Contents10
- 01Should you start with a tool or a task?
- 02Where does your data go when you use AI?
- 03How do you choose the right AI model?
- 04How much does AI cost, and how do you avoid a surprise bill?
- 05How do you connect AI to your documents and your tools?
- 06What rules should you set before deploying AI?
- 07What place should you keep for people?
- 08What we offer, and what we can prove
- 09Your plan in five steps
- 10Frequently asked questions
A salesperson pastes a contract into a consumer AI assistant to summarise it. In support, a colleague translates incoming emails with a tool found online. An in-house script calls an AI API with a key copied into its code. Everyone saves time, and nobody knows where the documents went, what it all costs or what it brings in. This is often how AI enters a company: through usage, before any decision.
It does not arrive at the same pace everywhere. In 2025, Eurostat measured its use by size of company in the European Union:
of small companies used AI
of large companies
Also according to Eurostat, companies that considered AI without adopting it cite a lack of expertise first.
This guide opens our Business AI: private and at the right cost section. It is for teams of 20 to 500 people who want to move from scattered uses to AI they have chosen: five questions, in the order they come up, each pointing to the article that covers it in detail. If you would rather first find out what AI costs you, our “AI at the right cost” pack runs each task on whatever does it at the best price, with a meter and caps.
In short
Start from a precise task, measured before and after, never from a tool.
Classify your data before choosing where it goes: public, internal, personal or regulated.
Choose the model task by task, on your own examples: the cheapest one that does the job well.
Cost is controlled at the design stage: routing, caching, batch processing, budgets and caps.
Write the rules and train the team: as a general rule, the company is answerable for how its staff use AI.
Should you start with a tool or a task?
With a task. In its questions and answers on generative AI, the CNIL (France’s data protection authority) recommends “starting from concrete needs to choose the most suitable system”. The studies we have gathered on AI’s return on investment, which is slow to arrive, say the same thing in another way: the gains measured relate to precise tasks (answering a customer, writing a text, producing an analysis), never to an “AI project”.
A good first task comes up often, follows roughly the same path every time, can be measured (time spent, errors, turnaround) and does no serious harm when it fails: sorting incoming requests, preparing a reply that someone reviews, extracting the fields of an invoice. Measure it before you touch anything, then measure it again three months later: without a starting point, nobody will know whether the tool pays off.
Some of these tasks need no AI at all. See when automation without AI is enough before paying for a model to make a decision that a rule can make.
To see where your company stands, our digital maturity test gives you, in fifteen questions, a score out of 100 and the three projects to tackle first. When the stakes justify it, our digital and AI maturity audit goes further: your processes, your tools and what integrates with the rest, the obstacles and the team’s appetite, the useful training, then what is worth doing, project by project.
Where does your data go when you use AI?
Every text sent to a model goes somewhere. We distinguish four levels of control over a private AI: a provider on its standard terms, a provider bound by contract, a server rented in Europe, a machine on your own premises. The higher the level, the more control you have, and the more of the running falls to you.
Watch out
The CNIL points out that with a model used through an API, “control of the system is then almost exclusively in the provider’s hands”. It also recommends “never sharing confidential information”, such as personal data or company data, when using a consumer service.
The right level is therefore chosen by type of data, not once and for all:
- Public data (a product sheet, an article already online): any level will do, at the best price.
- Internal, non-personal data (a procedure, a report): at least a provider that commits by contract not to keep your data or use it to train its models.
- Personal or regulated data (HR, health, legal, named customers): a model you control, or a European provider bound by contract; never a consumer offering.
This framework is ours, not a standard. For our part, we run Ollama, software that runs open models, on a rented server that we operate ourselves, for tasks where the data must not leave: those requests go to no model provider.
That leaves the question of keys: an agent that calls ten services carries ten sets of credentials. A secrets vault keeps them in one place, and your tools use them without ever reading them.
How do you choose the right AI model?
There is no best model in absolute terms. Providers release new ones all the time, each with a score published at launch. These scores show a trend, but they measure someone else’s questions.
What separates two models is a test on your own tasks:
- The criteria
What success means, in writing.
- The examples
About twenty real cases, difficult ones included.
- The candidates
Several models compared on these examples.
- The cost
That of each usable answer.
The method is detailed step by step in evaluating an AI model before putting it into production. That test tells you whether a smaller, and therefore cheaper, model is enough for your task.
Not every task needs a model that writes. To sort, score or check, decision models answer a closed question in under a second, with a probability. And using the smallest model that is enough is also the first lever on how much energy and water AI consumes.
How much does AI cost, and how do you avoid a surprise bill?
Through an API, AI is paid for in tokens, fragments of words, and output costs more than input. The bill depends mainly on three choices, detailed in what AI costs a business: tokens, routing and forecasting.
- Routing. Each task goes to whatever is enough: a rule first, then a small model, the most powerful last. A written table says which model for which task, with a fallback model if the first goes down.
- Caching and batches. At Anthropic, for example, re-reading a prompt that is already cached costs a tenth of the normal input price (the first caching costs a little more), and batch processing, when the answer can wait, is billed at half price.
- Forecasting. Each use gets a budget, caps and alerts, agents included: a runaway loop shows up the same day, not at the end of the month.
Choosing between providers can weigh heavily.
From the field
On the translation pipeline we operate for Palmora Property, a six-language property portal we work with, switching from DeepL to Gemini cut the cost by a factor of 60, and 95% of segments now come from the cache without calling the AI again. That ratio applies to that pipeline only: it shows how large a trade-off can be, not what you will save.
Conditions move too. At the end of September 2026, OpenAI launched a more expensive Pro plan, and the one that had been the most expensive until then kept its price, with half as much usage included. An architecture that lets you change models based on measurements is better than a commitment to a single provider.
