The First AI Workflow a Small Firm Should Automate

The first AI workflow a small firm should automate is recurring client communication, status updates, missing-information requests, intake follow-ups, monthly summary emails. Four things have to be true. It runs at least weekly. The output is written, and a client or partner sees it. The judgment calls are ones AI can actually help with, not the ones it can't. And the work is bottlenecked by drafting or organizing, not by deciding. The five operating-model moves that make it actually pay off: a named owner with a calendar block, a three-sentence data rule, a review step separated from the drafting step, a 30-minute workflow-specific training, and one metric (rework requests per month).

The rest of this issue walks through why that workflow, what the AI-assisted version looks like in practice, what's running inside ICBM Media right now, and how to know it's working in your own firm.

Last week's issue argued that AI doesn't fix a broken process, it accelerates one. This week's question is the one that decides whether AI ever pays for itself inside a small firm: what's the first AI workflow a small firm should automate, and what has to be true around it before AI touches it?

Two decisions are worth taking seriously here. Picking the right first workflow is one. Putting a few specific things around it before AI gets involved is the other. Most small firms I've watched make this leap miss on both at the same time, they pick a workflow that's too ambitious to start with, and they treat AI as a tool purchase rather than a change to how the firm operates.

The research has been pretty consistent on what that produces. MIT's NANDA initiative, in its GenAI Divide: State of AI in Business 2025 report, based on 52 executive interviews, 153 leader surveys, and analysis of 300 enterprise AI deployments, found that 95% of generative-AI pilots delivered no measurable P&L impact, with only the 5% of "integrated" systems creating significant value.

The report attributes the failure pattern less to model quality and more to organizational approach: vendor partnerships succeeded roughly two-thirds of the time, while internal builds succeeded about a third. McKinsey's State of AI: Global Survey 2025 points in the same direction from a different angle, AI high performers are 2.8x more likely than peers to have fundamentally redesigned workflows around AI (55% vs. 20%), and only 39% of all organizations report any EBIT impact attributable to AI at all.

So which workflow first, and what belongs around it?

In my experience, the best first AI workflow for a small firm isn't the most exciting one. It's the one that meets four criteria:

For most small professional firms, the workflow that meets all four is recurring client communication. Status updates, missing-information requests, intake follow-ups, monthly summary emails, kickoff packages, recap notes after a meeting. I'd start here because it's the highest-frequency, lowest-judgment-risk written work in most small firms, which means the operating-model muscle you build on this workflow transfers fairly cleanly to harder ones later.

The highest-leverage version per firm type tends to be:

Whichever one your firm sends most often is a reasonable place to start.

Worth showing the comparison directly, since a reasonable reader might ask why not intake, proposal drafting, or research.

Meeting summaries come closest to winning. They lose because they're usually internal, which means no client deadline forces the workflow to actually run consistently.

There's also a longer-term reason worth naming. The first AI workflow a firm runs is the one that teaches the firm what an operating model around AI feels like, owner, data rule, review step, training, metric. Those five moves are easier to learn on a low-stakes workflow than on a high-stakes one. Once a firm has run them successfully on client communication, applying them to harder workflows is a transfer of an existing skill, not a fresh attempt. Starting somewhere harder usually means failing at both the workflow and the operating model at the same time, with no way to tell which one broke.

Worth answering the obvious pushback. A reasonable skeptic might push back two ways. First: client communication is too low-stakes to be worth the setup. The answer is that the setup compounds, the five-move discipline you build here is the same discipline you'll need on proposal drafting, research, and document review later. Second: your biggest time sink is something else. Possible, and worth checking against the four criteria. If the biggest time sink in your firm meets all four, weekly, client-facing, low-judgment, drafting-bound, start there instead. The criteria matter more than the specific recommendation.

A concrete example, because the point of this issue is to be useful rather than abstract.

Without AI, the version most firms run today, an associate or owner opens a blank email at the end of the week, looks at their notes and the matter file, and writes a status update from scratch. Tone drifts across clients. Details get missed when the week was busy. Some weeks the update doesn't go out at all. Twenty to forty minutes per client, and the quality varies with how tired the writer is.

With AI, inside the five moves below, the associate opens a saved prompt template that already contains the firm's voice guidance, the structure of a standard status update, and the data rule about what can be pasted in. They paste in their notes from the week (scrubbed of anything outside the data rule), generate a draft, and stop. The draft sits for 24 hours. The next morning, the associate opens a short review checklist and reads the draft against it. Edits go in. The update goes out.

The output isn't dramatically better. The process is repeatable, consistent across clients, and survivable on a busy week. That's the part I'd argue matters.

This is the part I see skipped most often in small-firm AI rollouts, and it tends to be where the time savings quietly disappear. Five moves, roughly in order. None of them are heavy lifts on their own.

