AI consulting for Chicago companies

What AI consulting is, and where it stops

Artificial intelligence consulting is advisory work. An outside advisor helps owners and executives decide which problems are worth solving with AI, what has to be true about data and people first, what could go wrong, and how to test an idea cheaply before committing money. The output is decisions and documents your team owns, not a running system.

That is the line between consulting and implementation. Consulting answers whether, where and how safely. Implementation builds and connects the system: workflow tooling is covered on our AI automation agency page and custom builds on our AI development company page. A written advisory scope gives either one a clear target.

• Find the use cases

  Interview the people who do the work, list candidate tasks and score each one on value, effort and risk.

• Check readiness

  Review the data, access rights and systems an idea depends on, and who would own it after launch.

• Set the guardrails

  Write a short AI policy, name owners and map the legal duties that apply, using the NIST framework as the skeleton.

• Design the pilot

  Fix a baseline, a success measure and a stop rule before anyone switches a tool on.

Where US companies stand today: Census Bureau Business Trends and Outlook Survey (BTOS) data from December 2025 to May 2026 show overall AI use hovering between 17% and 20% of businesses. Use rises with size: 37% of firms with at least 250 employees, 32% of firms with 100 to 249 employees and under 20% of firms with four or fewer employees reported using AI. Census changed the question in November 2025, from AI use in producing goods or services to AI use in any business function, so older BTOS figures are not comparable. These are national numbers, not a Chicago split.^[4]

A National Bureau of Economic Research working paper (data from November 2025 to January 2026) found that 18% of firms used AI in at least one business function, and that 57% of adopters used it in three or fewer functions, most often sales and marketing (52%), strategy (45%) and IT (41%). Most adopters use AI in a few places, not everywhere, which suits a ranked shortlist better than a company-wide plan.^[5]

Use-case discovery: score value, effort and risk

Discovery starts with tasks, not tools. A task is something a person repeats, with inputs and an output that someone can check: drafting a reply, matching an invoice to a purchase order, summarizing a call. We interview the people who do the work, list the candidate tasks and give each one three scores.

• Value: the hours, errors, delays or revenue the task touches today, measured from your own records and not from a vendor slide.
• Effort: whether the data exists and can be reached, how many systems must connect, and how many people must change how they work.
• Risk: what a wrong output costs, who is affected, and which laws apply (see the Illinois section below).

NIST gives a plain definition of risk that works for scoring: the combination of how likely an event is and how large its consequences would be. A task that is wrong often but cheaply is a different problem from a task that is wrong rarely but expensively, and the scores should show that difference.^[3]

Score tasks, not job titles. A Harvard Business School working paper studied 758 knowledge workers. On 18 realistic tasks inside the AI's capabilities, people using AI completed 12.2% more tasks and finished them 25.1% faster on average, with better quality. On a task chosen to sit outside those capabilities, people using AI were 19% less likely to produce a correct solution. The authors call this a jagged technology frontier: AI helps with some tasks and hurts on others, even within the same workflow.^[14]

ROI framing and pilot design without invented numbers

ROI for an AI task is a chain you can fill in from your own records: how often the task happens, how long it takes and what that time costs, how often it goes wrong and what a mistake costs, minus the cost of the tool, the review time and the training. Published studies tell you which direction to expect, not your number.

Sources: ^[13],[14]

Read these as examples for specific tasks, not forecasts. The first covers customer support agents and the second tasks built for the experiment. Neither measures your own workflow, which is the reason to run a pilot. The figures above come from the working-paper versions; a later journal version of a study can differ.^[13],[14]

1. Baseline first. Measure the task as people do it today (time, error rate, rework) before the tool is on, from your own records.
2. One success measure and one stop rule, written in the scope: what result continues the pilot and what result ends it.
3. Small group, real work. A few volunteers use the tool on live tasks, and a person reviews every output.
4. Log everything the tool does, so errors and near misses are counted and not remembered.
5. Decide in writing. At the end of the agreed window, compare against the baseline and choose to scale, change or stop.

