An AI strategy for a UK SME: two pages, four decisions, and a first process.
By Zain M · 7 October 2026 · 12 min read
An AI strategy for a UK SME is two pages and four decisions: which categories of work AI will and will not be used for, and who decides on individuals; which tools on which plans, with the data position written down; how spend, quality and risk will be controlled; and which single process goes first, with a baseline measured before the build and a 90-day decision. Everything else is a deck. The UK evidence shows why: most adopters report productivity gains but few see revenue change, and the projects that get abandoned are the ones without a measured first process and a clear business value. The template below is written to be filled in as it stands.
What the evidence says a strategy has to answer
DSIT’s 2026 adoption research found three-quarters of UK adopters reporting productivity gains and only 12 per cent reporting higher revenue; PwC found 21 per cent of UK chief executives saying AI had increased revenue in the last twelve months. MIT NANDA found 95 per cent of organisations getting no measurable return from generative AI, and Gartner’s four causes of abandonment are poor data quality, inadequate risk controls, escalating costs and unclear business value. The ONS found most firms with a skills gap training their own staff. A strategy that does not answer those five things, where the return will be measured, what the data state is, how risk is controlled, what it will cost to run, and how staff will learn, is a strategy that will be abandoned, and the surveys say so.
The four decisions
Decision one: scope. Which categories of work AI may be used for (drafting, reading and sorting, answering, chasing, booking), which it may not (anything that decides about an individual without a person, anything with special-category data outside an approved plan), and who owns each. Decision two: tools. Which assistant on which business plan for which roles, with personal accounts banned; whether a coding agent is in scope; and the data position for each, recorded as a processor with the DPA reference. Decision three: controls. An acceptance threshold as a number for anything repeated, spending ceilings per feature, a person on every consequential decision, a DPIA where the ICO’s criteria are met, and a one-page policy staff have read. Decision four: the first process, chosen for volume and measurability, with a two-week baseline and a 90-day decision meeting in the calendar.
| Decision | What it settles | Where it is written |
|---|---|---|
| Scope | What AI touches and what it never decides | Page one, top |
| Tools | Which plans for which roles; processor records | Page one, bottom |
| Controls | Threshold, ceilings, human decision, DPIA, policy | Page two, top |
| First process | Baseline, build or buy, 90-day measure, owner | Page two, bottom |
The template
Replace the bracketed items. Keep the headings.
What a strategy should not contain
A vision statement. A list of every AI technology with a paragraph each. A three-year roadmap of projects nobody has costed. A benchmark of model capabilities that will be out of date by the review. A promise that nobody’s job will change. And a budget line for “AI” with no process attached, because a budget without a process is the escalating-cost cause of abandonment in Gartner’s list, written in advance.
Who writes it, and what it costs
The owner of the business, with the person who owns the first process, in an afternoon, using the numbers from a measured baseline. Where a firm wants the baseline measured and the options priced by someone who has done it before, our AI adoption audit produces exactly this document, at £2,500 to £6,000 fixed and credited in full against any build, and the market for that work is surveyed in our cost guide. Either way the strategy is two pages, and the fourth decision is the one that matters.
Common questions
Does a small business need an AI strategy?
It needs four decisions written down: scope, tools and data position, controls, and a first measured process. Two pages. A long strategy document is what the abandoned projects in the surveys had.
What should an AI strategy include?
What AI may and may not be used for and who decides on individuals; which tools on which plans for which roles; the acceptance threshold, spending ceilings, human decision rule, DPIA position and policy; and the first process with its baseline and 90-day decision.
How do we choose the first process?
By volume and measurability: the process with the most units and the most retyping, chasing or reading, where a two-week baseline is easy to count.
Should the strategy pick a vendor?
It should pick tools on business plans for roles, and record the data position for each. Model choice for a build is a discovery-step decision made on your own inputs, not a strategy decision.
How often should an AI strategy be reviewed?
Quarterly, after each 90-day cycle, and whenever a provider, plan or law changes. The tools change often enough that an annual review leaves it wrong for months.
What does an AI strategy cost?
An afternoon if the firm has a measured baseline. £2,500 to £6,000 for an audit that measures the baseline, prices the options and writes the two pages, credited against a build.
Want the two pages written from measured numbers?
The AI adoption audit measures the first process, prices the options with running costs, writes the data position, and hands you the strategy a board approves.