AI and Automation

What AI can actually do for a small or mid-size business in 2026

Updated 10 min readBy Sandeep Mahajan

A navy landscape of flat blocks with an orange sun on the horizon

For a small or mid-size business, AI in 2026 is not fraud models or self-driving trucks. It is five bounded jobs: answering questions from your own documents, drafting and summarising, pulling structured data out of e-mails and PDFs, producing marketing and product content with a reviewer, and automating one workflow with a person approving the result. Roughly one business in five in the United States and Canada reports using AI at all, and the gap between the largest and smallest firms is wide. The businesses that get value pick one job, measure it, and keep a human in the loop.

Key takeaways

  • US Census Bureau Business Trends and Outlook Survey data show overall AI use "hovered between 17% and 20%" from December 2025 to May 2026; "37% of firms with at least 250 employees" used it, against "less than 20% of firms with four or fewer employees".
  • Statistics Canada: 19.2% of businesses used AI to produce goods or deliver services in Q2 2026, up from 12.2% a year earlier and 6.1% in Q2 2024; 40.0% say AI is not relevant to the business. The top uses are data analytics (36.6%), text analytics (34.5%) and virtual agents or chatbots (28.2%).
  • The jobs that work are bounded, measurable and grounded in your own data. The ones that fail are open-ended ("use AI to grow sales") or unsupervised.
  • The risks are known and named: the OWASP Top 10 for LLM Applications (2025) covers prompt injection, sensitive information disclosure, misinformation and excessive agency; Canada's privacy regulators published nine generative-AI principles in December 2023.

The numbers, so you know where you stand

Survey Period Share of businesses using AI Notes
US Census Bureau, Business Trends and Outlook Survey Dec 2025 to May 2026 17% to 20% overall 37% for firms with 250+ employees; under 20% for firms with four or fewer. Question wording changed in Nov 2025 to AI use "in any business function", so older figures are not comparable
Statistics Canada, Canadian Survey on Business Conditions Q2 2026 (12 months prior) 19.2% 12.2% in Q2 2025, 6.1% in Q2 2024; 27.8% for businesses with 100+ employees, 19.9% for 1 to 4 employees; 40.0% say AI is not relevant

Two readings of this. First, you are not behind: four in five businesses are not using AI in any measured way, and adoption roughly tripled in Canada in two years mostly among the largest firms. Second, the most common uses are unglamorous: analytics, text handling and chatbots, which is what the rest of this article is about.

The 2022 version, revisited

The earlier version of this article listed cybersecurity, machine learning on sensor data, CRM, digital assistants and search as "what AI can do for business", with industry examples from transport to healthcare. It was written before general-purpose language models were a product anyone could buy for a few dollars a month, and it read like a tour of what large companies had built. What is different now is that the same capability is available to a 15-person company through an API or a SaaS feature, which makes the question "which job, exactly?" rather than "is AI relevant?".

Five jobs AI does well for a small business

Job What it looks like What it needs from you Main risk What drives the cost
1. Answer questions from your own documents A grounded assistant (RAG) over policies, manuals, product data or past proposals, for staff or customers Accurate, current source documents with an owner Confident wrong answers from stale content; disclosure of data the asker should not see Conversations per month and context per answer
2. Draft and summarise Meeting notes, first drafts of proposals and replies, summaries of long threads A person who edits and signs Fluent errors passed on unread Seats or tokens; small
3. Extract data from documents Invoices, résumés, enquiry e-mails, forms turned into fields in your systems Examples of correct output; a place to put the data Silent extraction errors Volume of documents
4. Content at scale, with review Product descriptions, attributes, translations, ad variants from your specifications A reviewer who knows the product; a style guide Scaled unreviewed content, which Google's spam policies treat as abuse when produced to manipulate rankings Items per month
5. One automated workflow with approval Lead qualification and CRM hygiene, order-exception triage, document intake routing, reporting A clear rule for when a person must approve; an audit log Excessive agency: an agent doing more than it should Integrations, not volume

Job 1 is the most common first project because it is bounded and measurable; our RAG buyer's guide covers it in depth, and the support-chatbot guide covers the customer-facing version. Job 5 is where the term "AI agent" belongs, and where guardrails matter most; the AI agents page explains the delivery model we use. Online stores have a sixth job, search and catalogue work, covered in AI in eCommerce.

What does not belong on the list for most businesses: training your own model, replacing a customer-facing team outright, or any project whose success cannot be measured against a number you already have.

