What is an AI audit?

Four layers.

1. Workflows. Every repeated process, step by step, as it really runs: who does it, how often, how long it takes, where it waits and where it goes wrong.
2. Data. Where the information for each process lives, whether it is consistent, and whether a system can reach it (an API, an export, a shared inbox) or only a person can.
3. Tools. What you already pay for, what is underused, and what could be connected instead of replaced.
4. Risk and governance. What data is sensitive, what rules apply (in the UAE that can include the federal data protection law, plus DIFC or ADGM rules if you operate there), what AI tools staff already use informally, and where a human must stay in the loop.

A written plan, not a slide deck. For each opportunity:

• The process it changes, in plain words.
• What it costs today in hours and, where relevant, money or delay.
• What would change: the trigger, the steps and the output of the proposed workflow.
• Effort and build route: Zapier, Make, n8n or custom code, and why.
• Risks and guardrails: where a person approves, what data is involved.
• Order: what to do first, second and later, and what to leave alone.

The plan is written so any competent builder could act on it, including your own team.

Here is the format, filled in for a hypothetical business:

Process: supplier invoice logging. Today: an assistant downloads PDFs from the accounts inbox, types supplier, amount, VAT and due date into the accounting tool. Runs daily. Proposed workflow: trigger on new attachment in the accounts inbox → AI step extracts fields into a fixed format → check against the supplier list and purchase orders → create a draft bill in the accounting tool → anything unmatched goes to a review queue. Build: n8n, with the accounting tool's API. Guardrail: bills are created as drafts; a person approves payment. Order: first. Frequent, clear rules, data already in one inbox.

Worth it when:

• You know you are losing time but cannot say exactly where.
• Several departments have different ideas about what to automate.
• Staff are already using AI tools informally and nobody has a picture of it.
• You want to see the full list before committing budget.

Skip it when you already know the exact process you want automated and it is well defined. Go straight to scoping the build.

Say you run two physiotherapy clinics in Dubai with a shared reception team of four. An audit would likely find:

• Reception answering the same WhatsApp questions about prices, insurance and parking many times a day.
• Manual reminder calls the day before appointments, with no-shows still common.
• Insurance pre-approval forms filled by hand from patient records.
• A weekly utilisation report built in a spreadsheet by the practice manager.

Ranked by return against effort, reminders and the weekly report come first (frequent, clear rules, data in the booking system). WhatsApp answers come next, with an AI step answering only from an approved list and handing anything clinical to reception. Insurance forms come later, after a check on what patient data can go where. The plan would also note that informal use of a public chatbot for drafting patient letters should stop until an approved tool is in place.

Our audit has four stages. Immersion: we sit with your team and watch how work flows. Diagnosis: we surface the gaps, the overloaded people and the repetitive tasks, each with an hours figure. Opportunity mapping: we rank what is worth automating by return against effort, and say what to leave alone. Roadmap and handover: you get the prioritised plan and a walkthrough with your team, so everyone is ready to act, with us or without us.

Audit length depends on the size of the business. We do not need you to prepare documentation first, only time with the people who do the work and a look at the tools they use.