When I talk about AI with a business owner, I usually hear one of two extremes. Either they say "what good would this do in our line of work," or half the team is already using ChatGPT but nobody knows who is doing what, with which files. The second situation is far more common. I also think it's the riskier one.
When people hear "AI transformation," most of them picture a big, expensive software project. In a small or mid-sized company, it almost never starts that way. In this post I'll explain what the transformation actually is, which task makes sense to start with, roughly how the process unfolds, and where you need to be careful with data.
The word I care about most in that definition is "planned." AI has already made its way into most companies. The problem isn't that it isn't being used. The problem is that it's being used where nobody can see it.
There's also this misconception: buying enterprise licenses for everyone counts as transformation. Accounts get opened, everyone tries it the first week, and a few months later only two or three people still open the tool regularly. This pattern is so common that one of my first questions when I talk to a company is now this: "How many people actually open the license every week?" The answer usually comes in lower than management's guess.
Probably more than you think, and more chaotically than you think. In Turkey, the Personal Data Protection Authority (KVKK, the body behind Turkey's Personal Data Protection Law) has a name for this in its February 2026 document on "Use of Generative AI Tools in the Workplace": shadow AI. That means employees using AI tools for work without the company's knowledge or approval. The authority announced the document on March 5, 2026 (in Turkish), and it contains an observation I liked. It says a total ban isn't realistic, and that a prohibitive approach pushes people to use the tools outside of any control.
I agree. In a company that bans AI, AI use doesn't stop. It moves to employees' phones.
That's why the first step is an inventory. Who is using which tool, for which task? Building this list is first-week work in an AI consulting engagement, but you can do it yourself too. Once you have the list, you can sort candidate tasks like this.
Drafting proposal text
Sales · a few times a week · has a template
Summarizing customer emails
Support · contains names and phone numbers
Extracting meeting notes
Management · unclear whose job it is
Inventory forecasting model
Data is in three separate Excel files and incomplete
Social media copy drafts
Marketing · one person uses it
Notice that the most exciting-looking idea on the list, inventory forecasting, landed at the very bottom. That's usually how it goes. Shiny ideas often lean on the company's messiest data.
Start with a task that repeats often and whose output someone can check in a few minutes. Even better if it doesn't involve customer data. What you want from the first project is for the team to say, "this actually works." Transforming the company is the job of the projects that come after.
A hard first project
A good first project
There are long lists online of "AI use cases for business." They're not bad for ideas, but the list shouldn't make the choice for you. In an accounting firm, classifying incoming documents might be a good start; on an e-commerce site, drafting product descriptions. The same idea might gain nothing at another company, because that task is only done once a month there.
You might be thinking, "there's no task in our industry that doesn't involve customer data." That may be true, especially in healthcare and law. Then the first project is either one where the data is stripped of names before it's used, or one that runs in a tool with its enterprise settings configured. You'll start a little slower. But you'll still start.
First see what's going on, then pick a small number of tasks, test them with measurement, and only roll out what works. You can follow the sequence below with a consultant or with your own team.
The first two months look roughly like this
Ask the team one question
"Which tasks do you use AI for, and with which tool?" The answers go into a single table. Nobody gets blamed, or else you won't get the real answer.
Find the annoying task
Set the tool list aside and write down the repetitive tasks the team complains about most. The candidate task comes from this list.
Write the metric up front
One metric per task. Something like time to prepare a proposal or number of incorrect invoices. Note today's value before the pilot.
Test with a small team
Two or three people do this task with AI for a few weeks. Sticking points are discussed in a short weekly check-in.
Let the data decide
The result is compared against the original metric and a continue or stop decision is made. Only after that is a rollout plan written.
There's no separate "training" step in the list, and that's on purpose. I find it better to deliver training inside the pilot. When you gather everyone in a room and give a generic ChatGPT training, people don't know how to use it in their own work the next day. When you show a salesperson using their own proposal file and an accountant using their own invoice, it sticks.
Don't skip the third step. Without a metric, you'll figure out whether the pilot succeeded by arguing about it in a meeting, and that argument is usually won by the loudest voice.
It can be. The answer depends on which data goes to which tool, and the tool's settings matter too.
