AI Transformation Checklist: 7 Stages and What Done Means

An AI transformation checklist is the list of decisions and tasks a business must finish, in order, before AI becomes part of normal work: name an owner, pick one costly problem, check your data and legal position, set up the right accounts, run a short measured pilot, train people, then decide whether to scale. Every item needs a “done” test, or it turns into a box you tick without doing the work.

The checklist below has seven stages and 33 items, and each item says what done looks like. Print it, write a name and a date next to every item, and work through it in order. Most businesses that stall bought a tool at stage 4 before finishing stage 2.

Key Takeaways

• Name one person who owns the AI work before you buy anything, because shared ownership usually means nobody follows up.
• Start with a single process you can already measure in minutes, shillings or errors, not with a tool someone saw on social media.
• Check your ODPC registration and whether your use case needs a data protection impact assessment before any customer data goes into an AI tool.
• Run a pilot of four to six weeks against a written baseline, and agree the pass mark before the pilot starts, not after.
• Scale only what passed. A pilot that missed its target has still told you something useful, so write it down and move on.

What should an AI transformation checklist include?

Most checklists that rank for this search are written for large companies with data teams and steering committees. A Kenyan business with 5 to 200 staff needs the same logic with fewer meetings, more measuring and Kenyan law built in. Here is the whole checklist on one page.

My honest view: “transformation” is too big a word for year one. What works is one process done properly, then the next.

Stage 1: Who owns AI in your business, and what is the goal?

• Name one AI owner. Done when: a named person has the role in writing (a staff memo is enough) and protected time, such as two afternoons a week.
• Set a budget ceiling for the first 90 days. Done when: a written figure covers tool subscriptions, staff time and any outside help, signed off by whoever approves spending.
• Write the goal in one sentence. Done when: the sentence names a business result, such as “reply to every booking enquiry the same day”, not “start using AI”.
• Tell your staff what is happening and why. Done when: a short meeting has covered what AI will and will not be used for, and who to ask.

The owner does not need to be technical. They need to be organised, trusted by staff and willing to measure things, which in a small business usually means the owner or the office manager.

Stage 2: Which business process should AI handle first?

• List ten repetitive tasks. Done when: a sheet shows each task, who does it, how often, and roughly how many minutes it takes each time.
• Score each task. Done when: every task has a 1 to 5 score for volume, for how rule-based it is, and for how costly a mistake would be.
• Pick one process. Done when: you have chosen a high-volume, rule-based task where mistakes can be caught before they reach a customer.
• Measure the baseline for two weeks. Done when: real counts are in a sheet, such as enquiries per day, minutes per enquiry and errors per week.
• Write the pass mark before the pilot. Done when: a target is written down with a buffer above break-even (see the worked example below).

Good first processes include drafting replies to common customer questions, summarising meeting notes and turning supplier invoices into a spreadsheet. If you are unsure which tasks qualify, our guide on how to tell which business processes AI can handle walks through the test in detail.

A blunt opinion: any process where AI would make a decision about a person, such as who gets credit, who gets shortlisted or who gets a discount, is the wrong first project. The legal duties are heavier and mistakes are harder to undo.

Stage 3: Is your data and legal position ready for AI?

Foreign checklists skip this stage. In Kenya it matters.

ODPC registration. The Office of the Data Protection Commissioner’s guidance note on registration says private businesses processing personal data of people in Kenya must register if they have an annual turnover of KSh 5 million or more, or more than 10 employees. Some sectors must register whatever their size, including education, health, hospitality, property management, financial services, telecommunications, direct marketing and transport. At the time of writing, the guidance lists a registration fee of KSh 4,000 for micro and small entities, with higher tiers for medium and large ones. Registration is done on the ODPC data portal.

Data protection impact assessment (DPIA). Regulation 49 of the Data Protection (General) Regulations, 2021 lists high-risk processing that needs a DPIA before it starts, including automated decision making with legal or similarly significant effects, processing sensitive personal data or children’s data, combining datasets from different sources, large-scale processing, and “innovative use or application of new technological or organizational solutions”. Regulation 22 also requires you to tell people when a decision about them is automated and explain the logic.

