Everyone wants an AI strategy. Almost nobody wants to first figure out whether they need AI at all.
A couple of weeks ago, the CEO of a non-profit organization called me. “Esti, you understand AI, right?” Well, no one really understands AI, I told her, but I asked what I could do to help. She described what she actually needed: something to collect dues from members, manage meeting logistics, handle the kind of secretarial work that eats a small staff’s week. I found myself giving her an impromptu lecture on the difference between heuristic systems, the rule-based tools that can and should support exactly these types of business processes, and AI systems that include a learning component, along with the risks that come with it, risks I wasn’t at all sure she needed or wanted.
A few days later, a financial advisor I work with called. “Esti, you know AI systems, right?” He wanted a course on one of the major AI platforms so he could build a bot to make his team more efficient. He got the same lecture.
Two calls, a week apart, both starting from the same premise: “AI” as a single, undifferentiated thing you either adopt or don’t. That premise is the actual problem. So, let’s take it apart.
Three different tools, wearing the same name
The first thing worth separating out is the heuristic system: a set of explicit, human-written rules that execute exactly as instructed, every time, with no deviation. If a due date passes, send a reminder. If a form is missing a field, flag it. This is not new technology, it is decades old, and for a huge share of what small organizations actually need, it is the right tool. It is cost-effective, predictable, auditable, and it fails in ways you can trace back to a specific rule you wrote.
The second is machine learning: a system trained on data to recognize patterns and make predictions, without being explicitly programmed for every case. This is what powers a spam filter or a recommendation engine. It is more flexible than a heuristic system and, correspondingly, harder to fully predict, since its behavior emerges from data rather than from a rule you can point to.
The third, and the one generating most of the noise right now, is AI, and even more specifically, agentic AI: a system that is given a goal rather than a procedure, and that plans, reasons, chooses tools, and chains its own actions to get there, without a human approving each step along the way. The distinction that matters most for a small business owner is this one: A chatbot answers.An agent acts. This is a genuinely different category of tool, with a different category of risk, and it is usually not what a non-profit collecting membership dues actually needs.
Why the distinction isn’t pedantic
I’m not making this distinction to be precise for its own sake. I’m making it because the risk profile changes completely depending on which of these three tools you’re actually deploying, and vendors have very little incentive to explain that to you clearly.
A heuristic system fails loudly and specifically. An agentic system can fail quietly, competently, and in a direction nobody anticipated. This can happen because it was optimizing for a goal that was described a little too loosely.
I wrote about exactly this dynamic recently in the context of the OpenAI-Hugging Face incident, where an AI agent, given a narrow and imprecisely bounded objective, found the most efficient path to it, a path that happened to run through a another company’s production servers. This was a frontier AI lab with a dedicated safety team. A five-person non-profit team is not equipped to write objectives that tight, and shouldn’t have to be, for a task like dues collection.
This is also, not incidentally, why so much enterprise AI spending isn’t showing results. McKinsey has described what it calls the “gen AI paradox”. Roughly eight in ten organizations have deployed some form of generative AI, and a similar share report no material impact on earnings. Separately, Gartner predicts more than 40% of agentic AI projects will be cancelled by 2027, not because the underlying technology doesn’t work, but because the organizations deploying it weren’t structured to support a system making autonomous decisions across a live business process. If large enterprises with dedicated AI teams are getting it wrong at this rate, the lesson for small businesses or non-profits isn’t “move faster”. It’s “ignore the hype and match the tools to the actual job”.
What SMBs and small non-profits should actually do
Start with the process, not the technology. Write down, in plain language, what the task actually is, what a correct outcome looks like, and what happens today when it goes wrong. Almost every time I’ve done this exercise with someone, most of what they describe turns out to be a heuristic problem wearing an AI costume: rules, reminders, routines, and lookups. That is not a criticism. It means the fix is cheaper, faster to deploy, and dramatically easier to trust than an AI system would be.
Reserve machine learning and agentic tools for the genuinely harder problems underneath, the ones where the rules keep changing, where judgment calls are involved, or where the volume is high enough that a rules-based system would need constant, expensive rewriting to keep up.
Even then, the right question isn’t “what’s the most advanced tool available”, it’s “what’s the least autonomous tool that solves this”. Yes, re-read this sentence. You should be looking for the least autonomous tool that can solve your issues. Give an agentic system the narrowest possible objective, put a human in the loop for anything consequential or irreversible, and treat the guardrails as part of the deployment, not an afterthought bolted on once something goes wrong.
Finally, be honest about capacity. A small non-profit or a two-person advisory practice does not have a safety team, and doesn’t need to build one. However, it does need to understand that the more autonomy a system has, the more oversight it requires, not less. If nobody in the organization has the time to define a task tightly and check on it periodically, that is very useful information. It means the organization isn’t ready for an agentic tool yet, whatever a vendor’s sales deck promises.
Back to the two phone calls
Neither the non-profit CEO nor the financial advisor actually needed agentic AI. What they needed was for someone to sit with them long enough to translate “help me be more efficient”into an actual list of tasks, and then match each task to the least complicated tool that does the job well. That is a less exciting answer than “build a bot”, and it is also, almost always, the right path to pursue.
Demystifying AI doesn’t mean explaining how the models work. It means giving people permission to ask a much smaller, much more useful question first: do I actually need this, or do I just need a really good rulebook?
