The 2026 small-shop AI starter kit

People keep asking me a version of the same question. "We're a small shop (twenty people, maybe forty) and we know we need to get serious about AI this year. What do we actually buy?"

I've answered it ad hoc enough times that I want it written down. Here's what I'd give a 5–50 person organization in May 2026 if they handed me the keys and said "build the stack."

Two notes before the picks. First, the right answer in 2026 is a hybrid: hosted frontier models for the heavy lifting, a small local footprint for the work that should never leave your perimeter. Anyone selling you all-cloud or all-local at this size is selling you their preference, not your fit. Second, I'm naming categories more than I'm naming vendors, because the vendor list will shift twice between when I write this and when you read it. The categories won't.

The layer that does the work

You need one frontier-class hosted model under contract. One. Not three. The temptation at this size is to wire up every API you can get a key for; resist it. Pick the provider whose enterprise terms you can actually read and whose data-handling story you can explain to your board, and standardize. The model quality differences at the top of the leaderboard are small enough in mid-2026 that procurement terms matter more than benchmark points.

Budget: $30–$60 per seat per month for the assistant product, plus API consumption for whatever you build on top. For a 25-person shop running normal usage, you're looking at $1,500–$3,000/month all in. That number is real and it's the floor, not the ceiling.

Alongside the hosted model, run a small local stack. A single workstation or a modest GPU box, an open-weights model in the 30–70B range, and an inference server you didn't write yourself. This is not where your team does their daily work. This is where the sensitive documents, the HR matters, the data subject to contractual obligations to stay on your network, and the experimental fine-tunes live. The local stack is your privacy backstop and your cost-control lever. It is not your primary surface.

Budget for local: $4,000–$12,000 one-time for hardware, then someone's time to keep it running. Don't pretend the time cost is zero.

The layer that holds context

A retrieval layer is the part most small shops skip and then regret. Your AI is only as useful as the context it can pull from, and at 5–50 people the context that matters lives in three places: your document store, your chat history, and whatever wiki or knowledge base you've accumulated.

Pick a retrieval product that connects to those three. The market has settled enough by 2026 that this is a real category with real options; you do not need to build it. What you do need is an honest read on what it indexes and where the embeddings live. If the answer to "where does our institutional knowledge get vectorized" is "a vendor's cloud you've never audited," that's a decision, not a default.

Budget: $10–$25 per seat per month, depending on connector count.

Want to go deeper on what "retrieval layer" actually means? I wrote up the home-scale version in A local-first second brain, how I built mine. Same idea, smaller hardware.

The layer that does the orchestration

For anything more interesting than chat, automations, agent workflows, the long-running tasks that actually move the needle on productivity, you need an orchestration layer. In 2026 this means an agent framework with human-in-the-loop checkpoints, audit logging that survives an external review, and the ability to swap model providers without rewriting your workflows.

Don't build this from scratch. The frameworks are good enough now that the build-vs-buy math has flipped for shops your size. What you should build is the specific workflows on top of it: the three or four agentic processes that map to your actual operations.

Pick those workflows carefully. The right first ones are the boring ones (inbox triage, document drafting, internal-question routing) not the ambitious ones. The ambitious ones come after you've earned the operational muscle on the boring ones.

Governance a small shop can actually run

This is where most of the advice you'll read gets unhelpful, because it's written for enterprises. At 5–50 people, your governance has to be lightweight enough to actually exist.

The minimum I'd hold:

A written AI use policy. One page. What the team can put into hosted models, what they can't, where the local stack is for, what gets human review before it goes out. Refresh it every six months because the answers will move.

A data classification scheme tied to model routing. Three tiers is enough. Public, internal, restricted. Public can go to any hosted model under your contract. Internal can go to your contracted hosted model under your enterprise terms. Restricted goes to the local stack or nowhere. If you can't classify a document in under thirty seconds, your scheme is too complex.

A logged inventory of agentic workflows. Every long-running automation gets an owner, a description of what it does, what it touches, and a kill switch the owner knows how to use. This is the document that saves you when something goes sideways at 11pm on a Friday.

A quarterly review. Sit down for an hour, look at the inventory, look at the bills, look at what's actually being used. Cut the things that aren't working. Rotate the things that are.

I've written before about governance for a team of one and the principle scales: the governance you actually run beats the governance you wrote down and forgot.

The privacy lines I'd hold

A few specific lines, because these are the ones small shops get wrong most often.

Data with confidentiality obligations does not go to a hosted model unless the hosting contract plainly covers it and the underlying obligation to the data owner plainly permits it. Both, not either. This is the line where the local stack earns its cost in any small-shop setup that runs into the question.

Employee data, performance notes, comp discussions, the messy interpersonal stuff that lives in your HR system, does not go to a hosted model. Ever. The local stack handles this or you do it by hand. I will die on this hill.

Anything that would embarrass you if it appeared in training data should be treated as if it might. Most enterprise terms in 2026 are clean on this, but "most" is not "all," and the cost of being wrong is asymmetric.

What the total looks like

For a 25-person shop running this stack: $4,000–$8,000/month operating: $5,000–$15,000 one-time for the local hardware, and one person spending roughly 20% of their time keeping the whole thing coherent. That's the honest number. Anyone quoting you less is either subsidizing or skipping something that matters.

The productivity story has to clear that bar. For most shops it does, not because AI is magic, but because the work it absorbs is real work that was being done by people who'd rather be doing something else. The displacement question is real and I've written about it elsewhere; what I'll say here is that the shops doing this well are running smaller-but-better, with the humans doing higher-leverage work than they did before. The collaboration model wins. The pure cost-cut model gets the short-term margin and the long-term damage.

If you only do one thing this quarter

Pick the hosted model. Sign the enterprise contract. Write the one-page policy. Classify ten documents into the three tiers. That's the week-one work. Everything else can follow.

The shops that get the most out of this in 2026 are the ones that started small and operational, not the ones that bought the most ambitious platform on day one. The starter kit is a starter kit because the starting matters more than the kit.