Automating website operations starts with an audit: a 30-task inventory and how to decide what AI handles (2026)

"We can't keep up with site updates and enquiries, so we'd like AI and automation to take some of the load." Over the past year we have heard this far more often, from businesses in Japan and in the Netherlands alike.

The first thing we ask for is not a tool choice. It is a list: who spends how many hours a month on which tasks. Once it is written down, tasks that looked easy to automate often turn out to be bundles of judgement calls. And checks someone repeats by hand every week sometimes disappear with a single setting.

This article explains how to audit website operations as 30 tasks, and how to decide which tasks AI and automation may handle and which they may not. The evidence comes from primary sources: Google Search Central and web.dev, the W3C, the European Commission (AI Act), the Dutch Data Protection Authority (AP), Japan's Ministry of Internal Affairs and Communications and Personal Information Protection Commission, Eurostat, Gartner and Patchstack.

Main sources behind this article

• Google Search Central: guidance on AI-generated content (February 2023), spam policies, and using generative AI content
• European Commission FAQ on Article 50 transparency obligations and the article text on the AI Act Service Desk (applicable from 2 August 2026)
• Eurostat, "Use of AI in enterprises" (2025 survey, published December 2025) and Japan's 2026 White Paper on Information and Communications
• Warnings from the Dutch Data Protection Authority (AP) on AI chatbots and AI agents
• W3C WAI "Selecting Web Accessibility Evaluation Tools", web.dev "Web Vitals", Patchstack "State of WordPress Security in 2026"

What you will learn	Key answer
How widespread are AI and automation?	20.0% of EU firms used AI in 2025. In Japan, 68.9% have a generative AI policy (section 1)
What goes into the audit?	30 tasks across 6 areas, recorded in 7 columns (sections 3–4)
How do you decide what to hand over?	Five questions, starting with "is the result defined from outside?" and "can it be undone?" (sections 5–6)
What do Google and EU rules require?	Mass generation is spam. Chatbots must say they are AI. Human review matters (sections 7–8)
What does it cost?	Three approaches; 37 hours a month down to about 23 (section 9)
Where do I begin?	A six-week plan and a checklist (sections 10 and 15)

1. What is happening: more firms use AI, and the rules have started to bite

First, the numbers outside website operations. Over the past two years, the share of businesses using AI at work has grown visibly in both Europe and Japan.

What sets 2025–2026 apart is that rules now apply to how AI is used. When you automate operations, you need to decide not only what is possible but how to use it without creating problems.

Europe: firms using AI rose from 13.5% to 20.0% in a year

According to Eurostat, the share of enterprises with 10 or more employees using AI technologies was 8.1% in 2023, 13.5% in 2024 and 20.0% in 2025, a rise of 6.5 percentage points in one year.

Size matters a lot. In 2025, 17.0% of small firms (10–49 employees), 30.4% of medium-sized firms (50–249) and 55.0% of large firms (250+) used AI. Among AI users, the most common purpose was marketing or sales (34.7%), which overlaps with website operations.

By country, Denmark is highest at 42.0%, followed by Finland and Sweden. Eurostat notes a break in the Dutch time series in 2025, so we do not compare the Netherlands here.

Japan: 68.9% of firms have a generative AI policy

In Japan, the 2026 White Paper on Information and Communications from the Ministry of Internal Affairs and Communications reports a corporate survey. The share of firms with a policy to "actively use" generative AI or "use it in limited areas" was 49.7% in the FY2024 survey and 68.9% in the FY2025 survey.

Large firms stood at 74.0% and SMEs at 58.1%. The white paper notes that Japan is still behind the US, Germany and China. Note that this measures whether a policy exists, while Eurostat measures actual use. Do not compare the Japanese and EU figures directly.

Rules: the AI Act's transparency obligations apply from 2 August 2026

The EU AI Act applies in stages. On 2 February 2025, Article 4 started to apply, requiring organisations that use AI to take measures supporting their staff's AI literacy. On 2 August 2026, Article 50, covering chatbot disclosure and labelling of AI-generated content, started to apply.

The 2026 Digital Omnibus amending the AI Act pushed back some high-risk deadlines, but the Article 50 date did not move. The only grace period covers machine-readable marking (Article 50(2)) for generative systems already on the market; their providers have until 2 December 2026.

