AI for business does not start with the tool. It starts with the question of which work you can responsibly hand over to a language model. A marketing agency draws different lines here than an accountancy firm. The gain lies in a way of working with fixed checkpoints, so you know whether the output is correct before it leaves your organisation.
According to provisional figures from Statistics Netherlands (CBS), 27 percent of Dutch companies with ten or more employees used AI in 2025, up from 19 percent a year earlier. Of the companies that considered AI but did not use it, 73 percent named lack of experience as the main reason. So the obstacle is rarely the technology.
What AI for business delivers
What AI for business delivers depends on the type of work. In knowledge-intensive services, the gain lies in recurring, text-heavy tasks such as drafting, summarising documents and organising raw data. In work that depends on facts you cannot check yourself, that gain evaporates.
A language model recognises patterns in text and generates new text based on them, but it does not supply verified facts. The difference between the two determines which tasks suit AI. It is a sharper criterion than the usual split between creative work and routine work.
Tasks where the time saving is real
The time saving is real for tasks whose result you can assess yourself without extra research. A legal professional checks a generated template agreement faster than someone can write one from scratch. An accountant can tell within a minute whether the structure of a draft report is right. In both cases, the person reading already has the knowledge needed to check it.
Four types of task recur in almost every knowledge-intensive organisation and meet that condition:
- Rewriting existing text for a different audience or length
- Summarising documents you have read yourself or can reread
- Structuring raw notes into a usable draft
- Generating variations on a text that you then select yourself
What these four have in common is that the source material is at hand and an error is visible as soon as you read, so the review takes minutes rather than hours. A second category is often overlooked: preparatory work that is never published. Intake questionnaires, an outline for an internal memo and three angles to consider before you start writing all save time without the output leaving your organisation.
Tasks where AI only shifts the work
For tasks without a verifiable source, AI shifts the work from writing to correcting. If you ask for figures, case law or citations without supplying them, you get plausible-sounding output that is wrong. A recurring pattern I saw with ChatGPT was search volumes appearing next to a keyword unprompted, even though there was no connection to a keyword tool those figures could have come from.
Three error patterns came up again and again in that period, and they apply more widely than SEO work:
- Invented sources and studies that turn out not to exist when you verify them
- Summaries that sound convincing but differ in substance from the source document
- Complex instructions where one part is carried out and another ignored
The third pattern is the hardest for businesses because it stays invisible. An employee gives five conditions, gets back a text that meets three of them and has no reason to check the other two. So the first question for any task is not whether AI can do it, but who checks the result, and against what.
AI applications by sector
Which AI applications are feasible varies widely by sector. What saves time in one profession touches on professional rules, confidentiality or liability in another. The sector guides below work this out for the professions where the lines are sharpest.
Legal services
In legal services, reviewing every draft comes first, because liability stays with the professional whatever tool was used. AI for lawyers covers confidentiality and the check before a draft goes to the client. For in-house lawyers, AI for legal professionals covers the same trade-off, with a focus on work you are better off doing yourself.
For civil-law notaries in the Netherlands, a specific framework has existed since November 2025. It is the AI-weegschaal (AI scale) of the Royal Dutch Association of Civil-law Notaries (KNB), with a supplement from December 2025. It sets out the risk level that goes with each application. In practice, the line is drawn at client data in deeds and files, because a summary of public regulations is not the same as a draft containing personal data of the people involved.
Accountancy
In accountancy, AI use revolves around auditability. In the Netherlands, the professional rules of the NBA (the Dutch professional body for accountants) and the NVKM (the Dutch quality management standards for audit firms) apply, alongside supervision by the AFM (the Dutch Authority for the Financial Markets). Together they require you to show how a judgement was reached. AI for accountants shows which audit and reporting work lends itself to AI support and which work stays out of reach.
To show this, you need to keep a record as you work, not afterwards. Four items belong in that record: the prompt used, the model version, the data entered and the name of whoever reviewed the output. The same requirement explains why a free consumer account is rarely enough here, because its processing terms differ from those of a business contract.
Marketing agencies
Marketing agencies have more room to manoeuvre, but risk generic output that does not stand out in search results. The gain lies in the steps of the content process that can be sped up without any loss of quality. If you want to speed up search engine optimisation, AI for SEO covers the practical applications and their limits.
After Google’s January 2026 update, I saw in my own field what happens to unchecked content. Generic AI texts lost visibility, while well-supported work based on its own data held its ground. Lead generation has different requirements because the number of recipients is small, and AI for B2B marketing works out that approach.
Healthcare
In healthcare, an error in AI output has more serious consequences than in an office, because an invented detail in a handover can lead to action being taken during the next shift. Applications of AI in healthcare range from decision support for diagnosis to voice-driven reporting and rostering, and each of them is subject to medical confidentiality and stricter rules for health data.
Architecture practices
Architecture practices mainly save time on text work, such as structuring a tender submission or reducing a programme of requirements to its hard requirements. The design and professional judgement stay with the architect. AI for architects also covers which confidential project information you should keep protected.
SMEs without an IT department
For SMEs without an IT department of their own, the first question is where to start, not which tool is best. The AI Literacy Course works out that starting point for a small team: which tools are responsible choices, which data never goes in and which agreements you put in writing first.