In Turkey: the Generative AI and Personal Data Protection Guide (in 15 Questions) (in Turkish), published by the authority in November 2025, sets out the general framework. The workplace document I mentioned above is more practical. It recommends that companies adopt a written usage policy. That policy should state clearly which tools may be used and what information may be entered into them; how outputs are used and employee training also appear as separate headings in the document. It also specifically says to use general wording instead of identifying details like names and locations, and to be even more cautious with health and financial information.
Then there's the cross-border question. Most of the AI tools you use process data outside Turkey. Article 9 of Law No. 6698, which governs transfers of personal data abroad, changed on June 1, 2024; the authority's cross-border transfer page (in Turkish) explains the new rules. I won't say anything definitive about how it applies to your situation. I'm not a lawyer; this part is the job of your legal counsel.
In practice, the most useful rule is very simple. You don't upload a file containing customer names or health information to a tool whose settings you don't know. In most companies, even that much isn't written down today.
You'll see the first concrete result in a few weeks, but the transformation itself never really ends. The inventory, task selection and first pilot wrap up in about two months at most businesses. Rollout stretches over months depending on the size of the company.
The reason it never ends is that the tools change fast. Nobody knows today which tool your team will be using a year from now, and neither do I. That's why I don't build the roadmap on top of tools. When a tool changes, the plan shouldn't end up in the trash.
Write tasks into the roadmap and leave tools as a footnote. Tools change within a year; a slow process stays exactly where it is.
I'm going to say something a bit contrarian here. Everyone is talking about AI agents, meaning systems that run a task from start to finish on their own. I think that conversation is premature for most small and mid-sized companies. Handing a whole process over to an agent while half the team can't properly use a simple tool is like adding floors to a building with no foundation. Let the team learn to use the tools first, then automate.
The number of items you check in the list below will roughly show where you need to start. It works if you check honestly.
AI readiness check
0/8Check the items; at the end you'll see where you should start.
The item most often left unchecked is the third one. Almost every company has an unwritten assumption like "surely nobody would upload the customer list." An assumption isn't a rule until it's written down.
If you already know what you want to do, you don't need consulting; go straight to implementation. That may be an odd sentence coming from someone who sells consulting, but it's the truth.
If you want to turn a specific process, like invoicing or a weekly report, into a workflow that runs on its own, what you're looking for is AI automation. I explained how tools like n8n work and which tasks are worth automating in the automation guide. If your main load is customer questions coming in from WhatsApp and your website, setting up an AI chatbot is a better starting point.
Consulting makes sense when several teams are using AI in a scattered way and management wants to invest but doesn't know where to begin. Even more so if customer data is involved. At that point, AI consulting helps you set the order of the work and the rules.
They help the company decide which tasks to use AI for and under which rules. Concretely, they build the usage inventory, pick the first tasks, get the data rules written and run a pilot. What you're left with at the end is an actionable plan.
Most of the time, no. If you have a single, clear need, setting up an automation or a chatbot directly is more economical. Consulting helps when several people are using different tools without rules and customer data is involved.
It wouldn't be right to quote a fixed price, because the number of teams and pilots changes the work a lot. When you get a quote, make sure the consulting fee and tool subscriptions are listed separately. If it's all in one line item, you can't tell what you're paying for.
I wouldn't recommend it. KVKK's workplace document also says a prohibitive approach can increase uncontrolled use. Instead of a ban, a short written rule explaining which tool can be used with which information works much better.
I'm a little skeptical of anyone who says so with certainty. What I've seen is that in the first phase, what changes is the repetitive steps inside the job. The job itself usually stays. Nobody clearly knows today how roles will change in the long run.
Last updated: September 27, 2026. I update this guide as KVKK publishes new documents on AI.
When you train employees on AI, giving everyone the same seminar doesn't work. We cover three role-based levels, the modules, a time plan, data rules and how to measure whether the training worked.
AI projects often either never get started or get stuck in the pilot. Here is a 90-day plan split into three phases, discovery, pilot and rollout, with the deliverables you should have in hand at the end of each one.
According to Comscore's September 22, 2026 report, ChatGPT's share of AI assistant conversations fell from 70% to 50% in six months; the same day, Claude Opus 5.5 launched at a lower price. The risk of an AI setup tied to a single vendor, and what to do today.
We use cookies to improve the site and measure advertising performance. Analytics and advertising cookies run only if you accept them. Details are in our Privacy Policy and Data Protection Notice.