A first AI project in 30 days

  1. Write down the one job, in a sentence that names the input, the output and who checks it. "Answer staff questions about our HR and IT policies from the intranet, with a link to the source, and log unanswered questions" is a project. "Use AI in HR" is not.
  2. Find the baseline number the job should move: tickets per week, hours per proposal, days to process an invoice, zero-result searches. If there is no number, pick a different job.
  3. Check the data. Is the source material accurate, current, in a format a machine can read, and allowed to be used for this? Most projects stall here, which is why our readiness audit starts with a data check rather than a tool choice. To see where you stand before talking to anyone, our free AI readiness assessment scores data and five other areas in about three minutes.
  4. Decide the human role. Who reviews every output (jobs 2, 3, 4), who approves actions (job 5), and who owns the content (job 1). Write the names down.
  5. Pick buy, configure or build. A SaaS feature you already pay for; a managed cloud service configured by an engineer; or a small custom build. Prefer the cheapest option that gives you the data boundary and the review step you decided on.
  6. Build a test set of 30 to 50 real examples with the correct answer, before building anything. Run it after every change.
  7. Run a two-week pilot with a small group. Read every output in week one; measure the baseline number in week two.
  8. Decide with the number, not the demo. Keep, widen or stop. Write a one-page note either way so the next project starts from evidence.

Rules that keep you out of trouble

  • Security. Treat anything the model reads (documents, e-mails, web pages) as untrusted input; the OWASP list calls the failure "prompt injection". Keep personal data out of indexes unless access is controlled. Give automated workflows the minimum permissions and an approval step ("excessive agency" is on the same list). Cap spend per day.
  • Privacy. In Canada, personal information handled by an AI feature is still PIPEDA personal information; the federal and provincial regulators' nine principles ("Legal Authority and Consent", "Appropriate Purposes", "Openness", "Accuracy", "Safeguards" among them) are the practical checklist. In India the DPDP Act applies. Read the vendor's terms on whether your data is used for training.
  • Disclosure. If a customer can talk to an AI system, say so. From 2 August 2026, Article 50 of the EU AI Act requires that people interacting with an AI system are informed of it unless obvious; if EU visitors can reach your bot, that applies to you.
  • Accountability. A British Columbia tribunal held Air Canada responsible for its chatbot's wrong answer in 2024, saying it "is responsible for all the information on its website". Review steps and grounded answers reduce the chance of this; nothing removes it.

What it costs

Three cost shapes, and we do not print prices here because they change monthly; the vendors' pricing pages are in the sources.

  • Per seat (assistants inside tools you already use): predictable, small, good for jobs 2 and 4.
  • Per usage (tokens, documents, resolved conversations): scales with volume, good for jobs 1, 3 and 5 at small scale; model the monthly figure from your baseline number before committing.
  • Build and integrate: engineering days for connecting the model to your systems. This is where the money goes for job 5, and it is driven by the number of systems, not the size of the model.

The recurring cost people forget is review and content ownership: a couple of hours a week, every week, or the system decays.

FAQ

What share of small businesses actually use AI?

About one in five. The US Census Bureau's survey shows 17% to 20% of businesses using AI between December 2025 and May 2026, with under 20% among firms with four or fewer employees. Statistics Canada reports 19.2% in Q2 2026, up from 6.1% two years earlier, and 40% say AI is not relevant to them.

What is the best first AI project for a small business?

An assistant that answers questions from your own documents, for staff or customers. It is bounded, cheap to run, measurable against ticket or query volume, and it forces the content clean-up that every later project needs. Build it with a fixed test set and a human hand-off.

Do I need my own AI model?

No. Hosted models from Amazon Bedrock, Anthropic, OpenAI, Google and others are accessed through an API, and your data is supplied at question time through retrieval rather than by training. Training or fine-tuning a model is rarely justified below enterprise scale.

How do I keep AI from making things up?

Ground it in your documents, require citations, tell it to refuse when nothing relevant is found, and test it against 30 to 50 questions with known answers after every change. Keep a person reviewing outputs that go to customers.

Is AI-generated content a risk for my website?

Only when it is published unreviewed at scale. Google's spam policies target scaled content produced primarily to manipulate rankings, and factual errors in product or service content damage trust. Use AI to draft from your own facts and have a person review and sign.

Impinge Solutions runs a one-week AI readiness audit that ranks your candidate use cases, reviews data and risk, and ends with a pilot recommendation and a cost range, and builds grounded assistants and agent workflows with a human in the loop. Book the scoping call.

Sources (9 links)
Share this article