This follows the NIST AI RMF. MANAGE 1.1 asks for a determination of whether the system achieves its intended purposes and whether deployment should proceed. MEASURE 2.3 asks that performance be measured for conditions similar to the deployment setting, and MEASURE 1.1 asks that risks you will not or cannot measure be documented instead of ignored.^[1]

Governance with the NIST AI Risk Management Framework

NIST released AI RMF 1.0 on January 26, 2023 and the Generative AI Profile (NIST AI 600-1) on July 26, 2024. NIST describes the framework as intended for voluntary use and flexible for organizations of all sizes, and it notes that small and medium-sized organizations may face different challenges than large ones. It also warns that using the framework alone will not create the accountability, culture and incentives that risk management needs. People have to do that.^[1],[2]

The Core has four functions. Govern is cross-cutting and runs through the others. Map sets the context for an AI system and supports an initial go/no-go decision. Measure uses quantitative, qualitative or mixed-method tools to assess the risks that were mapped. Manage allocates resources to mapped and measured risks. NIST says the actions are not a checklist or an ordered set of steps.^[1]

Sources: ^[1]

NIST AI 600-1, the Generative AI Profile, defines twelve risks that are new or made worse by generative AI. In our reading, five matter most for a company using chat assistants: confabulation (confidently stated but false content), data privacy, information security, human-AI configuration (over-reliance and automation bias) and value chain and component integration (untraceable third-party components).^[3]

ISO/IEC 42001:2023 is a different instrument: an international standard that specifies requirements for an artificial intelligence management system in organizations that provide or use AI-based products or services. NIST is a framework you adapt; ISO is written as requirements. A first assessment does not depend on it. Look at it if a customer, a regulator or a contract asks for a formal management system.^[22]

Data readiness, vendor choice and security basics

Data readiness is mostly about access and fit, not volume. NIST warns that data used to build an AI system may not truly represent the context of use, and that ground truth may not exist or be available. Two plain checks come first: can the tool reach the data it needs, and should it?^[1]

Permissions matter more than most owners expect. Microsoft documents that Copilot only surfaces organizational data to which a user has at least view permission, and Google documents that Gemini only retrieves Workspace content the user can already access. That makes your sharing settings part of the AI risk: an over-shared folder can end up in an assistant's answers. Cleaning up access is part of readiness.^[20],[21]

Sources: ^{[18],[19],[20],[21]}

Two cautions. A public privacy page is a disclosure; the signed agreement, including any data processing addendum, is what binds the vendor (OpenAI's page says it can execute one for ChatGPT Business, ChatGPT Enterprise and the API). And the same product name can have consumer and business versions with different terms, so approve specific plans and keep company data out of personal accounts.^[18],[19]

• Data terms for your exact plan: training default, retention, deletion, sub-processors and the data processing addendum.
• Access model: single sign-on, admin controls, audit logs, and whether the tool inherits your permissions.
• Fit for your tasks: test each shortlisted model on a sample of your own documents and score outputs against what your staff call correct.
• Exit: can you export prompts, logs and configurations, and move to another model without rebuilding?
• Evidence for claims: ask for results on your data, because unsupported AI claims draw enforcement (see the FTC item below).

Security basics come from the OWASP Top 10 for LLM Applications (2025). These are the entries a company using AI tools should turn into rules:^[15]

• Prompt injection (LLM01). Text inside an email, web page or document can steer a tool that reads it. OWASP advises restricting the model's access privileges to the minimum necessary and using human-in-the-loop controls for privileged operations.^[17]
• Sensitive information disclosure (LLM02). Decide in writing which data classes never go into a prompt, such as customer personal information, health or financial records and credentials.^[15]
• Supply chain (LLM03). Models, plug-ins and connectors come from third parties, so keep an approved list.^[15]
• Excessive agency (LLM06). Limit the extensions an agent can call, and the functions and permissions of those extensions, to the minimum necessary, and require a human to approve high-impact actions.^[16]
• Misinformation (LLM09). Treat outputs as drafts to check. NIST's related term is confabulation.^[15],[3]
• Unbounded consumption (LLM10). Set usage limits and alerts so a loop or misuse cannot run unnoticed.^[15]

