AI audit for small business: ten days to know where to invest.

An AI audit, also called an AI readiness assessment, is a study of your business processes to find the tasks AI and automation can take on. It measures how long they take, checks that the data they need is accessible, then ranks the use cases by value and difficulty.

The term can be confusing. An AI process audit isn’t a financial audit, an audit of your visibility in answer engines like ChatGPT, or an “AI maturity” score on some abstract scale. It doesn’t judge your team: it looks for the repetitive work that keeps people from the work that adds value.

Its outcome should support a go/no-go decision, use case by use case: launch it, wait for a prerequisite, or drop it. An audit that ends without priorities hasn’t done its job.

At DigitalCX, the audit takes ten business days and runs in four phases.

• Immersion: short interviews with the people who do the work, two to four per department, at their screens. That’s where the real task shows up, with its exceptions and workarounds.
• Measurement: volume, duration, errors, and rework, based on your own numbers.
• Feasibility: data access, APIs and exports from your software, GDPR and EU AI Act points.
• Debrief: a one-hour meeting with leadership to walk through the matrix and choose.

On your side, you need one lead who opens doors, two to four point people available for a few hours, and whoever manages IT to grant access. No one needs AI skills: translating your tasks into use cases is my job, whether that means automating a business process or handing a task to an AI agent.

The core deliverable is a matrix of three to eight use cases, each scored on two axes: gain (time saved, errors avoided, responsiveness) and difficulty (data access, number of tools, variety of documents). High-gain, low-difficulty use cases are your quick wins: that’s where you start.

For each use case, you also get:

• the estimated time saved, calculated from your real volumes;
• the effort to go live, and what needs sorting out first;
• the recommended review mode: approval by a person at first, or fully automated once the task has proven itself;
• what to watch for in the data.

The roadmap puts these use cases in order over six to twelve months. It’s yours: you can hand it to anyone you like. If you continue with me, it becomes the basis for the prototype, built in five days on your data.

An audit isn’t always the right way in, and I’d rather say so on the very first call.

• You already know which task to automate, you know its volume, and it’s the only one at stake: a short scoping session is enough, and we get to the prototype faster.
• Your business has few repetitive tasks: if no one spends more than a few hours a week retyping, checking, or chasing, the return on investment will be low.
• Your data isn’t accessible: old software with no API and no export blocks almost everything. Better to fix that first, for example with an API integration.
• You’re after legal compliance: the audit flags GDPR and EU AI Act points, but a lawyer or a data protection officer makes the call.

In those cases, I’ll tell you straight. An unnecessary audit costs more than its fee: it erodes trust in everything that follows.

The price of an AI audit depends on how many departments and tools it covers. At DigitalCX, it’s set in writing from the start, and the fee is credited toward the prototype if you continue. So you never pay twice to study your use case.

On the funding side, Bpifrance, France’s public investment bank, offers a program for small and midsize companies, the Diag Data IA, run by experts it has approved and partly paid for by the French government. I’m not one of those experts. The two don’t compete: if you already have a Diag Data IA, it’s a starting point, and I build the use cases it selected. For eligibility and how much is covered, check directly with Bpifrance.

Either way, ask up front what the deliverable includes: a scored matrix and a roadmap, not just a list of findings.

The two overlap, but they’re not the same thing. An AI audit of your processes looks for where AI can save you time. An EU AI Act compliance audit checks that the AI systems you use or provide meet the European regulation: risk classification, documentation, transparency.

For most small business uses (reading orders, preparing quotes, summarizing emails), the obligations are light. One rule has applied since August 2, 2026, though: a tool that talks with the public, like a chatbot or an AI voice agent, must disclose that it’s an AI, at the latest at the first exchange.

So for each use case, the audit flags what to watch: personal data processed, informing customers, planned human review. It doesn’t replace a lawyer’s opinion when a use case touches a sensitive decision, like hiring or credit.