VibeWelcome to Tech Notes, the VibeCMD blog. I am Kevin Cunningham, and twice a week, Tuesdays and Fridays, I will cover one practical topic across IT, apps, and AI for small businesses here in Citrus Heights, Sacramento, and everywhere else a small team is doing its own tech support. This first edition starts with a practical rule for using AI: start small.
Start with a problem, not a tool
The U.S. Small Business Administration's AI guide for small businesses gives the same advice in plainer terms: AI can help a small business do more with less, it is still new, so start small, and test tools, including free or lower-cost tiers, to see whether they actually add value before you build your workflow around them. The order matters. Pick the business problem first, then find the smallest tool that solves it. Buying the impressive platform first and hunting for a problem second is how small businesses end up paying for shelfware.
The four-question filter
A good first automation passes all four of these tests.
One, it happens every week, ideally every day. Frequency is where the time savings live. Two, the inputs are predictable: the same kinds of questions, forms, or documents arrive in roughly the same shape. Three, the cost of a mistake is low and reversible. A rough first draft costs nothing if it is wrong; a wrong payment, contract, or customer promise costs plenty. Four, a person can check the output in seconds. If verifying the AI's work takes as long as doing the work, it is not an automation yet.
Tasks that usually pass: drafting replies to routine customer questions that a human reads before sending; summarizing your own meeting notes into action items; turning your approved price list and policies into first-draft quotes or answers; sorting and tagging incoming requests so the right person sees them first. Tasks that fail the filter for a first project: anything that sends money, signs you up for obligations, talks to customers unsupervised, or touches regulated data.
The guardrails are the project
Two federal references are worth knowing by name. NIST's AI Risk Management Framework (AI RMF 1.0, published January 2023) is the voluntary framework for using AI with your eyes open, built around governing, mapping, measuring, and managing risk. Its Generative AI Profile (NIST AI 600-1, July 2024) names the failure modes that matter for the tools small businesses actually use, including confabulation, which is the polite word for an AI inventing facts with total confidence, and data privacy.
Translated into shop rules: a human reviews anything customer-facing or money-moving before it goes out. Nobody pastes passwords, payment details, or sensitive customer information into a consumer AI tool. Before a tool touches real business data, read what the vendor does with that data; the SBA flags vendor data security and privacy safeguards as a core buying question, and a GAO expert panel on AI for small business programs flagged the same pair of risks, inaccurate outputs and data privacy, at the top of its list.
Run it as a one-week pilot
Pick one task, one person, and one week. Keep the old way of doing it as the fallback. Write down roughly how long the task took before, then how long it takes with the AI doing the first pass and the human checking. At the end of the week you have a real number instead of a vendor's promise, and a simple decision: keep it, fix the filter and rerun, or kill it and pick the next task. That is the whole method, and it scales: the second automation is easier because you already know your guardrails.
If you want a second set of eyes on which task to pick, that is the kind of thing VibeCMD does. Reach me through vibecmd.net/contact or at (279) 202-4794. Next edition, Friday: the backup check that takes thirty minutes and decides whether a bad day stays a bad day.