Rule	Applies / published	Impact on site operations
AI Act Art. 4 (AI literacy)	From 2 Feb 2025	Measures to support staff understanding. No specific level is mandated
AI Act Art. 50 (transparency)	From 2 Aug 2026	Chatbots must be recognisable as AI. Public-interest text: label or human review
Google spam policies	Expanded March 2024	Mass generation without added value is "scaled content abuse"
European Accessibility Act	From 28 Jun 2025	Covered services such as e-commerce must be accessible. Microenterprise service providers are exempt
GDPR	Since 2018	Same principles for personal data given to AI. Processor contracts (Art. 28)

The takeaway: in 2026, deciding the scope of automation is also how you comply. If you decide who checks which task, the same table explains your AI Act human review and your GDPR records.

2. Why start with an audit?

A common situation we see: "We installed a tool that looked useful, but nobody actually looks at it." Alerts arrive daily, AI drafts pile up, and staff end up doing more work, not less.

The cause is not the tool. It is starting before deciding what to hand over, what people keep, and who checks what, where.

Automation fails because of how scope is set

In June 2025, Gartner predicted that over 40% of agentic AI projects will be cancelled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls.

Around the same time it predicted that, by 2027, 50% of organisations that planned to significantly cut customer service staff because of AI will abandon those plans. In a poll of 163 customer service leaders, 95% said they would keep human agents.

Neither says AI is useless. They say that if the scope is too wide, costs and checking effort outweigh the gains. The same happens in website operations.

What an audit reveals

Writing tasks down shows you the following. Automate without knowing them, and you cannot measure the effect or trace failures.

What the audit reveals	If you start without it
Which tasks eat time	You automate a 5-minute task and keep the 10-hour one
Which tasks need judgement	AI makes the call and a wrong answer goes out
Which failures would hurt	An auto-update breaks the site and nobody knows how to roll back
Who checks what	Unchecked automations multiply and nobody reads the results
Which tools are in use	You pay for several tools that do the same thing

The audit is also the baseline for comparing workload before and after. Without a starting figure, you cannot say six months later whether things got easier.

3. Split website operations into six areas

Website operations involve more kinds of work than most people expect. Start by splitting them into six broad areas so nothing is missed.

As a "model site" we use a 30-page corporate site in two languages (e.g. Japanese and English), four blog posts a month, 40 enquiries a month, running on WordPress, with monthly hours per area. These are working estimates DevNJ set from typical task durations, not measured statistics; they vary with size and team.

Area	Main tasks	Frequency	Hours/month (estimate)
Updates & maintenance	CMS and plugin updates, backups, certificates	Daily to weekly	4
Monitoring & measurement	Uptime, speed, broken links, forms	Continuous to monthly	3
Content	Planning, writing, checking, translating, images	Weekly+	16
SEO & search	Search Console, metadata, reports	Weekly to monthly	4
Enquiries	Routing, replies, chat, quotes	Daily	8
Compliance & quality	Accessibility, cookies, legal notices, access rights	Monthly to yearly	2

The total is 37 hours a month, a little over 9 hours a week. In a company without a dedicated web person, that time comes out of someone's main job.

As the figure shows, content takes over 40% of the time. Yet automation pays off most clearly in the small areas, updates and monitoring. The bigger an area, the more judgement it involves, and the less of it can be handed over.

Updates and monitoring: fixed procedures, repeated

These two areas follow fixed steps, and results can be judged as "succeeded" or "failed". They are the first candidates for automation.

Updates, however, hurt badly when they fail. Patchstack reports 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on 2024. 91% were in plugins and 9% in themes; WordPress core had six. 46% had no patch when they were disclosed, and for heavily exploited vulnerabilities the median time to first exploitation was five hours.

A weekly manual update round cannot keep up with that. The realistic answer in 2026 is to automate updates and make backups and restores solid instead.

4. Build the inventory: 30 tasks and how to fill them in

Now for building the inventory itself. Use a spreadsheet, one task per row, and fill in the seven columns below.

You do not need to get it perfect at once. Note each task as you actually do it for a week, and you will catch tasks you would never think of at a desk.

Seven columns to fill in

Column	What to write	Example
Task	Short name starting with a verb	Update plugins
Frequency	Daily / weekly / monthly / quarterly / ad hoc	Weekly
Time per run	Measured, as far as possible	30 min
Owner	Name or role	Office manager
Tool	Service or feature used	WordPress dashboard
Impact if it fails	Site down / wrong info / legal / minor	Site down
Judgement needed	Yes / no / sometimes	Sometimes

The "impact if it fails" and "judgement needed" columns feed into the criteria in section 5. Never leave these two blank; they matter more than anything else in the inventory.

Example inventory: technical and monitoring (10 tasks)

Below are the model site's 30 tasks in three tables. The "Tier" column on the right is the result of applying the criteria in sections 5–6. First, technical and monitoring work.

