AI automation in Portugal: how to choose the first workflow

Start with a broken workflow, not an AI tool

The first useful question is where work repeatedly waits, repeats or loses context.

Map one real path from trigger to final action. Typical candidates include lead routing, support triage, onboarding checks, CRM cleanup and recurring reporting. David Dacruz’s partner page uses the same operational lens: a useful implementation has a trigger, source data, shaping steps, a destination action, logs and a fallback—not merely a prompt.^[1]

Do not automate a process that nobody owns or can explain. First agree who decides, what a correct outcome looks like and which exceptions already cause trouble. Automation magnifies a stable process; it can also magnify ambiguity.

• Write the trigger in one sentence.
• Name every source of data.
• Describe the action the system may take.
• List exceptions and the current owner.
• Record current time, backlog and error level.

Score value and risk separately

A high-volume task may be commercially attractive and still be unsafe to run without review.

Estimate value from frequency, minutes saved, delay removed, error avoided and capacity released. Then assess risk independently: data sensitivity, reversibility, customer effect, financial authority and the cost of a confident wrong answer. A single blended score can hide a valuable but high-risk workflow.

NIST’s AI Risk Management Framework asks organisations to define the task, roles, human-AI configuration and ongoing monitoring. Use that logic to choose the control: automatic execution for low-impact bounded steps, sampled review for reversible work, and explicit approval for actions with material consequences.^[2]

Build governance into the workflow

The operating controls should be designed before the pilot handles real customers or sensitive data.

Use dedicated credentials with the minimum access required. Log the input, model or rule version, output, action, reviewer and exception. Define what happens when data is missing, a tool fails or confidence is too low. A manual queue is a valid fallback.

In the EU, the AI Act’s AI-literacy duty has applied since 2 February 2025, and the Commission says supervision and enforcement for that duty starts on 3 August 2026. Teams using AI need role-appropriate knowledge of opportunities, risks and possible harm; a vendor demonstration is not a training programme.^[3][4]

Keep human review where the consequence is real

Human review must be able to change the result, not merely observe it after the action.

Require approval for refunds, account restrictions, contract commitments, hiring decisions, credit decisions, health or safety advice, and unusual customer cases. The reviewer needs enough context and time to disagree with the system.

GDPR restrictions can apply when a decision is based solely on automated processing and has legal or similarly significant effects on a person. The European Commission describes safeguards including information, human intervention and a route to contest the decision. Obtain appropriate legal and data-protection advice for the actual use case.^[5]

Run a bounded pilot and earn the right to expand

The pilot should test the operating system, not only whether the model can produce an impressive example.

Start with historical or low-risk cases, then a limited live queue. Track completion time, first-pass accuracy, exception rate, rework, customer outcome and staff effort. Include failures and silent corrections; a faster queue is not an improvement if cleanup moved elsewhere.

Set stop, revise and expand rules before launch. Expand only when the measured gain survives normal variation, the error pattern is understood and the team can operate the review queue. Increase one dimension at a time: volume, data access, action authority or use-case breadth.