← All resources

AI for SMEs: the 5 tasks to automate first

Published October 30, 2026 · 8 min read · CyberNovaLabs.io

20.0% of EU enterprises with 10 or more employees used AI in 2025, up from 13.5% a year earlier. Measured usage gives an SME a clear order of priority: five tasks, in this order, and three to leave alone.

The short answer

AI for SMEs pays off first on written, repetitive tasks that are already documented: sorting inbound text, drafting and translating, qualifying inbound sales enquiries, transcribing calls, and then ICT security. That order is not a hunch, it is the order of measured European usage. In 2025, 20.0% of EU enterprises with 10 or more employees used at least one AI technology, up from 13.5% in 2024^[1]. And the most widespread technology was neither image nor voice: it was the analysis of written language, at 11.8%^[1].

What companies in the four countries already do

CyberNovaLabs.io works in the Netherlands, Belgium, France and Luxembourg. The gaps between those four markets are wide, and they matter when you compare your company to "the average". Share of enterprises using at least one AI technology in 2025^[2]:

Country	Small enterprises (10 to 49 employees)	All enterprises with 10+ employees
Luxembourg	30.5%	33.6%
Belgium	28.8%	34.5%
Netherlands	28.8%	33.2%
European Union	17.0%	20.0%
France	15.0%	18.2%

Two readings. Roughly one small company in three in Belgium, the Netherlands and Luxembourg is already equipped: AI there is no longer a watch item. And the gap between small and large firms in those three countries is narrow, 3 to 6 points, so size does not explain adoption, the nature of the tasks does. France sits about 2 points below the EU average for small enterprises^[2].

The reported barriers are stable. Across the EU, 7.8% of all enterprises with 10+ employees cite a lack of relevant expertise, 5.9% a lack of legal clarity, 4.8% data quality and 4.2% cost^[2]. Cost comes last: skills and law are what block, so the first project is organisational before it is technical. We flagged the same legal brake in our reading of the Flash Eurobarometer 578 survey on AI and algorithmic management in SMEs.

The 5 tasks to automate first

The order below follows the Eurostat ranking of measured usage, from most to least widespread. Every task is already tooled, and each one is measured in minutes saved.

1. Sorting and reading inbound text

The leading AI technology in Europe is the analysis of written language, used by 11.8% of EU enterprises with 10+ employees^[1]. By country in 2025: Luxembourg 25.0%, Belgium 23.0%, Netherlands 22.9%, France 10.2%^[2]. In practice: classifying inbound email, extracting the fields of an enquiry, summarising a fifteen-message thread before a meeting, reading an attachment and pulling three figures out of it. The task is bounded, errors are visible immediately, and the time saved is counted in hours per week from the first mailbox onwards.

One condition for success: a written sorting rule before the tool. If two people on your team classify the same email differently, AI will not decide for you, it will simply make the inconsistency faster.

2. Drafting and translating EN / FR / NL

Second use: generating written or spoken language, at 8.8% in the EU^[1] and markedly higher in multilingual markets: Netherlands 16.3%, Belgium 15.9%, Luxembourg 13.9%, France 7.8%^[2]. That gap is not an accident. A company that has to exist in two or three languages pays a permanent translation tax: quotes, website pages, standard replies, meeting notes. This is the first task where AI produces an obvious gain, including for a team of five.

Two guardrails: review by a native speaker remains mandatory for anything that leaves the company, because Flemish Dutch and Netherlands Dutch are not interchangeable; and never hand an external tool a document you would not send to a stranger.

3. Qualifying inbound sales enquiries

Marketing and sales is the leading reported application area: 6.9% of EU enterprises with 10+ employees, 12.3% in the Netherlands and 9.1% in Belgium^[2]. The useful application is not writing email at volume, it is making workable the enquiries that already arrive: identifying the company, checking it fits your target, spotting budget or deadline where they are written down, and asking the missing question before a salesperson picks up the phone.

Outbound prospecting, by contrast, runs into a precise framework. Before automating a single send, read what the GDPR and the national authorities actually allow: we set it out for B2B prospecting in France, Belgium and the Netherlands, and for the specific case of reconstructed business email addresses, which the French CNIL addresses explicitly.

