An automation strategy is a short written answer to 4 questions: which jobs we automate first, how we’ll measure each one, who approves what, and how we add the next one. For a 10 to 200 person company it fits on 2 pages.
It’s worth writing because the 2025 and 2026 data say most companies skip it, pilot things without measuring them, and switch them off after the first incident. Here’s how to build one that survives contact with a Tuesday afternoon.
Why a company your size needs one
Big companies are pulling ahead on automation, and the gap is organizational.
McKinsey’s State of AI survey (1,719 respondents, fielded May to June 2026) found 40% of organizations over $1 billion in revenue were scaling AI agents, up from 27% a year earlier, while smaller organizations stayed flat at 22%. Across all sizes, 80% of respondents said AI improved their personal productivity, but only 37% could attribute any EBIT impact to it, and about 1 in 5 said operating costs were already constraining use. The 6% McKinsey calls high performers share one habit: they redesign the workflow around the automation. Everyone else bolts AI onto the old process and wonders why the P&L doesn’t move.
MIT’s NANDA group reached a similar place from the other direction. Its GenAI Divide report (July 2025; 300 public initiatives, 52 organizations interviewed, 153 leaders surveyed) found that of companies evaluating custom AI tools, 60% looked, 20% piloted and 5% reached production. Budgets skewed to sales and marketing, “but back-office automation often yields better ROI.” External partnerships reached production at twice the rate of internal builds.
And Gartner predicted in June 2025 that over 40% of agentic AI projects will be canceled by the end of 2027, for 3 reasons that a strategy exists to prevent: escalating costs, unclear business value and inadequate risk controls.
So the strategy has 4 parts, one per failure mode: pick jobs with value, measure them, govern cost and risk, scale deliberately.
Step 1: Pick the jobs
Score every candidate on 4 things and automate the top 3 only.
Volume. A job done 300 times a week is worth automating; a job done twice a month almost never is, however annoying.
Repetition. The same shape of input and output each time. Order-status emails qualify. Investor updates don’t.
Reachable data. Can software get at the inputs through an API, an export or a connector? If the inputs live in people’s heads or in photos of paper, extraction comes first and the job drops down the list.
Cost of a wrong answer. A wrong product description costs an edit. A wrong refund costs money and a customer. High-cost jobs can still be automated, but only with a human approval step, which changes the economics.
What do businesses actually automate once they’ve got past the demos? Anthropic’s Economic Index (September 2025) found 77% of API traffic showed automation patterns; computer and mathematical tasks were about 44% of it, office and administrative tasks about 10%, marketing materials 4.7%. MIT NANDA’s interviews found 70% of people prefer AI for drafting emails and 65% for basic analysis, while for complex or long-term work “humans dominate by 9-to-1 margins.” In small-company terms: inbox triage, order-status replies, product copy, daily reporting and inbound sorting are the proven jobs. Strategy and judgment stay with people.
Our ladder of the types of automation helps match each job to the cheapest tool that handles it. A surprising share of the top 3 need only a rule.
Step 2: Measure before and after
Write the baseline before anything is installed. For each job: how many per week, minutes per unit, who does it, error rate if you know it, and what “good” looks like in one sentence.
Then set 3 numbers for the automation: output volume, share of outputs accepted without edits, and cost per run. Review them weekly for the first month.
Measure outputs, because people’s feelings about AI are unreliable in both directions. METR’s July 2025 study had 16 experienced developers complete 246 real tasks; with AI tools they finished 19% slower, yet believed afterwards they’d been 20% faster. Gallup’s May 2026 indicator shows 52% of US employees now use AI at work at least a few times a year, and only 15% daily; usage figures tell you about adoption, and nothing about value.
Cost per run is the number small companies forget. Model prices are public: OpenAI’s API pricing (October 2026) lists gpt-5.4-mini at $0.75 per million input tokens and $4.50 per million output, which makes a drafted email cost well under a cent. But an agent that loops through 20 tool calls with 30,000 tokens of context each burns 600,000 tokens per run. Log tokens from day 1 so you see it before finance does.
The questions in our AI implementation checklist cover the measurement setup in more detail, including the test set you should build before the agent.
Step 3: Govern it: approvals, access, cost, law
This is the part Gartner’s “inadequate risk controls” refers to, and it’s 4 decisions.