Task	Frequency	Time per run	Tier
CMS and plugin updates	Weekly	30 min	Fully automated (with backups)
Taking backups	Daily	—	Fully automated
Test restore from backup	Quarterly	2 h	Human (steps automated)
Uptime monitoring	Continuous	—	Fully automated
SSL certificate renewal	Every 90 days	15 min	Fully automated
Speed measurement	Weekly	30 min	Fully automated
Diagnosing and fixing slowdowns	Ad hoc	2–6 h	AI draft + human
Broken-link detection	Monthly	1 h	Fully automated
Form submission test	Weekly	20 min	Fully automated
Deciding on security alerts	Ad hoc	30 min+	Human

Seven of the ten technical tasks can be fully automated. What stays with people is the restore test and decisions when an alert fires. The more you automate, the more you need to decide who notices when something stops.

Example inventory: content and SEO (10 tasks)

Next, content and SEO. Here "AI draft + human" dominates.

Task	Frequency	Time per run	Tier
Choosing article topics	Monthly	2 h	AI draft + human
Drafting articles	4 a month	3 h	AI draft + human
Checking facts, figures, sources	4 a month	1 h	Human
Titles and meta descriptions	4 a month	20 min	AI draft + human
Image alt text	20 images a month	2 min	AI draft + human
Translation (two languages)	4 a month	2 h	AI draft + human
Checking Search Console errors	Weekly	20 min	Fully automated (alerts)
Monthly traffic and ranking report	Monthly	2 h	Fully automated
Deciding improvements from the report	Monthly	1 h	Human
Listing old articles to update	Quarterly	2 h	Fully automated

What can be fully automated here is collecting and laying out numbers. Deciding what to rewrite and what comes first stays with people. Fact-checking is "human" rather than "AI draft + human" because having AI check and then checking the AI usually means doing the work twice.

Example inventory: enquiries and compliance (10 tasks)

Finally, enquiries and compliance: words that leave the company, and tasks you may be held accountable for.

Task	Frequency	Time per run	Tier
Routing enquiries	Daily	15 min	Fully automated (rules + AI sorting)
Filtering sales pitches and spam	Daily	10 min	Fully automated
Replying to common questions	Daily	30 min	AI draft + human
First response in chat	Continuous	—	AI (disclosure and human route required)
Answering quotes and prices	Ad hoc	1 h	Human
Automated accessibility scan	Monthly	30 min	Fully automated
Manual accessibility check	Quarterly	3 h	Human
Changing cookies and tracking tags	Ad hoc	1 h	Human
Updating company details and legal notices	Yearly+	30 min	Human
Reviewing admin access rights	Quarterly	1 h	Human (list generated automatically)

Across all 30 tasks, that gives 13 fully automated, 8 AI draft + human, 1 AI with conditions, and 8 human. Nearly half can be handed over, but the most time-consuming tasks keep a human in the loop.

5. Criteria for what to hand over

With the inventory done, judge each row: can it be handed over? To avoid going back and forth, fix five questions in advance.

The questions are designed to give the same answer whoever applies them. Don't decide on gut feeling that "AI could probably do this".

Criterion 1: is the correct result defined from outside?

Tasks such as "was the backup taken?", "does the page return 200?" or "is LCP 2.5 seconds or less?" have a correct result set by an external standard, so a machine can judge them. web.dev defines "good" Core Web Vitals as LCP of 2.5 seconds or less, INP of 200 milliseconds or less and CLS of 0.1 or less, assessed at the 75th percentile of real users. Tasks with numeric thresholds like these suit automation.

By contrast, "is this article useful to readers?" or "is this reply polite?" have no external standard. AI can give an answer, but a person has to confirm it is right.

Criterion 2: can a failure be undone?

A plugin update can be rolled back if you have a backup. A draft does no harm until it is published. Tasks that can be undone may be handed over even if they sometimes fail.

Sent emails, published prices, deleted data and personal data sent to a third party cannot be undone. Even if you automate them, a person presses the final button.

Criterion 3: does it become a company commitment?

Prices, delivery dates, contract terms, refunds and incident explanations become company commitments once they are out. An AI answer sent from your website or mailbox is still your company speaking.

Article 50 of the AI Act also exempts public-interest text from labelling when a person has reviewed it and someone holds editorial responsibility. Placing responsibility with a person now matters legally too.

Criterion 4: does it touch personal data or confidential information?

Enquiry content, customer lists, quotes and admin passwords can create problems as soon as you give them to an AI service. Section 8 covers the warnings from Dutch and Japanese authorities.

