An AI Workflow Design,
in full.
Not consultancy to redo every time, but a reusable playbook. This is the Customer support department example, open and free: what to really automate, with which tools, in which phases and — the most delicate point — with which controls when it's AI answering the customer and the liability stays yours. The exact shape of what we graft into your business.
What to really automate
The pattern of what works: high-volume, repetitive first-level contact. AI takes on standard requests — where they repeat and the bottleneck is the hours, not the judgement — and leaves the nuanced cases and complaints to the agent, where a person is needed. Deflection is the most-adopted function, but it's also the one that carries the tightest control on liability (see governance, below).
- First-level deflection (chatbot/agent) al posto di: The human front line on repetitive requests
- Ticket triage and routing al posto di: Manual queue sorting
- Agent-assist / copilot for agents al posto di: Manual search for notes and scripts during the conversation
- Automated replies from the knowledge base al posto di: Manual search in the KB
- Sentiment analysis for escalation al posto di: Manual QA sampling of calls and tickets
Mature deflection programmes absorb on average about 41% of first-level contacts, up to nearly 59% in the best quartile; simple intents like password reset and order status go beyond 70%, while nuanced complaints rarely go past 25%. These are self-reported aggregate figures from vendors and analysts, not independently verified: read them as direction, not a promise of results. The number that matters for an SME is a different one — deflection doesn't zero out human support, it frees the hours that today go into repetitive questions.
Two models, not a shopping list
The 2026 support-AI market splits into two models useful to an SME. The right choice depends on where your tickets and knowledge base sit, not on the most-cited tool. The enterprise suites (like ServiceNow or Service Cloud) remain a reference ceiling, not a starting point for an SME.
Vertical helpdesk with built-in AI
A dedicated support platform (like Freshdesk, Intercom Fin or Zendesk) that brings AI into the ticket flow — deflection, triage, agent-assist — anchoring answers to your knowledge base. It's the right cut for the SME tier precisely because source grounding, the control that keeps hallucinations away, is native to the platform, not an add-on to build.
Horizontal copilot on the suite
An assistant (like Google Workspace with Gemini or Microsoft 365 Copilot) that speeds up reply drafts and internal search inside the tools you already use. If you're already on Workspace it's often the cheapest AI entry point; it stays a horizontal assistant, though, it doesn't handle the ticket queue on its own nor guarantee grounding to the public KB.
Our default choice for an SME is to start from the vertical helpdesk when you have real ticket volume and a knowledge base to anchor answers to — that's where the grounding architecture, the real risk control, arrives already assembled. The horizontal copilot is the lighter entry if you're already on that ecosystem and you need internal agent-assist first. Picking the exact vendor, the due diligence on its data-processing terms and on how it anchors answers are part of the graft.
The phases of the graft
Every item in the playbook carries a phase, so halfway through you filter by "what comes next" instead of re-reading the pilots you've already closed. In support the order isn't negotiable: you start from the high-deflection, low-risk intent, already grounded to sources, and widen only where grounding and escalation hold up.
-
1
Pilot
First 30 daysA single intent — usually the high-deflection, low-risk one: password reset, order status, a recurring FAQ — with answers grounded to the knowledge base from day one, not made up on the fly. A named owner, the usage policy written, escalation to an agent always one click away, and the metrics (deflection, CSAT, escalation rate) instrumented before you start.
-
2
Scale
First 90 daysWhat worked extends to more intents and to agent-assist for the agents (the copilot that pulls the answer while they talk to the customer). Deflection widens only where source grounding and the escalation path have already proven they hold: nuanced complaints stay with the human, they aren't forced into the bot.
-
3
Ongoing
Steady stateContinuous monitoring of deflection, CSAT and — above all — hallucination and escalation rate, with periodic review of vendors and risks. The knowledge base has to be kept alive: grounding decays if the KB ages, so the playbook gets updated at every change of policy or price list, not archived.
The compliance overlay, and who governs it
The liability stays yours (the Air Canada precedent)
It's the most important rule for customer-facing AI. In Moffatt v. Air Canada a tribunal held the airline liable for the wrong information given by its chatbot, rejecting the defence that "the chatbot is a separate legal entity": a company cannot offload onto a bot the responsibility for what it tells the customer. With us no workflow that answers the customer ships without this assumption: the bot's answer is your word, so it has to be built to be defensible, not just fast.
Source grounding (RAG) is not optional
A chatbot left free to answer hallucinates in a significant share of cases (industry estimates put it at 15–27%); tightly grounded to the source material — your knowledge base, your policies — that share collapses below 2%. That's why every customer answer is anchored to a verifiable source and there is always escalation to an agent for anything outside the perimeter. It's the same reason grounding, not the most powerful model, is the control that counts: without it the customer inherits Air Canada's exposure.
Compliance overlay
Tickets contain customers' personal data — orders, addresses, sometimes sensitive information: it raises the same GDPR questions as the rest of the playbook. A legal basis for processing, minimisation of the data passed to the model, transparency towards the customer about the fact that they are talking to an AI, retention and deletion of conversation logs. Due diligence on the vendor and its processing terms is a non-negotiable part of the software choice.
The AI owner
No big-enterprise Center of Excellence: in an SME one or two people named as AI owner are enough. Five responsibilities stay with them — setting priorities, who approves what (which intents the bot can handle on its own, first of all), enabling the team, reusable standards and monitoring deflection, CSAT and hallucination rate. It's the owner who keeps alive the knowledge base everything anchors to: when the KB ages, the grounding frays.
The same pattern, other departments.
-
Sales
Lead scoring, automated follow-ups, CRM hygiene.
See the full example -
Marketing
Campaign optimisation and copy with brand oversight.
See the full example -
Operations
Process automation, reporting and anomaly detection.
See the full example -
Finance & Administration
Accounts payable, month-end close and cash forecasting, with a human on the money.
See the full example -
HR & People
Screening, onboarding and an internal knowledge base, with high-risk hiring kept under oversight.
See the full example
This is the example. We graft yours.
The other departments follow the same pattern. Start from the free assessment to find out where it makes sense to begin, or let's talk directly.
Example for guidance only: it does not constitute legal or tax advice or a compliance assessment.