Choose Where Automation and AI Can Help Your Business

Start with the work your people need to do. The best next step might be clearer instructions, a feature you already own, a connection between systems, AI assistance, or an agent with a narrow task.

Our IT Operating Model describes enabling IT functions. The IT Automation & AI Opportunity Map helps identify work worth examining. Its colors show illustrative automation potential, not a requirement to use AI, measured readiness, or expected savings.

Start by simplifying the process and checking tools already owned. Use rules for clear, repeatable steps; consider AI assistance for interpretation, and an agent only when a bounded sequence needs one. A high score does not mean every step needs AI.

Business work crosses IT functions and departments: hiring someone, paying a supplier, resolving a recurring issue, serving a customer, or launching a service. Follow the whole flow, including its handoffs and exceptions.

Start with one process

1. Choose one concern. Describe who is affected and what a better result would look like.
2. Examine real cases and exceptions. Ask the people doing the work where they wait, repeat steps, correct errors, or copy information between systems.
3. Sketch the flow. Record the trigger, inputs, decisions, handoffs, systems, expected output, and accountable owner. A simple SIPOC records suppliers, inputs, process, outputs, and customers.
4. Establish a small baseline. Measure elapsed time, staff effort, quality, rework, and cost. Record gaps and assumptions instead of inventing a score.
5. Compare the options. Remove unnecessary steps first. Then compare existing features, integration, rules, AI assistance, agents, and a manual approach. Check what the process is ready to support.
6. Test and decide. Agree acceptance criteria, safeguards, owners, and a fallback. Use the evidence to improve, expand, defer, or stop.

This follows Identify, Own, Measure, Improve, Automate. Ownership continues throughout. A company does not need to document everything before improving one bounded process.

Choose the right kind of help

• Use rules for known steps: route an approved request, check a required field, send a reminder, or provision an approved role.
• Use AI assistance for interpretation: summarize a document, suggest a category, find related issues, or draft material for review.
• Consider an agent for a bounded sequence: give it an approved purpose, tools, data, destinations, and stopping conditions. Its permissions must be enforced outside the prompt.
• Keep accountable decisions with people: define approvals for consequential actions, exceptions, spending, and risk acceptance.

See employee lifecycle and recurring-issue examples. They show possible designs and measures, not client results.

Agree risk limits before choosing a location

Leadership and the business owner should agree which consequences the organization will accept while pursuing the benefit. Legal, contractual, and professional requirements remain requirements. A high estimated saving cannot cancel an unacceptable exposure.

• Information: what is needed, how sensitive it is, and which uses and recipients are permitted.
• Authority: whether AI may summarize, draft, recommend, or perform a specific approved action.
• Consequences: what a wrong answer, disclosure, delay, outage, or unwanted change could cause.
• Limits and evidence: acceptable quality, spend, access duration, review, recovery, and the events that require a stop or escalation.

Classify sensitivity separately from location. On-premises and cloud describe where processing happens; they do not tell you whether the information is public, internal, confidential, or regulated.

Compare existing tools, cloud, local, and hybrid designs

A local agent can still call a cloud model or remote connector. A sandbox limits what the agent can access; it does not determine where every part of the workflow runs. Verify the actual data route.

Removing identifiers or replacing them with labels can reduce exposure. It does not automatically make data anonymous or authorize cloud sharing. Keep any mapping key outside the AI's reach. Check the remaining context, retrieved originals, and the destination after restoring original values.

Review every connection

Record who or what connects, its owner and effective permissions, the source device or host, approved networks and regions, access duration, allowed actions, output destinations, and reviewable activity. Include workstations, servers, gateways, connectors, and delivery runners.

People and agents need the same control goals, with mechanisms appropriate to their identity type. Do not assume that a human sign-in rule also covers a service account, managed identity, or existing database session.

Compare total cost on the same basis

Use the same workload, quality target, availability, data-handling rules, and time period for every option. Include the current process as a baseline. Compare doing less work, using features already paid for, rules, AI assistance, and agents before choosing where a model runs.

Keep two cost views: future cash spending, and the full cost of delivering the service, including staff effort and shared resources. Show how shared costs are allocated. Use one consistent cost basis; do not count both purchase cost and depreciation for the same asset. Money already spent is not a new saving; existing equipment and licenses still need capacity, support, and eventual renewal or replacement.