1. A named owner with a calendar block. One person whose name is on the workflow and whose calendar has a recurring window for running it. In a one-person shop, that person is you, and the calendar block still has to exist or the workflow drifts.

2. A three-sentence data rule. Plain English. What goes into which tool, what never goes into a public chat window, what gets scrubbed first. Thomson Reuters Institute's 2025 Generative AI in Professional Services report found that 52% of legal professionals surveyed said their organization had no GenAI usage policy and 64% had received no GenAI training, even as legal GenAI adoption nearly doubled year over year. Three sentences put a firm ahead of most of the field.

3. A review step, separated from the drafting step. In a multi-person firm, a second person reviews before the work ships. In a one-person firm, the equivalent is a deliberate gap, at least 24 hours between drafting and reviewing, with a short written checklist in front of you while you review. The checklist is what keeps you from passing over your own work too fast. Three questions, each answered yes or no, tends to be the sweet spot.

4. A 30-minute workflow-specific training. Not "AI training." Training on this workflow: which tool gets used at which step, what the data rule says, what the review step looks for. In a one-person shop, the training is writing it down on one page so the process stops living in your head.

5. One metric you actually watch. Not five. One. For client communication, the most useful one tends to be rework requests per month, how often something went out that had to be corrected, rewritten, or apologized for. If that number drifts down, the workflow is doing what it's supposed to. If it doesn't, the workflow probably needs adjusting before another tool gets added.

Five moves, one page. Worth keeping somewhere you'll actually look at it.

A concrete example, no hypotheticals. This is the setup running this week.

Drafting a status note used to take me roughly 25 minutes. With the workflow it's closer to eight. Reworks trended down too, from a couple a month to maybe one over the last eight weeks. Caveat: I'm a one-person operation here, and that number gets harder to hold as a team grows.

What matters is that each tool has one job inside the workflow, not which brands are on the list. When I find myself switching tools mid-step, it's usually a sign the workflow isn't designed yet. It's also worth noting that the MIT research above found vendor-partnership AI deployments succeeded at roughly twice the rate of custom internal builds, which is a long way of saying that for a small firm, using established tools well beats building your own.

Research and public sourcing run in Perplexity Max. Drafting from my own notes runs in Claude Pro. Anything with internal numbers or vendor pricing stays in Claude Code on local files. Graphics run on GPT-5.5 inside Perplexity Max from a written brief. Nothing confidential goes into a chat window without being scrubbed first.

The Three-Sentence Data Rule. Write three sentences and post them where everyone using AI tools can see them. (1) Allowed: e.g., public matter type, jurisdiction, deadline dates, anonymized fact patterns, and our own templates. (2) Scrub before paste: e.g., client names, dollar amounts, case numbers, opposing-party identifiers, replace with [CLIENT], [AMOUNT], [MATTER-ID]. (3) Never paste: e.g., SSNs, account numbers, privileged communications, settlement terms, or anything covered by an NDA or protective order. If it doesn't fit on three lines, it won't survive a busy Tuesday.

The tool that has changed the most about how I work this year is the Comet Assistant inside the Perplexity browser. Comet is Perplexity's AI browser, included with Perplexity Max, and the assistant can take actions inside the browser on my behalf, navigating pages, running multi-step tasks across tabs, pulling and comparing data, filling forms, and executing repeat workflows I describe in plain English.

The reason this matters for small firms, I think, is specific. Most small-firm owners have a list of recurring browser tasks they avoid because the workaround feels technical. Logging into three vendor portals and pulling the same five fields. Checking court dockets or state filings on a schedule. Pulling competitor pricing pages into a comparison sheet. Reformatting client intake data from a web form into a working document. None of that is hard. All of it is annoying enough to get skipped or done badly.

A browser agent collapses those tasks. I describe what I want in plain English. Comet handles the clicking, the navigating, the copying, and the comparing. I review the output.

The agent doesn't replace the review step. It replaces the clicking. The same five moves still apply.

A note on the risk. A browser agent is operating with your logins inside your live session, which is closer to handing a junior associate the keys to your browser than running a search query. I'd be careful about letting one touch client portals, banking, payroll, or anything with regulated records until you've written the data rule for what it's allowed to do and confirmed how the underlying tool handles session data, prompts, and logs. The thing I'd watch for isn't an agent going rogue. It's "just have Comet do it" creeping into tasks that needed a human at the controls.

Used inside a written workflow, with an owner, a rule, a review step, and a metric, a browser agent is probably the highest-leverage AI tool a small-firm owner has access to right now, specifically because it does the technical work most owners can't or won't do themselves.

