AI process automation: a 6-step guide for businesses

The short answer

AI process automation means using an AI model (usually a large language model) to handle steps that used to need a person to read, understand and classify information — and connecting those steps to the software you already run. A safe approach has six steps: pick the right kind of automation, choose a process worth automating, map the process, place human approval, run a measured pilot, then scale and operate.

One principle runs through all of it: use the simplest solution that does the job. Anthropic, the developer of the Claude models, advises adding complexity only when it is truly needed, which sometimes means not building an agentic system at all.

Step 1: Tell rule-based automation, RPA, AI and AI Agents apart

Many projects fail because they pick the wrong tool on day one: an AI Agent for a job a simple if/else rule handles better, or RPA forced to process free-text email. The table below matches each tool to the kind of work it suits.

IBM describes RPA as technology that uses software robots to automate tasks humans perform on a computer; the key difference is that RPA is process-driven (bots follow only the steps a user defines), while AI is data-driven and recognises patterns, especially in unstructured data. IBM also notes the two complement each other.

For language-model AI, Anthropic draws an architectural line: workflows are systems where models and tools are orchestrated through predefined code paths, while agents are systems where the model directs its own process and tool use. Anthropic now describes an agent simply as a model autonomously using tools in a loop.

Step 2: Choose suitable processes with a scoring table

The best first candidates usually share three traits: high frequency, low variance and measurable outcomes. Add two more to manage risk: inputs already exist in digital form, and mistakes can be caught and corrected.

Score each criterion from 1 to 5, multiply by the weight and add up. The weights below are EYC's suggested starting point for discussion, not an industry standard; adjust them to your context.

Step 3: Map the process before writing any prompt

Do not automate a process you cannot describe on paper. The map should record the trigger, each step, who does it, data in and out, the systems involved, exception branches and the end state. A detailed walkthrough is in our guide on how to map an AI workflow.

Once mapped, label each step with one of the four approaches from Step 1. Usually only a few steps genuinely need AI (reading email, extracting fields from documents); the rest is ordinary rules and integration. Splitting it this way keeps cost down and control up.

• Remove unnecessary steps first — automating a messy process only makes the mess faster.
• Write down what "done" means for each step so you can measure it later.
• List the common exceptions; that is where AI or a person needs to step in.
• Identify personal or sensitive data passing through each step so internal data governance rules apply.

Step 4: Place human approval where it matters

Not every step needs a reviewer, but every hard-to-reverse action should have one. NIST's AI Risk Management Framework (AI RMF 1.0) — a voluntary framework — emphasises accountability, post-deployment monitoring and mechanisms for people to intervene and override when needed. See our guide on human-in-the-loop design.

Anthropic likewise describes agents pausing for human feedback at checkpoints or when they hit blockers, and recommends extensive testing in sandboxed environments with appropriate guardrails.

• Approve before execution: moving money, deleting data, sending information outside the organisation, commitments to customers.
• Approve by threshold: AI handles high-confidence, low-value cases; anything above the threshold goes to a person.
• Approve by sample: spot-check a share of automatically handled cases to catch drift.
• Always keep a stop switch and a named owner for each automated process.

Step 5: Run a pilot with clear metrics

A pilot runs in a narrow scope — one team, one request type — with baseline numbers measured before it starts. A safe pattern is shadow mode: AI proposes, people keep working as before, and you compare results before letting AI act for real.

Set stop-or-scale criteria up front, for example "the manual correction rate stays below X for N consecutive weeks". You choose X and N based on the risk of the process; this guide gives no standard figure because there is none that fits every industry.

Step 6: Scale and operate

An automated process is a software system that needs long-term operation, not a one-off project. NIST notes that AI risks differ from traditional software partly because data can change over time and affect system behaviour, so risk management has to be continuous.

• Scale in steps: add new request types or user groups once metrics are stable.
• Version prompts, rules and models; re-run the test cases before any change goes live.
• Log inputs, decisions and actions so incidents can be traced.
• Least privilege: the system only reaches the data and tools its job requires.
• Review periodically: when the business process changes, the map and the automation must change too.

Processes you should not automate (or not yet)

Knowing when to say no is part of good automation. In the cases below, keep a person deciding and let AI only prepare information.

Some AI systems used in sectors such as education, health, banking and transport may fall under the list of high-risk AI systems issued with Decision 33/2026/QD-TTg, which brings conformity assessment and stricter human oversight; see the overview in Vietnam's AI Law 2025.

Where the line falls between what to automate and what to keep human differs by department. Two deep dives cover this in detail: AI in accounting and finance and AI in recruitment and HR.

• Decisions with major impact on an individual: hiring, discipline, credit, diagnosis — especially when the reasoning is hard to explain.
• Rare or one-of-a-kind processes: build and testing cost outweighs the benefit.
• Unstable or changing processes: standardise them first.
• Work with no way to check whether the output is right: what you cannot measure you cannot control.
• Situations that need empathy and personal accountability: serious complaints, sensitive conversations with parents or patients.
• Irreversible actions without a human approval point.

How EYC supports process automation

EYC advises on and builds AI and AI Agent automation following the sequence above: discovery, process mapping, approval design, a measured pilot and only then scaling. When several systems must be connected, we combine it with integration and consulting. EYC itself is building toward an operating model where AI Agents perform most repeatable work under human direction.