The 2025 SMB context
A French SMB in 2025 has a limited tech budget but must meet high expectations: AI adoption, post-NIS2 cybersecurity, GDPR compliance, and a customer experience on par with market leaders.
The classic mistake: trying to do everything. Rolling out an unmanaged internal ChatGPT, half-deploying MFA, redesigning the website without ambition — and ending up with four half-projects that deliver no value.
Our conviction: three clear priorities, sequenced. AI (productivity), cybersecurity (risk), simplification (agility). In that order.
Priority 1: applied generative AI
Generative AI is today the best tech ROI for a service SMB. Not abstract AI — concrete use cases: an internal documentation assistant, meeting-report generation, call summarisation, email classification, data extraction.
Typical pilot cost: €10-25k for an internal RAG assistant over company documentation. ROI within 6 months for any SMB with more than 30 employees.
Caution: the pilot must be framed (security, GDPR, chosen model). No wild 'let's test ChatGPT' — the data goes to OpenAI without an Enterprise contract, and that is a GDPR risk.
Choosing a provider: prefer a studio that masters both AI and cybersecurity (rare). Avoid 'AI agencies' that outsource deployment to juniors.
Priority 2: cybersecurity and NIS2
NIS2 applies to many SMBs (energy, transport, health, finance, digital infrastructure, etc.). Even outside its scope, it is a good framework for structuring security.
Essential, low-cost measures: MFA everywhere (email, admin accounts, cloud accounts), a password manager (Bitwarden, 1Password), 3-2-1 backups, an incident response plan, anti-phishing training.
Structuring investment: a lightweight SIEM (open-source Wazuh), EDR (CrowdStrike, SentinelOne), a secrets manager (Vault, Doppler). Annual budget €5-15k depending on size.
Initial audit: €8-15k to identify gaps and prioritise. Not optional for a growing SMB.
Priority 3: legacy simplification
Every SMB older than 5 years has accumulated legacy: an old CRM, interconnected Excel scripts, an outdated ERP, an ageing website, manual workflows.
Trying to rebuild everything is a mistake. Prioritise by business impact: what slows the team down most day to day? Start there.
Pragmatic approach: a short audit (1 week), 3 identified quick wins, delivery over 2-3 months. No big bang. Each victory funds the next.
When to redesign the website? When it holds the business back (low conversion, costly maintenance, marketing can't iterate). Not before. A 'good enough' site can stay as is for years.
The 'AI everywhere' trap
Everyone wants to do AI. Not everyone should. If your problem is really a process problem, dirty data, or an organisational issue — AI won't solve it, it will temporarily mask it.
AI relevance criterion: is the task repetitive, with lots of input data, and acceptable at 80% accuracy? If yes, AI fits. If the task requires 100% precision or has little data, look elsewhere.
The use case that always pays off: document search (internal RAG). 80% of service SMBs find positive ROI within 6 months. It is our #1 recommendation to start with.