For a simple 36-month estimate: add one-time setup and transition, 36 months of running costs, planned upgrades, and exit or retirement costs. Record each assumption, its source, and its owner. Finance can add tax, inflation, funding, and discounting where material. Test low, expected, and high demand, review effort, and support cost.

• Start-up: discovery, data preparation, integration, configuration, testing, training, and running old and new services during transition.
• Running: licenses or compute, storage, networks, people, monitoring, review, corrections, maintenance, and provider support.
• Controls and protections: classification, identity and access, endpoint or host security, containment, network limits, protected logs, test data, recovery tests, incident response, and access removal. Budget the work to operate and retest them.
• Change and exit: hardware or model refresh, policy and compatibility changes, data export, retained records, contract commitments, and secure disposal.

Track cost per accepted, useful result as well as the total. Count failed attempts, retries, human review, corrections, and ongoing support in the cost. Keep minimum quality and safety requirements in place even when a cheaper option looks attractive.

A fictional cost comparison

These are invented USD planning inputs, not product prices, benchmarks, quotes, or expected client results. Assume each option meets the same requirements and delivers 1,000 accepted results a month. The monthly amounts include assigned staff time, review, support, and required controls. Setup includes any assumed hardware, transition, and exit allowances. No additional refresh is assumed within this example; add one when needed. This is an undiscounted cost illustration.

The calculation is setup plus 36 times the monthly amount. Reusing existing features has the lowest total only under these made-up assumptions. Test real usage, quality, costs, and control needs before ranking actual options. A design that cannot meet required safeguards is not an eligible low-cost alternative.

Assign the budget, controls, and remaining risk

Risk appetite means the type and amount of risk leadership is willing to take to pursue an outcome. Turn it into practical limits: permitted data and regions, allowed actions, maximum spend and outage, required review, and events that stop the work. Required legal and contractual duties still apply.

• Business and budget owner: owns the outcome, funds the full service and its controls, and validates the benefit with finance.
• Data owner: approves the information, recipients, location, retention, and permitted AI use within their authority.
• Service and control owners: operate the platform and each protection, with time, funding, evidence, and escalation. Assign duties explicitly across internal teams and providers.
• Authorized risk owner: decides whether the risk remaining after controls is within approved limits. Record the decision, evidence, conditions, review date, and stop triggers. Escalate decisions beyond that person's authority.

Buying a cloud service or assigning a task to IT does not remove the organization's accountability. Record uncertain failure or incident exposure separately from the operating-cost estimate. Use ranges and stated assumptions when quantifying it; do not present a possible loss as guaranteed savings or use a dollar score to override a required safeguard.

Test before broader use

Use a separate test environment with synthetic or otherwise approved test data, distinct credentials, and controlled destinations. Do not copy live sensitive information into development by default.

• Test normal work, exceptions, incorrect inputs, and malicious instructions.
• Verify denied reads, writes, tools, and transfers as well as successful work.
• Check quality, review effort, cost, time limits, stop procedures, and recovery.
• Record sources, versions, actions, approvals, outputs, errors, and policy decisions. Protect and minimize those records.
• Recheck when models, tools, connectors, policies, or requirements change.

A model's explanation can help a reviewer, but it is not a verified account of its internal reasoning or a substitute for execution records.

Measure the useful result

Compare cost per accepted, useful result, including preparation, licenses or compute, review, correction, and ongoing support. Check service quality and the whole process, so a faster step does not create work elsewhere.

Distinguish cash saved, staff capacity released for other priorities, and estimated cost avoidance. Agree targets from the organization's baseline. Benchmarks can inform a later discussion when their source, scope, date, and limitations are clear; they are not proof of your likely result.

Keep the benefits separate: cash savings are spending actually reduced; released capacity is staff time available for another priority; cost avoidance is a credible future expense prevented or deferred. Record the baseline, timing, assumptions, and owner for each. Do not count the same benefit twice.

For example, unassigning a license may release capacity within a subscription without reducing the bill. Count a cash saving only when the contract and billing actually change. A possible avoided incident is uncertain risk reduction, not money already saved.

For detailed safeguards, read governing AI access to mail and data. For an existing data-platform example, read SQL Server modernization and secure delivery.

Apply this to your organization: explore a process-focused Readiness Review. We agree scope, outputs, responsibilities, completion dates, and fee before work begins.

Cost-planning references

Method references checked October 22, 2026: Microsoft guidance on estimating the full environment cost and FinOps Foundation guidance on unit economics. The worked amounts above are our fictional illustration, not figures from these sources.