Approvals. List every action an automation can take and mark the ones that send, pay, refund, delete or publish. Those get a human click until the automation has a track record. OWASP’s prompt injection guidance (2025) names “require human approval for high-risk actions” as a core control because an agent reading emails or web pages can be hijacked by text in them, and no filter catches everything.
Access. Give each automation the narrowest key that does the job. The MCP security best practices recommend starting with a minimal scope and stepping up permissions only when a privileged action is attempted. A read-only key on the order system is enough for drafting replies.
Cost. A monthly ceiling per automation, an alert at 80%, and a cap on steps per run for anything agentic. Anthropic’s own agent guide recommends the simplest solution that works and warns that agents trade cost and latency for flexibility.
Law. If you’re in the EU, the AI Act has applied in general since 2 August 2026, and the AI literacy duty for anyone deploying AI at work since 2 February 2025. The high-risk rules (hiring, education, biometrics) apply from 2 December 2027 after the AI Omnibus. In the US, NIST’s AI Risk Management Framework is voluntary and its 4 functions (govern, map, measure, manage) make a decent 1-page policy for a small company.
Write these 4 decisions down and the strategy is most of the way done.
Step 4: Scale one job at a time
Add the second automation only after the first has run for 30 days and cleared its numbers. Then the third.
Two findings explain why the sequencing matters more than the tooling. Microsoft’s 2026 Work Trend Index (20,000 workers in 10 countries) found organizational factors such as culture, manager support and talent practices accounted for 67% of reported AI impact, against 32% for individual mindset. Gallup found employees whose manager strongly supports their team’s use of AI are 1.7x as likely to use it a few times a week or more.
For a small company that means: the owner of each automation is a named manager, the team sees the before-and-after numbers, and the workflow around the automation gets redesigned around it. McKinsey’s high performers do exactly that, and they’re 6% of respondents because it’s work.
A realistic 12-month shape for a 40-person ecommerce brand: month 1, built-in rules and one workflow tool (Zapier’s free plan covers 100 tasks a month with 2-step Zaps); months 2 to 3, the inbox job with an AI drafting step and human approval; months 4 to 6, daily reporting and reviews; months 7 to 12, product copy, inbound sorting and a payments watch, each one measured against its own baseline. Our guide to AI vs automation helps decide at each step whether the job needs a rule, a model or an agent.
The 2-page template
Page 1: the 3 jobs, each with baseline numbers, the tool or agent, the owner, the 3 success metrics and the kill criterion (the number that stops it).
Page 2: the approval list, the access list, the monthly cost ceiling per automation, the legal note, and the order in which jobs 4 to 10 come next.
Review it quarterly. Delete anything that hasn’t cleared its numbers. The strategy’s value is in what it stops you doing as much as what it starts.
Where AutomationHero fits
We do steps 1 to 3 with you and install the result. Our done-for-you agents for ecommerce and SaaS teams go in during one session, scoped to one job each, with the approval step built in: you approve anything that sends, refunds or publishes, and the monthly fee covers keeping them running.
For the back-office jobs the data keeps pointing to, the inbound desk sorts and prices partnership and sales email and drafts replies, and payments watch flags failed payments, chargebacks and payout blocks before they become a month-end surprise. The full list is in the agent catalog.
FAQ
What is an automation strategy?
A short written plan covering which jobs you automate first, how you’ll measure each one, who approves which actions, and how you add the next one. For a 10 to 200 person company it’s 2 pages, reviewed quarterly.
What are the benefits of an automation strategy?
It stops the 3 failure modes Gartner expects to cancel over 40% of agentic AI projects by 2027: runaway cost, unclear value and weak risk controls. In practice it means every automation has a baseline, an owner, an approval list and a kill criterion, so you know within 30 days whether it’s earning its keep.
Which processes should a small company automate first?
The ones with high volume, repetitive inputs, reachable data and a low cost of error: inbox triage, order-status replies, daily reporting, product descriptions and inbound email sorting. Jobs where a wrong action costs money (refunds, payments) come later and keep a human approval step.
How do I measure automation ROI?
Baseline the job before installing anything (units per week, minutes per unit, error rate), then track output volume, share accepted without edits and cost per run. Compare monthly. Ignore self-reported time savings; METR’s 2025 study found developers who were measurably slower with AI still believed they were faster.