Setting up AI inside small businesses.

Twenty-five years in enterprise sales, five weeks into a new patch, and 249 work files spread across three folders on one laptop. No system had ever stuck. Several had been tried and abandoned, each leaving its own copies behind.

The cost of that showed up in the files themselves. One deal-review template had been rebuilt from scratch eleven times. The most recent quarterly review deck had reached version 25.

One session, ninety minutes, on their machine with them driving. Their AI read every work file on the laptop, interviewed them about how the job actually runs, proposed a structure, and moved nothing until they had approved it.

Every move was logged and nothing was deleted. Files that looked redundant went to a quarantine folder rather than to the bin, because "looks superseded" is a guess and a checksum is not.

282 files filed, 107 quarantined, 250 moves, all reconciled exactly against the log. About a third of what they were carrying was duplicate or superseded, identified by checksum rather than by filename, which is the only way to catch a file that was renamed on the way to being copied.

The more useful find was not the filing. Reading their compliance pack against a written request from a bank's third-party risk team surfaced six documents that were genuinely missing: a penetration test over a year old, an expired audit bridge letter, and two statements of applicability that were not there at all. That evidence gates being shortlisted. It had been sitting in the gap between having answered something before and being able to find it.

• No after-number. I have not measured how long assembling that compliance pack takes now against what it took before.
• One session. Whether the structure survives six months of daily use is not something I can yet claim.
• Whether closing those six gaps changed the outcome of the bid is not visible to me, and I am not going to imply it did.

A company two weeks old, two founders working from different countries, everything in one shared cloud folder, and neither of them had used Claude Code.

Nothing was broken, because nothing existed yet. That is the cheapest moment to do this and the one nobody books, since the mess has not been built and so there is nothing to point at.

Two sessions. The first restructured the shared folder into three layers: a router file their AI reads whenever it opens, a context file per area of the business, and a progress file per area. Personal work was separated from business work so the shared folder stayed shareable.

The second built a marketing toolkit on top of it: 24 files covering positioning, voice, campaign structure, research and templates, adapted from a framework they already had access to and had not been able to use.

Two things were deliberately left empty: their brand voice and their positioning. They had not given me enough to work from, and inventing it and filing it as theirs would have been worse than an empty file with an honest note in it.

Four and a half hours from a shared folder to a working system. At two weeks old the entire value is not having to unpick it later.

The audit also turned up a live API token sitting in the shared, cloud-synced files, in two places. Nobody was looking for it. It surfaced because the process reads every file, not because anyone ran a secret scan. It was flagged for rotation and redacted from the files. I have not confirmed that it was rotated, so the honest version is that the exposure was surfaced, not that it was closed.

• No after-number. The later sessions had not happened when this was written.
• The token was flagged, not verified rotated. Rotation is the client's action and I have no way to check it.
• The fastest of the five engagements, and the one with the least mess to start from. It is not representative of what an established business takes.

The shared mailbox the whole team runs on was full, and nobody knew what the software actually cost. Eleven subscriptions spread across several accounts. The internal spreadsheet said one number, the founder feared close to double, and neither was right.

The obvious fix for the storage, buying more of it, pointed the wrong way on the bill.

Audited every subscription against the real invoices rather than against the spreadsheet: what each one is for, whether anyone still uses it, what cancelling would cost or save, and what breaks if it goes. Then a before-and-after model with exact figures, so the decision was arithmetic rather than nerve.

The storage problem was fixed and the annual software bill went down. The upgrade that solved the storage was paid for several times over by what the audit found underneath it: a website plan on a tier built for paid bookings when the site takes none, a marketing tool nobody had sent from in over a month sitting at full price, and a redundant mailbox account.

Separately, two domains had auto-renew switched off. One of them routes a team member's email. If it had lapsed her mail would have stopped without warning, and the first sign would have been someone saying they had not heard back.

• The money figures are held back on purpose. The client's cost base is theirs, and a precise saving against a precise starting number identifies them.
• Two of the changes were still in progress when this was written, so the final run-rate is modelled rather than settled.
• The audit measured cost, not hours. There is no time-saved figure here because none was taken.