Illinois and US rules that touch company AI use

• AI in employment decisions (HB 3773, Public Act 103-0804). Effective January 1, 2026, it added a provision to section 2-102 of the Illinois Human Rights Act. For recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges or conditions of employment, it is a civil rights violation for an employer to use AI that has the effect of subjecting employees to discrimination on the basis of protected classes, or to use zip codes as a proxy for protected classes. It is also a violation to fail to notify an employee that the employer is using AI for those purposes. The Act counts generative AI as AI and directs the Department of Human Rights to adopt rules on the circumstances that require notice, the time period for giving it and the means of giving it.^[6],[23]
• Who counts as an employer: the Act's definition includes any person employing one or more employees within Illinois during 20 or more calendar weeks in the year of or before the alleged violation, with other limbs for certain claims and for government bodies.^[6]
• AI video interviews (Artificial Intelligence Video Interview Act, 820 ILCS 42). An employer that asks applicants to record video interviews and uses AI analysis for Illinois-based positions must, before asking for the video, notify each applicant that AI may be used, explain how it works and what general types of characteristics it uses, and obtain consent. Videos may be shared only with people whose expertise or technology is needed to evaluate fitness, and within 30 days of a request the employer must delete the videos and instruct others to delete copies. An employer that relies solely on AI analysis to choose who gets an in-person interview must report race and ethnicity data to the Department of Commerce and Economic Opportunity each year by December 31.^[7]
• Biometric data (Biometric Information Privacy Act, 740 ILCS 14). Biometric identifiers include a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. A private entity needs a public written retention and destruction policy, and before collecting such data must inform the person in writing and receive a written release. If an AI tool identifies people by face or voice, check this first. The voice side is covered on our AI voice agents page.^[8]
• Personal information security (Personal Information Protection Act, 815 ILCS 530). A data collector holding personal information about Illinois residents must maintain reasonable security measures, and a contract for disclosing that information must require the recipient to do the same. Ask whether your AI vendor contract has that clause.^[9]
• Claims about AI in your own marketing (FTC). The FTC announced Operation AI Comply on September 25, 2024, a sweep against deceptive AI claims, and said there is no AI exemption from the laws on the books. In a later case the FTC alleged that a company advertised an AI content detector as 98 percent accurate when independent testing showed 53 percent on general-purpose content; the final order, announced August 28, 2025, bars accuracy claims unless the company has competent and reliable evidence.^{[10],[11],[12]}

One open item: the Human Rights Act amendment tells the Department of Human Rights to write notice rules. We did not verify their current status, so check the Department's site before you finalize employee notices.

Staff training and change management

A tool does not change how work gets done by being installed. NIST's framework asks that personnel receive AI risk management training for their duties (GOVERN 2.2), and that processes for operator proficiency (MAP 3.4) and human oversight (MAP 3.5) are defined and documented.^[1]

The Generative AI Profile treats human-AI configuration as its own risk: algorithmic aversion, automation bias, over-reliance and emotional entanglement with AI systems. Training therefore has to cover trusting the tool too much and too little.^[3]

• Everyone: which tools are approved, what data never goes into a prompt, how to check an output, and how to report a mistake without blame.
• Managers: how to review AI-assisted work, when employment-related uses trigger the Illinois notice duties, and how to keep a pilot honest.
• Power users: task-specific prompting and testing. They become the pilot group and the internal reference.
• Owners and executives: risk tolerance, approval thresholds and how to read the pilot scorecard.

Training can be tested like anything else. The Harvard experiment above randomly assigned people to no AI access, access to a GPT-4 model, or access plus a prompt engineering overview. In your pilot, compare trained and untrained users on the same tasks instead of assuming the training works.^[14]

Change management is mostly plain communication: name a sponsor, say in advance what the tool will and will not be used for, give people a safe channel to flag errors, and keep a named person accountable for every output that leaves the building.

How an engagement works with us, what you receive and what to prepare

1. Request

   You describe the problem or the question: which processes, which teams, what worries you.

2. Short call

   We ask about your goals, tools and limits, and tell you honestly whether advisory work is what you need.

3. Written scope

   Goal, tools in scope, approvals and the success measure, written down before anything is built.

4. Assess

   Interviews and records review, use-case scoring, data and access check, risk and rules mapping, and vendor criteria.

5. Decide and pilot

   You choose what to pilot, if anything. Pilots come before rollout. If a pilot uses an agent we run, it asks for approval on risky steps, logs every action, uses least-privilege access with its own service account, runs on accounts you own and can be switched off.

