Why map the process before deploying AI?
Before choosing an AI tool or model, map the process as it runs today: where work starts, which steps it goes through, who does them, how long they take, what data they use and where they end. The map shows which steps are worth automating, which need human approval and which should stay as they are.
Credible frameworks put context first. NIST's AI Risk Management Framework (AI RMF) has a MAP function that establishes the context of an AI system, and says that after MAP an organisation should know enough to make an initial go/no-go decision on whether to design, develop or deploy it. This guide turns that idea into a concrete working method for small and mid-sized businesses. If you already have a map and want the next steps, see the 6-step guide to AI process automation.
Start with a one-page SIPOC
According to ASQ, a SIPOC diagram records the Suppliers, Inputs, a high-level Process of about five to seven core activities, Outputs and Customers of a process. It is a 15–30 minute exercise that gets the team to agree on scope before going into detail.
For detailed maps, BPMN (Business Process Model and Notation), maintained by OMG, is the common notation; OMG describes it as usable directly by business stakeholders yet precise enough to be translated into systems. Small businesses do not have to use BPMN; a spreadsheet with the right columns (below) is usually enough for a first project.
- Where does the process start and end?
- Who receives the final output, and what does "done" mean to them?
- Where do inputs come from: email, forms, chat apps, accounting software, CRM?
- Does the process handle personal or sensitive data?
Process mapping checklist: 7 columns to fill in
Each row is a real step, including informal ones such as phoning a colleague or a note in a group chat. Record how the work actually happens, not how the procedure is written down.
| Column | Question to answer | Example entry |
|---|---|---|
| Trigger | What event starts this step? | Email with an attachment arrives in the shared inbox |
| Step | What exactly is done (verb + object)? | Read the invoice, enter the amount in the software |
| Owner | Who does it, who decides, who only helps? | Accountant does it; chief accountant approves |
| Time | Working time and waiting time, frequency per day/week | 5 minutes work, 1 day wait; about 40 times a week |
| Data | What data is used and created, in which system, any personal data? | Invoice PDF, tax ID, accounting software |
| Exceptions | When does this step leave the normal path? | Wrong invoice details, no matching purchase order |
| Automate? | Automate / AI proposes + human approves / keep manual | AI proposes, accountant approves |
Which steps to automate and which to keep with people
Once the table is filled, put each step into one of three levels. As a rule, the more repetitive, rule-based and easy to check a step is, the better it suits automation; the more it needs judgement, has legal consequences or directly affects people, the more a human should decide.
| Level | When it fits | Example |
|---|---|---|
| Fully automated (rules) | Structured input, clear rules, errors easy to spot and reverse | Move files to a folder, send a receipt notice |
| AI proposes, human approves | Unstructured input (text, images) that needs reading, with a person checking before anything is written | Extract invoice data, draft a customer reply |
| Keep manual | Needs judgement about people, large legal or financial consequences, or a relationship that needs a human voice | Decide on a disputed debt, handle a serious complaint |
Exceptions and handovers: the part most maps miss
Most risk sits not in the normal path but in exceptions: missing data, unusual formats, customer questions outside the script, a downstream system that does not respond. For every exception in the table, write down who receives it, through which channel, with what information and how quickly it must be handled.
A handover between AI and a person must carry context: the original input, what the AI did, why it stopped and its proposal if any. The person receiving it should not have to start over. Designing approval points is covered in detail in Human-in-the-Loop.
Linking to legal requirements for human control
Vietnam's Law on Artificial Intelligence (Law No. 134/2025/QH15, in force from 1 March 2026), in Article 4(2), sets the principle that AI serves people and does not replace human authority and responsibility, and that human control and the ability to intervene in AI decisions and behaviour must be maintained. A process map with clear "owner" and "approval point" columns is a practical way to show that this control was designed in. This is general information, not legal advice.
Reference map for a task involving AI
The diagram below is a reference frame: input is always checked before it reaches the AI, the AI has read-only access to draft a proposal, and every write to a system passes a human approval point. Once the process runs steadily and has data behind it, some low-risk steps can be given more autonomy by the accountable owner.
[Trigger] -> [Validate & normalise input] -> [Fixed rules]
| |
low risk | | exception / high risk
v v
[AI drafts a proposal (read-only)] [Human handler]
| |
v v
[Human approval checkpoint]
| approve | edit / reject
v v
[Write to system + audit log] [Record for improvement]Illustrative example: processing supplier invoices
Illustrative example (hypothetical, not a real project): a trading company of about 30 people receives supplier invoices by email; an accountant types them into the accounting software and then matches them against purchase orders.
| # | Trigger / Step | Owner | Time | Data | Exceptions | Automate? |
|---|---|---|---|---|---|---|
| 1 | Invoice email arrives in shared inbox | System | Continuous | Email, PDF/XML | Email is not an invoice | Automate: filter and save file |
| 2 | Read invoice, capture figures | Accountant | ~5 min/invoice | Tax ID, amount, date | Blurry scan, missing fields | AI proposes, human approves |
| 3 | Match to purchase order | Accountant | ~5 min | Purchase order in software | Amount mismatch, no order | AI proposes match; mismatches go to a person |
| 4 | Approve payment | Chief accountant | ~1 day wait | Payment request | New supplier | Keep manual |
| 5 | Post entry and file documents | Accountant | ~2 min | Accounting software | Connection error | Automate after approval, with log |
Fix the scope of the first release
Do not automate the whole process at once. Pick one or two high-volume, easy-to-check steps (steps 2 and 3 in the example), run them alongside the old way for a while, compare results, then expand. Before starting, check whether input data is clean enough with the data readiness for AI checklist.
- Baseline before you start: handling time per invoice, correction rate, waiting time.
- Stop criterion: if the error rate of proposals passes the threshold the team agreed, revert to manual.
- Accountable owner: a business person owns the process, not only the tech team.
- Review schedule: revisit the map when the process, systems or regulations change.
Frequently asked questions
What are the steps to implement AI in a business?
A practical sequence: map the current process, choose steps suitable for automation, check the data, design human approval points, pilot on a small scope, measure, then expand. This guide focuses on the first step, mapping. The steps after the pilot are covered in the pilot-to-production checklist.
What is SIPOC and do I need it?
SIPOC is a high-level diagram of suppliers, inputs, process, outputs and customers (per ASQ). It is optional, but it helps a team agree on scope in a short session before detailed mapping.
Do I need BPMN or dedicated process-mapping software?
Not for a first project. A spreadsheet with the seven columns (trigger, step, owner, time, data, exceptions, automate?) is usually enough. BPMN helps when the process is complex or must be handed to an engineering team.
Which steps should not be automated with AI?
Steps that need judgement about people, have large legal or financial consequences that are hard to reverse, or need a human voice in a customer relationship. AI can help draft at these steps, but a person decides.
How long does process mapping take?
It depends on complexity. For a process of a handful of steps, a team can usually complete the SIPOC and the seven-column table in one or two working sessions, then check it by observing the real work.