4. Transcribing calls and meetings

Converting spoken language into a machine-readable format is used by 7.2% of EU enterprises^[1], and by more than one in eight in Luxembourg (13.0%) and Belgium (12.3%)^[2]. The gain is twofold: the write-up no longer has to be written, and it becomes searchable.

One serious caveat: recording a conversation means informing the participants. The legal basis, the retention period and the way you inform the other party are decided before the first recording, not after. The competent authorities are the Autoriteit Persoonsgegevens in the Netherlands, the APD / GBA in Belgium, the CNIL in France and the CNPD in Luxembourg^[6].

5. ICT security

Last of our five, and often the best return measured against the risk avoided: 3.9% of EU enterprises use AI for ICT security, but 8.6% in Belgium, 6.6% in the Netherlands, 5.9% in Luxembourg and 3.2% in France^[2]. Fraudulent email detection, abnormal account behaviour, alert triage. This building block is usually bought as a feature of your antivirus or mail platform: check first what your current subscriptions already include.

Three tasks not to automate first

AI for SMEs: the AI Act and GDPR framework in four countries

The timetable of the European AI Regulation is public and staged. The dates that concern an SME as a user, as published by the European Commission^[3][4]:

• 2 February 2025: prohibitions, definitions and the provisions on AI literacy. The duty to train the people who use these systems has therefore been running for over a year.
• 2 August 2025: governance rules and obligations for general-purpose AI models.
• 2 August 2026: the transparency requirements of Article 50 apply, and enforcement of the Regulation starts.
• 2 December 2026: providers of systems placed on the market before 2 August 2026 must have complied with the marking and detection obligations of Article 50(2).
• 2 December 2027 then 2 August 2028: Annex III high-risk systems, then systems embedded in regulated products.

Three practical consequences for an SME user: the people who use these tools must be trained; generated content and conversational agents must be identifiable as such; and any personal data passing through an AI tool remains subject to the GDPR, with its legal basis and retention period. We do not give legal advice: the source is the Regulation itself^[5], and the competent data protection authority is the AP, the APD / GBA, the CNIL or the CNPD depending on your country of establishment^[6]. For the skills themselves, see our AI training for teams.

Put a number on the gain before you start

An AI project is decided on a three-line calculation, not on a demo. The figures below are assumptions, to be replaced with your own.

Worked example under assumptions, to be replaced: 120 inbound enquiries per month, 6 minutes of reading and sorting each, a loaded hourly cost of 45 euros. That is 144 hours per year, 6,480 euros gross; allowing 30% for review, roughly 4,536 euros net per year on a single task. The figure is worthless until you have measured the 6 minutes and the volume of 120 yourself.

The questions to settle before signing anything:

1. Which task, in one sentence, and how many times a month?
2. Exactly how much time does it consume today, measured rather than estimated?
3. Who reviews the output, and how long does that take?
4. Which data leaves the company, and to which country?
5. What is the legal basis if that data is personal?
6. Who, by name, has been trained on the tool?
7. How do you see that the tool got it wrong, and how fast?
8. What gets stopped if the gain is not there after three months?

The eighth is the one people forget: a project with no written stopping criterion never stops, it is simply forgotten.

At CyberNovaLabs.io

We install these automations in that order: one measured task, one tool, one stopping criterion, then the next. The detail is on our AI and automation for business page; we work in the Netherlands, Belgium, France and Luxembourg, quoted on request once the task has been measured.

If you want to know which of these five tasks costs you the most today, ask for a thirty-minute call: we start from your real volumes, not from European averages.

Sources

1. Eurostat, « 20% of EU enterprises use AI technologies », communique du 11/12/2025
2. Eurostat, jeu de donnees isoc_eb_ai, « Artificial intelligence in enterprises », annee 2025
3. Commission europeenne, AI Act Service Desk, « When does the AI Act go into effect? »
4. Commission europeenne, AI Act Service Desk, « When does enforcement start? »
5. Reglement (UE) 2024/1689 etablissant des regles harmonisees concernant l'intelligence artificielle (AI Act)
6. EDPB, liste des autorites de protection des donnees (AP, APD/GBA, CNIL, CNPD)
7. Eurostat, Statistics Explained, « Use of artificial intelligence in enterprises »

Read next