How many AI tools does a small business actually need?

Start with one, for your most common low-risk tasks. Add another only when a recurring job needs a capability the first lacks — source-linked research, approved document search, media generation, coding help, or local processing. Confidential data isn't a tool-count question at all: it needs its own privacy, legal and security assessment first.

How do I choose between all the tools on offer?

Start with the job and its risks: what data goes in, whether important claims need source verification, whether the tool can take actions, and what human review the output requires. Then compare current products on data handling, access controls, retention, reliability, output rights and task fit. The categories are useful shorthand — but their features and boundaries change, so re-check periodically.

Which AI tool for what

You do not need five AI subscriptions — most small-business work fits into a handful of jobs, and many businesses can begin with one deliberately chosen tool, adding another only when a recurring task or risk demands a different capability. Products, prices and model names change every few months, so the durable skill is not knowing which brand is "best" this quarter: it is matching the job to the right kind of tool. Here are the categories worth knowing, what each is good and bad at, and how to choose. For current, named examples, see the dated companion list of AI tools we're watching.

General-purpose assistant

The all-rounder: a chat tool that drafts text, analyzes what you paste in, brainstorms, and handles images — think ChatGPT, Claude, Gemini, or Copilot as illustrative examples. A sensible first tool for most: pick one and learn it well.

Good at: emails, quotes, summaries, ideas, restructuring messy notes, plain-language explanations.
Weak at: current facts (training data isn't live knowledge, unless a search feature is on), and anything you cannot check yourself.
Choose one that lets you save reusable instructions and upload reference documents, offers suitable business data terms — retention and deletion controls, access management, training settings. And accept that turning training off is one safeguard, not GDPR compliance; personal data still needs its own assessment.

Source-grounded research and retrieval

A search-and-answer tool that returns a direct answer with supporting links you can inspect — Perplexity, for example, or the AI answers in search results. Reach for it when you need current facts you must be able to verify: market data, regulations, competitor checks, grants.

Good at: answers you can trace — which reduces unsupported claims if you actually open the sources: a system can cite a real page that's weak, outdated, or doesn't support the claim, so verification means reading, not seeing a link.
The workflow: take the sourced facts into your drafting tool, keep the citations attached, and verify the finished text against the originals — rewriting detaches claims from their sources. For laws, taxes and grants, the responsible government or professional source has the final word.

Document Q&A (RAG)

A tool designed to answer from documents you provide, with citations to the supporting passages — Gemini Notebook, for example. This is retrieval-augmented generation: it retrieves from your material first, then writes from it. Check the configuration though — "only my documents" is a product setting, not a law of the category; some tools blend in web results or model knowledge.

Good at: making documented institutional knowledge — manuals, procedures, product docs — easy for staff to query. (Undocumented knowledge in a colleague's head must be captured and reviewed first; no tool interviews people for you.)
Weak at: anything outside the loaded documents — and only as good as what you load: keep sources current and approved, preserve document permissions, test how it reads scans and tables, and don't ingest untrusted files, which can carry hidden malicious instructions.

Image and media generation

Generative media suits concepts, custom illustrations and fast iteration; stock or commissioned media may still win where realism, releases and predictable rights matter. Some tools make stills, others also short video — the dated list carries current examples.

Good at: original visuals on demand, quick concept iteration.
Weak at: factual accuracy and truthful depictions of real people or places.
Rules for business use: check the service terms and license for commercial use — and separately review copyright, trademark, likeness and consent risks; never publish AI images of real people or places as genuine; and keep accessibility in the loop — alt text, essential information in real text, contrast and motion checked.

Coding help

If you or your team touch any code — a website tweak, a spreadsheet formula, a small script — a general-purpose assistant already helps, and some tools plug directly into a code editor.

Good at: explaining code, drafting small functions, spotting bugs, writing formulas.
Weak at: large or safety-critical systems without expert review. Treat generated code as an untrusted draft: review the changes, keep a rollback copy, test outside production, check dependencies and licenses — and never paste passwords, keys or customer data into an unapproved tool.

Controlled local deployment

For some confidential work, you can run a locally installed model on hardware you control — with a local model runner such as Ollama, or the lower-level engine beneath it. Verify the local-only claim rather than assuming it: confirm the selected model actually runs locally, disable cloud and web features, and check the application's extensions and telemetry.

Good at: keeping data on your own machine, working offline, no per-use cloud fees (hardware, electricity and maintenance are still real costs, and each model's license must permit your business use).
Weak at: convenience — capability, speed and hardware trade-offs differ from those of cloud services, so test on your actual work rather than trusting benchmarks.
Important: local operation is one layer, not a guarantee. Device security, access control, encryption, backups, and plugin/telemetry checks all still apply — see what data is safe to put into AI.

How to choose

Name the job — and its risks. Drafting? Verifiable facts? Your own files? Images? Code? Data that must stay in-house? What review will the output need?
Pick the category that fits — the sections above.
Then pick a product within it, on the durable criteria: data-handling terms, retention and access controls, reliability, output rights, cost. That trade-off is covered in whether a paid AI service is worth it.

Categories chosen on purpose beat tools chosen on hype — and because products move fast and category boundaries blur, re-check your choices every few months.

What to do

Pick one general-purpose assistant as your main tool and learn it well.
Add a source-grounded research tool for anything you must verify — and verify by reading the sources, through to the final draft.
Use sensitive data only in an approved setup meeting your legal, retention, access and security requirements — local processing helps with data transfer, and is not compliance by itself.
For current, named examples in each category, see AI tools we're watching.