What to automate first: a scoring method
Written by: Artashes Arakelian, Co-founder & COO · Published: · Updated:
Most companies have more automation candidates than capacity. This article describes the scoring method EUHub uses in workshops, with a hypothetical worked example and the steps to run it.
Why the first choice matters
A company that starts looking at AI agents usually has a long list of candidate workflows and capacity for one or two. The first one sets expectations for everything that follows. If it is a good fit, the team learns how to supervise an agent on a task where a mistake is cheap. If it is a poor fit, the lesson learned is that agents are unreliable, when the real lesson was that the task was badly chosen. A scoring method does not make the choice for you. It makes the reasons visible, so that the people who do the work and the people who carry the risk can disagree on specifics instead of on impressions.
Five criteria, scored from 1 to 5
The method is our own. It is not an industry standard, and the weights are a judgement we have found useful, not a measurement. Each criterion is scored so that a higher number always means a better first candidate. That means cost of error is scored in reverse: 5 is a mistake that is cheap and contained, 1 is a mistake that harms a person or a legal position.
The scoring table and its risk column
The last column links each criterion to the legal question it raises. The AI Act articles come from the European Commission's AI Act Service Desk, which notes that its summaries are not legally binding. The GDPR articles come from the Official Journal text of Regulation (EU) 2016/679. AI Act Articles 14 and 26 concern high-risk systems, so they matter only if your use case falls in that category; the Commission's pages are the place to check the current scope.
| Criterion | What you ask, and what 1 and 5 mean | Where the law comes in |
|---|---|---|
| Frequency | How often does the task occur? 1 is a few times a year, 5 is daily or more. | No article. It decides whether the controls below are worth setting up. |
| Clarity | Can the right answer be written as rules and examples? 1 is tacit judgement, 5 is written rules with clear answers. | AI Act Articles 14 and 26: oversight is only effective if the person can judge the output against something known. |
| Data access | Can the system reach the data it needs, with permission? 1 is paper or screens without export, 5 is an API or export you control. | GDPR Articles 28 and 32 for every vendor and system in the data path; Article 35 if the processing is likely to be high risk. |
| Cost of error (reversed) | What does a mistake cost? 1 harms a customer, a payment or a legal position, 5 is cheap and contained. | GDPR Article 22 for decisions based solely on automated processing that significantly affect a person; AI Act Articles 14 and 26 for high-risk systems. |
| Reversibility | Can a wrong action be undone? 1 is irreversible once sent, 5 is undone in one step. | AI Act Article 26: deployers monitor, can suspend use and keep logs for at least six months, for high-risk systems. |
A worked example, with made-up numbers
The following example is hypothetical and illustrative. It does not describe a real client, and the scores are not results of any project. Imagine a small distributor whose team matches supplier invoices to purchase orders by hand. We score that single workflow in the table below, with one line of reasoning per criterion, to show how the arithmetic and the discussion fit together. The reasoning is the valuable part: in a real workshop, a score without a reason is a guess.
Scoring the hypothetical invoice-matching workflow
The scores are invented for illustration. The total is the plain sum of the five scores, out of a possible 25.
| Criterion | Score | Reasoning in this made-up case |
|---|---|---|
| Frequency | 5 | Invoices arrive every working day, so there is steady volume to learn from. |
| Clarity | 4 | Most matches follow a written rule on reference and amount; a minority need judgement. |
| Data access | 3 | Purchase orders can be exported, but invoices arrive as PDF attachments that must be read first. |
| Cost of error (reversed) | 3 | A wrong match delays a payment and creates rework, but a person checks before anything is paid. |
| Reversibility | 4 | A proposed match can be rejected or changed before posting; posted entries need a correction entry. |
| Total | 19 of 25 | A promising candidate if a person approves matches before posting. |
How to read a score
We use three bands, which are again our own rule of thumb. A total of 20 or more suggests starting. A total from 15 to 19 suggests a candidate with conditions: begin with a person approving each action, for instance with one of the patterns in our article on human approval for AI agents. Below 15, leave it for later or split the workflow into smaller steps. Two rules override the total. A 1 on cost of error or on reversibility removes the candidate from the first round, because the first project should be one where being wrong is survivable. And any candidate that processes personal data goes through the GDPR questions before it is built, not afterwards.
Running the scoring in a workshop
A session of about two hours is usually enough for a list of five to ten candidates. The order matters, because scoring before the list is agreed tends to turn into an argument about favourites.
- Invite the people who do the work, one person who owns the process, and someone who can speak for data access and security. Do not score from the top down alone.
- List candidate workflows, one line each, naming the trigger, the output and the system it ends in. Stop at ten.
- Agree the five criteria and the 1 to 5 meanings in the table above, adjusting the wording to your company before anyone scores.
- Score each candidate silently and individually, then reveal the scores together.
- Discuss every criterion where scores differ by two or more points, and write down the reason for the final number.
- Apply the vetoes first, then the totals and the bands, and mark which candidates touch personal data.
- Pick one candidate, write down what a person must approve, and set a date to rescore after the first pilot.
What the method does not do
The method ranks candidates by how forgiving they are. It does not estimate savings, and it says nothing about whether an agent is technically capable of the task: that is what a diagnostic and a short pilot are for. It also cannot tell you whether a use case is high-risk under the AI Act or needs a data protection impact assessment. Those are legal judgements. Take the candidates that score well to your data protection officer or lawyer before you build. This article is general information from an engineering team, not legal advice.
Frequently asked questions
Is this scoring method an official standard?
No. It is EUHub's own working method, built from what we ask in diagnostics. The criteria and the bands are judgement, not measurement, and no regulator or standards body requires them. Adapt the wording and the thresholds to your business, and write down your reasons so the scores can be challenged.
Should we always start with the highest-scoring workflow?
Not automatically. Apply the vetoes first: a low score on cost of error or reversibility rules a candidate out of the first round whatever the total. Then compare the remaining totals and check data access and personal data questions. The highest total is a starting point for discussion.
Can the score tell us how much we will save?
No. The scores rank how safe and practical a candidate is to start with, not what it is worth. Any estimate of savings needs your own volumes, your own costs and a measured pilot. Treat any figure produced from the score alone with suspicion.