Touching such data does not automatically mean "don't hand it over". If you choose a service whose contract rules out training on your data, and you decide what may be entered, there are drafting tasks where AI can still help.

Criterion 5: are frequency and volume worth it?

Building automation for a 30-minute task that happens once a year does not pay; maintaining the automation takes longer.

As a rule of thumb, consider automating tasks that occur at least monthly and add up to more than one hour a month. Below that, a clear written procedure is usually enough.

Here are the five criteria as questions to add to the inventory.

Criterion	Question for the inventory	If yes
1. Result defined from outside	Can success or failure be judged by a number or state?	Suits automation
2. Can be undone	Can it be rolled back, or stopped before publication?	Suits automation
3. Commitment or liability	Does it involve prices, contracts, apologies or legal notices?	People keep it
4. Personal data	Does it send customer or confidential data to a third party?	Set input rules and contracts first
5. Frequency and volume	At least monthly, over 1 hour in total?	Worth considering

Criteria 1 and 2 ask "may it be handed over?", 3 and 4 ask "is there a reason not to?", and 5 asks "is it worth it?". A task becomes a candidate only when all three views agree.

6. Three tiers: fully automated, AI drafts with human approval, kept by people

Of the five criteria, 1 (result defined from outside) and 2 (can be undone) do the most work. Use them as the two axes and tasks fall into four quadrants.

In practice it is easiest to run three tiers: top right is "fully automated", top left and bottom right together are "human approval in between", and bottom left is "kept by people".

Tasks you can fully automate

These have a clear right answer and can be undone. On the model site: updates, backups, uptime monitoring, certificates, speed measurement, broken links, form tests and spam filtering.

There is one condition for full automation: always attach a way to notify a person when it fails. WordPress plugin auto-updates (available since version 5.5) run twice a day and email the result, success or failure. The official documentation also recommends making sure you can roll back before enabling them.

Tasks where AI drafts and a human approves

These are tasks without a clear right answer that can be undone (article drafts, alt text, translation, reply drafts), plus tasks with a clear answer that are hard to undo (publishing, sending, deleting). In both cases, a person presses the final button.

The key is not to let approval become a formality. The European Commission's FAQ explains that, for the AI Act's human review, superficial or purely formal checks such as spell-checking are not enough. Someone who understands the content has to examine its substance.

Tasks people keep

These have no clear answer and cannot be undone: price quotes, replies involving contracts or refunds, decisions during incidents or data breaches, the content of legal notices, and granting access rights.

Even here, gathering material can be automated. Let machines produce the list of access rights or collect the logs you need during an incident, and leave only the decision to a person.

For each tier, here is how people are involved and what to record.

Tier	Main tasks	Human role	Record to keep
Fully automated	Updates, backups, monitoring, measurement	Respond to failure alerts	Run logs, alert history
AI draft + human	Articles, translation, alt text, reply drafts	Check, edit and approve	Approver, date, whether edited
Auto + approval	Publishing, bulk sends, deletion	Check target and content before running	Approver, target, time
Kept by people	Prices, contracts, incidents, legal notices	Decide; let AI gather material if useful	Reason for decision, people involved

The record column exists so you can explain later who checked what. When someone asks about AI Act or GDPR compliance, this table is your answer.

7. Google's policies: AI-written articles and descriptions

When automating content, the first worry for most people is Google. Since February 2023, Google's position has been consistent.

In short: using AI does not change how content is evaluated, but mass generation without added value is penalised.

Quality counts, not how content is made

Google Search Central's post "Google Search's guidance about AI-generated content" (February 2023) says Google focuses on quality rather than how content is produced. Its guidance on helpful, people-first content suggests asking who created it, how, and why.

On "how", it suggests explaining the use of automation or AI where readers would reasonably wonder. It also states plainly that using AI-generated headshots or made-up names to suggest a human expert is deception.

Mass generation is "scaled content abuse"

Google's spam policies include "scaled content abuse": generating many pages primarily to manipulate search rankings, however they are made.

Examples include using generative AI to produce many pages that add no value, mass-producing pages from other sites through automated changes such as synonyms or translation, and stitching content together. Translation is named explicitly, which is easy to miss when automating a multilingual site.

Metadata, structured data and alt text need checking too

Google's page on using generative AI content notes that AI output can be inaccurate and asks publishers to fact-check and review it before publishing. That applies not only to body text but also to titles, meta descriptions, structured data and image alt text, because they can appear in search results.

E-commerce has more specific rules. AI-generated product images must carry IPTC DigitalSourceType metadata set to TrainedAlgorithmicMedia, and AI-generated product titles and descriptions must be specified separately.