AI-specific law. Kenya launched its National AI Strategy 2025-2030 on 27 March 2025, but as Afriwise’s summary of the strategy notes, Kenya still lacks a comprehensive AI regulatory framework. For now, the Data Protection Act is the law that applies. Our guide to AI and Kenya’s regulatory requirements covers the wider picture.

• Confirm your ODPC registration status. Done when: the certificate is on file, or a short written note explains why you are exempt (turnover, staff count and sector checked).
• Map the data the pilot will touch. Done when: a list shows every type of information the process uses, with personal and sensitive data marked.
• Answer the DPIA question in writing. Done when: you have checked your use case against the regulation 49 list and written yes or no with a reason. If yes, the DPIA is finished before the pilot starts.
• Clean the source material. Done when: the price list, FAQs, policies and product details the AI will draw on are current, correct and in one place.
• Write a “never paste” list. Done when: staff have a short list of information that never goes into an AI tool, such as ID numbers, KRA PINs, M-Pesa statements, medical records and passwords.

Stage 4: Which AI tools and accounts should you set up?

• Choose one main tool for the pilot. Done when: after testing two or three options on real examples, you have written one sentence on why this one fits.
• Use business accounts, not personal ones. Done when: every account belongs to a company email address and an admin can remove access the day someone leaves.
• Check whether your inputs are used for training. Done when: you have read the vendor’s policy and saved a screenshot of the setting.
• Turn on two-step verification. Done when: every account that touches company data has it switched on.
• Write a one-page AI use policy. Done when: each pilot user has signed a page covering approved tools, the never-paste list and the rule that a person checks every output before it is used.

Data settings differ by plan. Anthropic’s privacy centre says it does not use inputs or outputs from its commercial products for training by default, while its consumer plans depend on a “Model Improvement” privacy setting. Google’s Workspace privacy hub says Workspace does not use customer data for training models without the customer’s prior permission or instruction. Whatever tool you pick, check its current policy yourself.

Stage 5: How do you run an AI pilot that proves something?

• Fix the length and scope. Done when: the pilot has a start date, an end date four to six weeks later, and one named team or person.
• Have a person check every output at first. Done when: a named reviewer approves each AI draft before it goes out, and corrections are logged.
• Track the same numbers as the baseline. Done when: the sheet from stage 2 is updated every week with the pilot figures.
• Log errors and near misses. Done when: every wrong price, invented fact or wrong tone is recorded with the date and what caught it.
• Hold a mid-pilot review. Done when: at week two or three the owner and the team have met for 30 minutes and agreed any changes.

The human check is not optional. We learned this running our own publishing desk: an AI writer will invent statistics and client stories unless checks stop it, and a human-written rule set plus automated checks are what make the output publishable. We describe how that system works in our AI publishing system case study. The same holds for a customer reply or a quotation.

Worked example (hypothetical): a 12-room guest house in Naivasha with 7 staff. The process is answering booking enquiries on WhatsApp and email. Hospitality must register with the ODPC regardless of size, and guest names and phone numbers are personal data, so stage 3 starts with the certificate.

Assumptions from two weeks of baseline: 35 enquiries a day at 7 minutes each.

• Baseline time: 35 × 7 = 245 minutes a day, about 4 hours.
• During the pilot, the AI drafts each reply from the rate sheet and house rules, and staff check availability and send. Assume 4 minutes per enquiry: 35 × 4 = 140 minutes a day.
• Time saved: 245 - 140 = 105 minutes a day. Over a 30-day month: 105 × 30 = 3,150 minutes, or 52.5 hours.

Now the pass mark. Suppose the owner works out that subscriptions plus the AI owner’s time cost the equivalent of about 20 staff hours a month. That is break-even. Two weeks of baseline numbers are noisy, so the owner sets the pass mark at 30 hours saved, a 50% buffer (20 × 1.5 = 30), not at 20. A second condition: no more than 1 wrong rate in every 50 replies sent. At 52.5 hours the pilot passes the time test easily, but it only passes overall if the error log holds too.

Stage 6: How do you train staff to use AI well?