Who you work with: Media Express LLC has worked in digital since April 1995, with 2,500+ digital projects, and 100+ web properties are kept running and monitored by our own team of AI agents (Claude, ChatGPT, Gemini and open-source runtimes). See how we run AI agents for the detail.

• A ranked use-case list with the scores and the reasons.
• An AI register and a short acceptable-use policy with named owners.
• A rules map for each shortlisted use, with Illinois and federal items flagged for your attorney.
• Data and access readiness notes per use case.
• A pilot plan: baseline, success measure, stop rule and review process.
• Model and vendor selection criteria with a scored shortlist.
• A training plan by role.

To prepare: the recurring tasks that cost the most time or cause the most errors, in your staff's words; a few redacted examples of those tasks' inputs and outputs; a list of the tools you use and where company data lives; the person who can say yes; and any customer contracts or policies that limit how data may be used. The AI readiness audit is a quick way to start. If you want us to build what the assessment recommends, that is a separate written scope.

When you do NOT need a consultant

Advisory work costs time and money, so skip it when the decision is small and easy to reverse.

• You want to try a mainstream assistant on non-sensitive drafting or summarizing. Write a one-page rule on approved plans and on what stays out of prompts, use a business plan and not personal accounts, and test on a few tasks. The vendor pages in the table above explain default data terms.^{[18],[19],[20],[21]}
• The task follows fixed rules. If a rule, a spreadsheet formula or an existing software feature does the job, you do not need AI. NIST asks teams to weigh viable non-AI alternatives (MANAGE 2.1).^[1]
• You already have a defined problem and only need it built. Go straight to a scoped build, for example through our AI automation agency or AI development company pages.
• You have an internal owner with time and a mandate. NIST publishes both the AI RMF and the Generative AI Profile free of charge, and one structured workshop may be enough to start.^[1],[3]
• You need a legal opinion. That is a job for your attorney, not for an AI advisor.

If one of these fits, we will say so on the first call.