I review my own work, because I'm a one-person shop right now. Two moves make that workable: a 24-hour gap between drafting and reviewing, and a three-question checklist I keep in front of me while I review:

Three questions, yes or no, every time. The checklist works for me because it's short enough to actually use and specific enough to catch the failures I'm prone to.

Claims that didn't survive a second-source check. Sentences that sounded sharp but didn't mean anything. Numbers that were directionally right but cited the wrong study. Each one was the kind of error a sharp reader would notice and remember.

Rework after publish, how many post-publish corrections, clarifications, or rewrites I've had to make. That number has dropped. I'm not publishing a percentage because self-reported AI productivity numbers don't survive scrutiny in the broader research base, MIT's own data shows 95% of enterprise GenAI pilots produce no measurable P&L impact even when teams report using the tools daily, and I'd rather give you something you can verify than a clean figure you can't.

Four checks, none of which require time tracking.

Does the workflow exist on paper? If "how we do client status updates" still lives in someone's head, what the firm has is a habit, not a workflow.

Could someone else run it from the document? This is the real test of leverage. If only one person in the firm can do it, AI hasn't really changed the dependency.

What has the review step caught in the last 30 days? A running list of specific saves is more useful here than a percentage. If the list is empty after a month, either the review step isn't doing anything or the workflow doesn't actually need AI.

Where did the first version break, and what was the fix? Every working AI workflow I've seen broke somewhere on the first pass. The fix is almost never more AI, usually a clearer rule, a tighter checklist, or a separated step.

Last week's question was: which workflow should we map first?

This week's, I'd argue, is one layer down: which workflow do we run often enough, with low enough judgment risk, to be worth turning into a system this month?

For most small firms I've watched, the answer is recurring client communication. Build the five moves around it, run it for 30 days, and watch rework instead of hours. If it works, you've built a small piece of operating-model muscle that transfers to the next workflow. If it doesn't, the workflow itself probably needs fixing before another tool gets added.

What's the first AI workflow a small law firm or CPA should automate?
Recurring client communication, matter status updates for law firms, missing-document requests for CPA firms during close, weekly project updates for consultancies, and recurring client recaps for agencies. It's the highest-frequency, lowest-judgment-risk written work in most small professional firms, which makes it the safest place to build operating-model discipline before tackling harder workflows.

Why do most small firms get no return from AI?
MIT NANDA's GenAI Divide: State of AI in Business 2025 report found that 95% of enterprise generative-AI pilots delivered no measurable P&L impact, with the failure pattern tracking organizational approach rather than model quality, internal builds succeeded only about a third of the time, compared to roughly two-thirds for vendor partnerships. McKinsey's State of AI: Global Survey 2025 reaches a complementary finding: AI high performers are 2.8x more likely to have fundamentally redesigned their workflows around AI (55% vs. 20% of peers), and only 39% of organizations overall report any EBIT impact attributable to AI.

What should be in a small firm's AI policy?
At minimum, three sentences per workflow: which tool gets used at which step, what data can't go into a public chat window, and what gets scrubbed before AI touches it. Thomson Reuters Institute's 2025 Generative AI in Professional Services report found that 52% of legal professionals surveyed had no GenAI usage policy and 64% had received no GenAI training, even as adoption nearly doubled year over year. A short, specific written rule puts a firm ahead of most of the field.

Is it safe to use an AI browser agent like Comet inside a professional firm?
Yes, with limits. A browser agent operates with your logins inside your live session, so confidential client portals, banking, payroll, and any system with regulated records need an explicit written data rule before the agent touches them. Treat agent access the way you'd treat browser access for a new associate. It works when the boundaries are written down. It causes problems when they aren't.

How do I measure whether an AI workflow is actually working?
Skip hours-saved figures, which are notoriously unreliable in the published research. Watch four things instead: does the workflow exist on paper, could someone else run it from the document, what specific errors has the review step caught in the last 30 days, and where did the first version break and how did you fix it. For recurring client communication, the single best metric is rework requests per month.Honestly, I went looking for an hours-saved number first too, and the spread across two weeks was so wide I stopped trusting it. Rework requests held still.

Next week's issue is the one-page AI policy itself, short enough to fit on a single sheet, specific enough to change behavior, and built so a non-technical partner can enforce it without a compliance department.

Coming soon: a standalone deep dive on the Three-Sentence Data Rule, including the common mistakes that leak client data through AI chat windows.

That's the pattern every Tuesday: a specific kind of firm, a workflow that's actually breaking, and a call you can make this week.

See you next week.

— Bob

The Small-Firm AI Playbook is published every Tuesday by ICBM Media, Inc. for owners and partners of 1–20 person professional services firms. Each issue covers the AI tools, workflows, and decisions that save your firm hours and dollars.