To create an AI for your business, 1) pick a high‑value use case, 2) fix data access and quality, 3) choose buy/customise/build, 4) prototype with human‑in‑the‑loop, 5) harden security and governance (EU AI Act/ISO 42001/NIST AI RMF), 6) productionise with MLOps, and 7) monitor for drift, bias and ROI.

Why this matters in 2026

AI is mainstream, but value is uneven. Success now depends on governed delivery, not just clever prompts. This guide shows how to go from problem framing to a compliant, monitored AI in production—using tools your team already knows.

Phase 0 – Strategy & guardrails (week 0–2)

Decide where AI should not be used (safety, ethics, legal). Define your red lines up front.
Pick one outcome to prove: e.g., reduce email response time by 30%, cut document prep time by 40%, increase lead qualification accuracy by 15%.
Name an accountable owner (product lead) and a reviewer (risk/compliance).
Adopt a governance baseline: align to EU AI Act obligations relevant to your risk level, stand up an AI Management System (ISO/IEC 42001) and reference NIST AI RMF for risk controls.

Deliverables: one‑page AI policy, risk register, DPIA/AI impact assessment template, success metrics.

Phase 1 – Use‑case selection (week 1–2)

Score candidates on: business value, data availability, complexity, risk, and speed to value.
Great first patterns: inbox triage and drafting, document summarisation, support answer suggestions, spreadsheet clean‑up, knowledge search, meeting notes, contract clause extraction, forecasting with explainable features.

Avoid for pilots: safety‑critical medical/financial advice, autonomous actions without approvals, high PII exposure.

Phase 2 – Data readiness (week 2–4)

Inventory and access: list sources, owners, and sharing rules; move team IP to Shared Drives/data lake with proper labels.
Quality: fix duplicates, missing values, skew; write a data card (schema, lineage, refresh cadence).
Privacy & security: DLP policies, role‑based access, logging, key management.

Deliverables: data map, data card, access model, retention plan.

Phase 3 – Buy, customise or build (week 3–4)

Buy/customise when a SaaS or cloud service already fits 80% of needs (e.g., Workspace with Gemini, enterprise search, contact‑centre assist).
Build‑light (compose) using cloud platforms (e.g., Vertex AI/Model Garden, Databricks, Azure AI Studio) plus retrieval‑augmented generation (RAG) over your documents.
Build‑deep only when IP/latency/cost demands it (fine‑tuning, custom models, on‑prem inference).

Decision factors: latency, data sensitivity, cost per task, integration effort, vendor lock‑in, evaluation results.

Phase 4 – Prototype & evaluate (week 4–6)

Small, safe pilot with 10–50 users.
Human‑in‑the‑loop (HITL): require reviewer sign‑off before outputs go external.
Evaluation suite: task success rate, factuality, toxicity, bias, robustness to prompt injection.
Red‑team prompts and jailbreak attempts; document failure modes.
UX: include edit‑and‑explain controls, feedback buttons, and event logging.

Deliverables: evaluation report, decision log, go/no‑go.

Phase 5 – Production architecture (week 6–10)

Typical stack

• Front end: web/mobile or in‑tool sidebar (e.g., Gmail/Docs add‑ons).

• Orchestration: API gateway, rate limits, secrets manager, feature flags.

• Model layer: hosted foundation model (proprietary/open) with versioning; RAG over vector store; policy enforcement.

• Data layer: governed lakehouse; PII vault; audit logs.

• MLOps/LMMOps: CI/CD for prompts/config, dataset versioning, offline/online evals, canary releases.

Security & compliance

• Role‑based access; least privilege; private networking.

• Content filters and allow/deny lists; safe‑completion policies.

• Incident response runbook for model/API outages or harmful outputs.

Phase 6 – Governance & compliance (continuous)

Map obligations by risk level (minimal/limited/high‑risk).

• Keep a technical file: data sources, tests, metrics, human oversight steps.

• Run impact assessments before major changes.

• Stand up an AI Management System (ISO/IEC 42001) to operationalise policy.

• Use NIST AI RMF functions (Map–Measure–Manage–Govern) to structure risk controls.

• Track regional rules: EU AI Act timelines; UK guidance/assurance initiatives.

Deliverables: policy register, change log, audit trail.

Phase 7 – Operate & improve (post‑launch)

Monitor drift, latency, cost per task, user feedback, and safety incidents.
Retrain/refresh RAG indices and prompts on a schedule; re‑evaluate after any major update.
Measure ROI: time saved, error reduction, NPS/CSAT movement, revenue lift where applicable.
Scale: expand to new teams only after two consecutive months of stable metrics.

Roles & team model

• Product owner (accountable), Tech lead/architect, Data/ML engineer, Applied AI engineer, Evaluator/QA, Compliance & security, Change manager.
  Small firms can partner with a consultancy while upskilling internal champions.

Cost & timeline (typical ranges)

• Discovery & design: 2–4 weeks.

• Prototype: 2–6 weeks.

• Production hardening: 4–8 weeks.

• Run costs: model/API usage, vector DB, storage, monitoring, support.
  Costs vary by volume, latency, and security needs—start with a capped pilot and expand on proven value.

Templates

1) Use‑case scorecard: Value (H/M/L), Data readiness (H/M/L), Risk (H/M/L), Effort (H/M/L), Time‑to‑impact (H/M/L).
2) Evaluation metrics: exact match, instruction adherence, groundedness score, harmful content rate, bias tests, robustness checks, human‑edit rate.
3) Change log fields: date, change, reason, affected users, risk rating, reviewer, rollback.

FAQ

Is it better to buy, customise, or build?
Start with buy/customise if a platform covers most needs; build where IP, latency or cost require it.

What about compliance?
Adopt an AI management system (ISO/IEC 42001), use NIST AI RMF for risk controls, and map your obligations under the EU AI Act by risk class and timeline.

How do we keep data safe?
Use role‑based access, encryption, private networking, DLP, and human review for sensitive outputs. Avoid pasting restricted data into prompts unless policy allows.

How do we measure success?
Time saved, quality uplift, defect reduction, customer impact, and safe participation (incident rates trending down).

Can small teams do this?
Yes—start with a narrow use case, leverage cloud platforms, and enforce basic governance from day one.