• Train the pilot team on their actual task. Done when: each person has done the real task with the tool at least five times under the owner’s eye.
• Build a shared prompt library. Done when: a document holds the tested instructions for each task, with an example of a good output.
• Teach checking, not just prompting. Done when: each user can find a planted mistake in an AI draft, such as a wrong price or an invented policy.
• Collect feedback from the people doing the work. Done when: you have notes on what slows them down.

Generic “intro to AI” sessions rarely change how anyone works on Monday. Training tied to one real task is cheaper and sticks. Our article on AI staff training for Kenyan businesses covers formats and what to teach first.

Stage 7: When should you scale AI, and how do you keep it working?

• Hold a go/no-go meeting. Done when: a written decision says scale, rerun or stop, with the numbers behind it.
• Work out payback with your own figures. Done when: monthly cost, monthly value and months to payback are written down. Our guide on whether an AI investment will pay off shows the arithmetic.
• Write the new process down. Done when: a one-page procedure explains the steps, the checks and who to call when something goes wrong.
• Book a monthly review. Done when: a recurring date is in the calendar to check results, errors, costs and any change in the tool’s terms.
• Choose the next process. Done when: the next task from your stage 2 list has an owner and a start date.

For the monthly review, the US National Institute of Standards and Technology’s voluntary AI Risk Management Framework, released in January 2023, is a useful free reference built on four functions: Govern, Map, Measure and Manage. You do not need to adopt it formally. Asking “who owns this, what does it touch, how are we measuring it, and what happens when it fails?” once a month covers the spirit.

What can you do this week to start?

1. Monday: name the AI owner and write the one-sentence goal, in writing.
2. Tuesday: list ten repetitive tasks with how often they happen and how long they take.
3. Wednesday: score the list, pick one process and start counting the baseline.
4. Thursday: check your ODPC status and the regulation 49 list against your chosen process.
5. Friday: open business accounts on one or two tools, check their data settings and write your never-paste list.
6. Next week: finish the baseline, write the pass mark and set the pilot start date.

Which AI transformation mistakes should you avoid?

• Buying a tool before choosing a problem. You end up hunting for uses for a subscription.
• Skipping the baseline. Without “before” numbers, the go/no-go decision becomes a matter of opinion.
• Using personal accounts. When a staff member leaves, company information leaves with them.
• Removing the human check too early. One invented price sent to a customer costs more than the minutes saved.
• Treating compliance as a later problem. A DPIA that should have come before processing cannot be done honestly afterwards.

We cover more of these in the AI mistakes Kenyan businesses keep making.

Frequently asked questions

What is an AI transformation checklist?

It is an ordered list of steps for bringing AI into a business safely, from choosing an owner and a first process to piloting, training and scaling. A useful one says what “done” looks like for each item, so progress is checked rather than assumed.

How long does the first stage of AI transformation take?

Stages 1 to 4 can be finished in two to three weeks for a small business, mostly because the baseline needs two weeks of real numbers. The pilot then runs four to six weeks. Larger organisations take longer at stage 3.

Does a small Kenyan business need to register with the ODPC before using AI?

Registration depends on your personal data processing, size and sector, not on AI itself. The ODPC guidance requires registration at KSh 5 million turnover or more, or more than 10 employees, and for listed sectors such as education, health and hospitality regardless of size. If you fall in either group, register whether or not you use AI.

Do we need a data protection impact assessment for a chatbot?

Not automatically. Check your chatbot against the regulation 49 list: if it makes decisions with significant effects on people, handles sensitive or children’s data, or processes data at large scale, a DPIA is required before you start. A bot answering opening-hours questions from a public FAQ is unlikely to qualify, but record your reasoning either way.

What if the pilot fails?

Write down what the numbers showed and why, then adjust and rerun or move to the next process. A failed six-week pilot is far cheaper than a full rollout of something that does not work.

The bottom line

AI transformation for most Kenyan businesses is not one big project. It is this checklist run once properly, then again on the next process. The boring stages, the baseline, the ODPC check and the human review, decide whether the results are real.

If you want a second pair of eyes on your task list or pilot plan, WhatsApp us on 0711 344 702.