How do you connect AI to your documents and your tools?
A model on its own knows neither your procedures nor your files. RAG in business connects it to your documents, and everyone queries only what they are entitled to read:
The path of a question
- The question
Asked by someone on the team.
- The permissions
Filtered before the model sees a document.
- The relevant passages
The model reads them, for each question.
- The answer
It cites its source.
When the task requires chaining steps that cannot be planned in advance, you move on to an agent. An AI agent lets the model decide the steps and the tools, whereas a workflow always follows the same path, which is more predictable and cheaper for a repetitive task. An agent works in a loop: it gathers context, acts, checks its result and starts again until it reaches the goal, with guardrails and human review before any action that commits you.
We run two of these set-ups for this site. A content loop prepares draft articles every morning and never publishes: a human reviews before anything goes live, and this guide was prepared that way. Our SEO engine reads Search Console every day and runs its technical checks every week, on a sample.
Going from a demo to an agent that works alone takes more: an agent in production has an owner, a written scope, a budget per task, a starting measurement and a log of its actions. And isolation is not a detail: in July 2026, OpenAI agents tested without guardrails attacked Hugging Face; their test environment was poorly isolated, and the alerts were ignored.
What rules should you set before deploying AI?
Three jobs to do before opening AI up to the whole team.
A short policy. The CNIL recommends governing generative AI with “internal policies or charters, clearly defining authorised and prohibited uses”, and it gives mandatory training before these tools are used as an example. Above all, it points out who answers for it:
In the general case, it is the user organisation that will be held legally liable in the event of misuse of AI by its staff.
Permissions by department. An AI that reads everything it is given also reads what it should not. AI governance in business sets out a common foundation open to all, one knowledge base per department entrusted to a named owner, agents with minimal permissions, a log and a regular review of permissions.
The legal framework. An SME that uses AI is generally a “deployer” under the AI Act: it must take measures so that its teams are AI-literate, and since 2 August 2026, a chatbot must identify itself as such, unless that is obvious. The GDPR applies as soon as personal data goes to a model. The details are in the AI Act and the GDPR: what an SME that uses AI must do.
What place should you keep for people?
The human role alongside AI is shifting from production to judgement: AI helps a lot on some tasks and degrades the work on neighbouring ones, and knowing which side you are on becomes a skill. There is also a specific risk to learning: a controlled experiment shows that handing AI the task you need to learn gives worse results once the tool is taken away, as we describe in does AI make us dumber?. So choose, task by task, what to delegate and what teaches the job.
What we offer, and what we can prove
Each question in this guide matches a job we do: choosing the projects with the digital and AI maturity audit, paying for AI what it is worth with the “AI at the right cost” pack, answering from your documents thanks to an AI assistant that cites its sources without your data leaving your server, and keeping hold of your keys with the AI vault.
What we can prove comes down to three examples: the Palmora Property translation pipeline, mentioned above; our own server, which runs a dozen services, including the Twenty CRM (in production with us since early 2025, and we contribute to the project), n8n, Matomo and Ollama; and the two loops that keep this site running. We draw no gain figure from them that we have not measured.
Your plan in five steps
- The inventory
List the AI uses already in place and the data they touch. Often, they exist without anyone having decided on them.
- The task
Choose one that is frequent and measurable, and note its starting figure.
- The data
Classify the data the task touches, and work out from that where it can go.
- The model
Test two or three on about twenty real examples, and keep the cheapest one that does the job well.
- The framework
Set the budget, the caps, the rules and the training. Three months later, measure again.
To take this path with us, start with the “AI at the right cost” pack, or with our digital maturity test if you do not yet know where to begin.
Frequently asked questions
Should we ban ChatGPT until we have decided?
A ban does not say what to use instead. A short policy is better: the approved tools, the data that never goes into them, who signs off on a new use. The CNIL recommends exactly that: a policy that defines authorised and prohibited uses, and training for users. Once the policy is in place, existing uses become visible and can be compared.
Does an SME need a private AI?
Not for everything. The level of control is chosen task by task, according to the data involved: a public text can go to the cheapest provider, while personal or regulated data calls for a model you control or a European provider bound by contract. That is what we do ourselves, with a written framework that says what can go to whom.
How much does AI cost a business?
Through an API, it is paid for by use, in tokens, and output costs more than input. The amount depends on volume, the length of the exchanges and the model chosen for each task. Three levers reduce it: routing to the model that is enough, the discounts for caching and batches, and caps per use. Our article on the cost of AI shows how to forecast it with a table.
Assistant, agent or automation: which should you choose?
It depends on the task. A repetitive task with a known path belongs to a workflow, with or without AI. A question about your documents belongs to an assistant that cites its sources. An agent is justified when the number of steps cannot be predicted, with minimal permissions, a budget and human review before any action that commits you.
Sources
- Eurostat (new tab)ec.europa.eu
- Its questions and answers on generative AI (new tab)cnil.fr
- Re-reading a prompt that is already cached (new tab)platform.claude.com
Jim · founder of Brain Plus AI
Also in business ai

Choose and price9 min
Private AI in business: the four levels of control
A "private" AI is not a product, it is a degree of control over your data. We distinguish four levels, from an API used as is to a model installed on your premises, and a simple way to choose task by task.

Practical guide10 min
The cost of AI in business: tokens, routing and forecasting
What you really pay when you use an AI through an API: input and output tokens, the context sent back with every call, an agent's turns. And a method to forecast the bill before you receive it.

Practical guide12 min
Enterprise AI governance: who can access what
An AI assistant reads whatever your access rights let it read, sharing mistakes included. Here is how to split your knowledge bases by department, keep a common core and decide who writes to the shared memory.
