production requires role-based permissions, activity logs, cost limits, alerts, a manual fallback and a way to stop the workflow. Where personal or sensitive data is involved, the client must validate the legal basis, providers and retention with its data-protection lead or adviser.

What can AI not do?

Generative AI does not know what is true: it calculates a probable response. It can omit a fact, misread a phrase or invent a convincing explanation. It also cannot repair disorganised data, contradictory processes or software with no supported integration route.

It cannot take professional responsibility, guarantee every output, understand information it never received or promise a return before the process is measured. Nor does it automatically learn everything the business knows: sources must be selected, maintained and protected by access controls.

Which processes will we not automate?

We do not delegate clinical, legal, employment, financial or essential-service decisions to a model. Out of scope are, among others:

• autonomous diagnosis, prescriptions, treatment plans or clinical triage;
• final legal advice, litigation strategy or filings without a lawyer’s review;
• hiring, dismissal, credit, insurance or admission decided solely by a model;
• signing, sending or publishing sensitive content without identifiable approval;
• autonomous deletion or alteration of systems that act as the source of truth;
• biometric identification, emotion inference or covert surveillance;
• data extraction or access that breaches permissions, contracts or security controls.

An automation may prepare and organise; the decision and responsibility remain with a qualified person.

How does a project start, and what does the public minimum include?

We first measure the current process and select a case with enough volume and low risk. We then build a pilot, initially in read-only or draft mode, and compare it with the baseline. It is expanded only if it reduces time or error without degrading the service.

The public minimum covers one bounded process, one primary system and one human approval point. Licences, model usage, hardware, archive digitisation and extra integrations are calculated separately in the final quote. Most projects need no special hardware; they do require authorised access, process documentation and time from the people who understand the work.

How is it kept under control?

We review acceptance rates, human corrections, errors, execution costs and changes to connected systems. Models and APIs change, so an automation is not delivered as a mechanism that can be forgotten. It needs an owner, periodic reviews and a working manual alternative.