Questions answered

Sources

1. NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0) (National Institute of Standards and Technology (NIST)), accessed 2026-10-12. Four functions, subcategories in the deliverables table, voluntary and flexible for organizations of all sizes, data and training points, non-AI alternatives.https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf
2. NIST: AI Risk Management Framework (landing page) (National Institute of Standards and Technology (NIST)), accessed 2026-10-12. Release dates of AI RMF 1.0 and the Generative AI Profile, voluntary use, note that AI RMF 1.0 is being revised.https://www.nist.gov/itl/ai-risk-management-framework
3. NIST AI 600-1: AI Risk Management Framework, Generative Artificial Intelligence Profile (National Institute of Standards and Technology (NIST)), accessed 2026-10-12. Definition of risk, the twelve generative AI risks, confabulation, data privacy, human-AI configuration.https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
4. Large Firms With at Least 20 Employees Biggest AI Users (U.S. Census Bureau), accessed 2026-10-12. Business Trends and Outlook Survey (BTOS): share of US businesses using AI, December 2025 to May 2026, by firm size, and the change in question wording.https://census.gov/library/stories/2026/05/ai-use-businesses.html
5. The Microstructure of AI Diffusion: Evidence from Firms, Business Functions, and Worker Tasks (NBER Working Paper 35141) (National Bureau of Economic Research), accessed 2026-10-12. Share of firms using AI in at least one function and the functions adopters use most.https://www.nber.org/papers/w35141
6. Public Act 103-0804 (HB 3773), amending the Illinois Human Rights Act (Illinois General Assembly), accessed 2026-10-12. Employer AI use that has a discriminatory effect, zip code proxy, notice duty, rulemaking, effective date, definition of employer.https://www.ilga.gov/Legislation/publicacts/view/103-0804
7. 820 ILCS 42: Artificial Intelligence Video Interview Act (Illinois General Assembly), accessed 2026-10-12. Notice, explanation and consent before AI analysis of video interviews, sharing limit, deletion on request, demographic reporting.https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68
8. 740 ILCS 14: Biometric Information Privacy Act (Illinois General Assembly), accessed 2026-10-12. Definition of biometric identifier, written retention policy, written notice and release before collection.https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57
9. 815 ILCS 530: Personal Information Protection Act (Illinois General Assembly), accessed 2026-10-12. Data collectors must keep reasonable security measures and require them by contract from recipients of Illinois residents' personal information.https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67
10. FTC Announces Crackdown on Deceptive AI Claims and Schemes (U.S. Federal Trade Commission), accessed 2026-10-12. Operation AI Comply and the statement that there is no AI exemption from the laws on the books.https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes
11. FTC Order Requires Workado to Back Up Artificial Intelligence Detection Claims (U.S. Federal Trade Commission), accessed 2026-10-12. Allegation that a claimed 98 percent accuracy was 53 percent in independent testing; evidence requirement.https://www.ftc.gov/news-events/news/press-releases/2025/04/ftc-order-requires-workado-back-artificial-intelligence-detection-claims
12. FTC Approves Final Order against Workado, LLC, Which Misrepresented the Accuracy of its Artificial Intelligence Content Detection Product (U.S. Federal Trade Commission), accessed 2026-10-12. Final order and the requirement of competent and reliable evidence for accuracy claims.https://www.ftc.gov/news-events/news/press-releases/2025/08/ftc-approves-final-order-against-workado-llc-which-misrepresented-accuracy-its-artificial
13. Generative AI at Work (NBER Working Paper 31161) (National Bureau of Economic Research), accessed 2026-10-12. Measured productivity effect of an AI assistant for customer support agents (working paper abstract).https://www.nber.org/papers/w31161
14. Navigating the Jagged Technological Frontier: Field Experimental Evidence of the Effects of Artificial Intelligence on Knowledge Worker Productivity and Quality (HBS Working Paper 24-013) (Harvard Business School), accessed 2026-10-12. Measured effects inside and outside the AI frontier; the three experimental conditions.https://www.hbs.edu/faculty/Pages/item.aspx?num=64700
15. OWASP Top 10 for LLM Applications 2025 (OWASP GenAI Security Project), accessed 2026-10-12. The ten risk categories used in the security checklist.https://genai.owasp.org/llm-top-10/
16. LLM06:2025 Excessive Agency (OWASP GenAI Security Project), accessed 2026-10-12. Limit extensions, functions and permissions to the minimum and require human approval of high-impact actions.https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
17. LLM01:2025 Prompt Injection (OWASP GenAI Security Project), accessed 2026-10-12. Definition of prompt injection, least privilege and human-in-the-loop controls.https://genai.owasp.org/llmrisk/llm01-prompt-injection/
18. Enterprise privacy at OpenAI (OpenAI), accessed 2026-10-12. Default of no training on business data, retention and deletion, encryption, SOC 2 Type 2, data processing addendum.https://openai.com/enterprise-privacy/
19. Is my data used for model training? (Anthropic privacy center) (Anthropic), accessed 2026-10-12. Default for commercial products and the separate treatment of consumer plans.https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training
20. Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn), accessed 2026-10-12. No training on prompts, responses and Graph data; surfaces only data the user can view; stored interaction data and retention controls.https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
21. Generative AI in Google Workspace privacy hub (Google Workspace), accessed 2026-10-12. No training on customer data without permission; Gemini retrieves only content the user can access.https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub
22. ISO/IEC 42001:2023 Information technology, Artificial intelligence, Management system (International Organization for Standardization), accessed 2026-10-12. What the standard specifies and who it is for.https://www.iso.org/standard/42001
23. 775 ILCS 5/2-102: Illinois Human Rights Act, civil rights violations in employment (compiled statute) (Illinois General Assembly), accessed 2026-10-12. Shows the AI provision as subdivision (L) of section 2-102 in the compiled statute.https://www.ilga.gov/Documents/legislation/ilcs/documents/077500050K2-102.htm

How we checked this page

Last verified 2026-10-12 · Media Express LLC

General information, not legal, financial or security advice. Rules and vendor terms change; check the cited source before you rely on a figure.

Related

• AI automation agency for Chicago businessesAI automation agency
• AI development company for Chicago teamsAI development
• Is your company ready for AI agents ?Free self-check
• AI voice agents for Chicago companiesAI voice agents