A smaller team also means that nobody monitors AI use centrally. Governance can therefore be lighter than in a large organisation, without disappearing. One internal point of contact and a document of a few pages cover what is needed in most cases.
Where to start with AI in your business
To start with AI in your business, choose one specific process, because a broad strategy that takes months of preparation delivers nothing at this stage. Three steps lay the foundation. They come in this order on purpose: without a chosen process, there is nothing to apply rules to.
Choose one recurring process
Choose a process that recurs at least weekly and whose result you can assess yourself. Drafting quotes, writing up reports and preparing client correspondence meet that requirement in most offices. Which process suits best differs by department, and AI in sales, AI in HR and AI for customer service work this out for three functions found in almost every business.
A process that occurs once a month gives too little repetition to build a way of working. Only after ten runs do you know which wording gives consistently usable output. So start small, with one to three processes. AI process optimisation helps you decide which process comes first, based on the bottleneck in the chain.
Decide what you may do with your current tools
For each tool, decide which data may go into it before the first team starts using it. A free account, a business subscription and an API connection differ in how the provider handles the data you enter. The question breaks down into three parts: which data goes in, where it is processed and how long it is kept. Whether your data itself is ready for use in an AI tool is a separate question, answered in AI data readiness.
Without those answers, you end up with a policy nobody can follow. So record the outcome for each account type rather than for each vendor, because within a single provider the terms of a free account and a business contract differ. Employees do not see that distinction in the interface. For ChatGPT, the differences between plans are set out in using ChatGPT for business, including what happens to your data.
Set the first checkpoints
For each task, record who checks the output and against what. From my years at major Dutch banks I bring the four-eyes principle: nothing leaves the building without a second pair of eyes. At SME scale, that does not mean a compliance department, but it does mean an internal point of contact and a workable governance document.
Not every task has the same risk profile, and the intensity of the check should match it. An internal memo needs a lighter check than client advice. In my own way of working, I assess AI output with one question: could I publish this under my own name? That question determines where a checkpoint is needed.
A checkpoint only works if it names what is being checked against: reading something through is not a checkpoint, but comparing names and figures with the source document is. If you want to set those checkpoints for a whole team rather than employee by employee, they belong in a prompt library and an AI policy that remain the property of your organisation.
Rules and risks that apply to every business
Besides your own quality requirements, some rules and risks are not tied to a sector. Three topics come up in every business, regardless of industry and size.
AI literacy under the EU AI Act
Under Article 4 of the EU AI Act, which has applied since February 2025, AI literacy is an obligation for organisations that deploy AI systems. AI literacy explains which knowledge that involves and how you record the measures you have taken.
Since 27 July 2026, it has been a best-efforts obligation: you take measures that support AI literacy, without a guaranteed level for each employee and without a fixed number of training hours. What counts is that employees know the capabilities and limitations of the systems they use, in proportion to their role. The wider obligations under the regulation go beyond training, and AI Act compliance describes which systems you must register and which documentation goes with that.
Shadow AI in your business
Shadow AI arises when employees use AI tools on their own initiative without the organisation knowing which data ends up in them. Shadow AI describes how to map that use. A ban rarely works, because people work around it as soon as the approved alternative is slower.
The underlying pattern is older than AI. Shadow IT shows why employees reach for unapproved software, and that explanation applies in full to language models.
When an impact assessment is mandatory
Under the GDPR, an impact assessment (DPIA) is required when processing personal data is likely to result in a high risk to the rights and freedoms of the people involved, and AI use can meet that threshold. Under the AI Act, a separate assessment applies to certain high-risk applications. Three instruments are often confused, although each examines something different.
A DPIA examines the consequences for the protection of personal data and follows from the GDPR, while an AIIA examines the wider risks of the AI system itself. A FRIA is the legally required variant under Article 27 of the AI Act and applies only to specific high-risk applications at certain organisations.
Most SME service providers fall outside that last category, because a general-purpose language model used for draft texts is not a high-risk system within the meaning of the regulation. What remains is the practical question of which risks your current AI use brings. You can answer that question without a formal instrument.
AI as a shared way of working
AI as a shared way of working delivers more than individual users who each choose their own approach. Without shared agreements, quality varies from one employee to the next and knowledge stays with whoever happens to be good with prompts. Three documents capture that knowledge in the organisation:
- A prompt library with the texts that do the work
- An AI policy that sets out what is allowed
- A governance document that names the checkpoints for each role
As long as those three do not exist, you do not have a way of working, just a collection of habits. You notice the difference when people leave: if the colleague who was best with prompts moves on, a group of individual users loses the whole benefit. A documented way of working stays.
Writing agreements down is one thing and following them is another. That is why the way of working includes a regular check that the whole team applies the agreements consistently. Responsible AI use describes which agreements need to be on paper as a minimum.
The next step with AI for business
The next step with AI for business depends on where you stand now. If nobody works with AI in a structured way yet, start with one process and build the first checkpoints around it. If several colleagues already use it without shared agreements, documenting the way of working is more urgent than a new tool.
Map out in advance what is allowed with your current tools and accounts and where the risks lie. From there, you know for each tool what is responsible and which agreements you need to put in writing first. If it is mainly about your team’s level of knowledge, AI training for teams is aligned with the obligation under Article 4.