Translated into operating rules, Google's policies look like this.

Google's policy	Operating rule
Quality counts, not production method	Don't ban AI. Define quality standards first
Mass generation without value is spam	Put something only you can say into every piece. Don't set volume targets
Mass automated translation is covered	Have someone read each language. Don't publish languages nobody can read
Fact-check and review before publishing	A person checks figures, names and sources, and the checker is recorded
Metadata and alt text count	Even if generated in bulk, review the list before publishing
Fake authors are deception	Bylines are real staff or the company. Explain AI use where relevant

Of these, "don't set volume targets" has the most effect. AI makes it easy to publish more, so volume becomes a tempting goal, and that is the fastest route towards the spam policy.

Automating multilingual sites and hreflang

For sites in several languages, such as Japanese–English or English–Dutch, automating translation saves a great deal of time. Google explains how to declare language and regional versions of pages with hreflang.

But correct hreflang says nothing about translation quality. Machine translation published as is moves towards the "automated changes" in the spam policy. The safe rule: don't create pages in a language nobody on your side can read.

8. European rules: AI Act, GDPR and accessibility

For sites aimed at European users, EU and Dutch rules come on top of Google's policies. They can matter for Japanese businesses too, if they offer services to users in Europe.

We cover only the parts directly relevant to automating site operations. For individual cases, consult a legal professional.

AI Act Article 50: chatbot disclosure and AI-written text

Article 50(1) requires providers to design AI systems that interact directly with people so that people know they are dealing with AI, unless this is obvious to a reasonably well-informed user. The Commission's FAQ says the "obvious" exception should be read narrowly and that people must be informed clearly from the first interaction.

Article 50(4) requires deployers to disclose AI-generated or manipulated text published to inform the public on matters of public interest. The exception is text that has undergone human review or editorial control, where a natural or legal person holds editorial responsibility.

Whether ordinary product descriptions or company pages count as "public interest" is not settled in the FAQ. Consumer safety is listed among public-interest topics, so it is prudent to assume that some content may fall within scope. Breaches can lead to fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher.

GDPR and warnings from the Dutch authority

Pasting enquiry content or customer lists into an AI service hands personal data to a third party. Under the GDPR, a processor needs an Article 28 contract, and a data breach generally has to be reported within 72 hours (Article 33).

In August 2024 the Dutch Data Protection Authority (AP) warned that it had received data breach reports where employees entered personal data into AI chatbots. Examples included a GP practice where patient data was entered and a telecom company where a file of customer addresses was entered. The AP noted that even use permitted by the organisation can breach the law, and asked organisations to agree which data may be entered.

In February 2026 the AP also warned against using experimental AI agents with broad access to email and files (such as OpenClaw) on systems holding personal or confidential data. It pointed to the risk of hidden instructions in web pages or emails steering the agent (prompt injection). Avoid giving an AI agent broad rights over your website's admin panel.

In October 2025 the AP and the Dutch Authority for Consumers and Markets (ACM) issued a joint call on AI chatbots in customer service, asking among other things that a human remains reachable.

Accessibility cannot be determined by automated checks

The European Accessibility Act has applied since 28 June 2025, and covered services such as e-commerce must be accessible. Microenterprises providing services (fewer than 10 employees and annual turnover or balance sheet of no more than €2 million) are exempt, but business customers increasingly ask for it anyway.

The W3C's WAI explains that evaluation tools cannot determine accessibility; they can only assist. Even with "0 errors" in an automated scan, only a person can confirm whether the site works with a keyboard and makes sense through a screen reader.

Here are the European rules as operating requirements.

Rule	Applies to	What operations need
AI Act Art. 50(1)	Chatbots on your site	Say "AI answers here" on the first screen
AI Act Art. 50(4)	AI text on public-interest matters	Human review with editorial responsibility, or label as AI
AI Act Art. 4	Organisations using AI	A procedure for use and checks, briefing for staff
GDPR Arts. 28 and 33	Personal data given to AI	Check processor contracts, input rules, breach procedure
European Accessibility Act	Covered services such as e-commerce	Automated scans plus regular human checks

Every item in the right-hand column overlaps with the "record to keep" column in section 6. Deciding the scope of automation and keeping records is your preparation for European rules.

9. Ranges for cost and effort

The cost of automation depends heavily on how far you build it. Here we split the approach into three stages with ranges for setup effort and monthly tool costs.

Amounts are in euros. If you think in yen, convert at the current rate, since the exchange rate moves. Effort is in hours, so it compares directly in Japan and Europe.

Three approaches

Approach	What it involves	Setup effort	Tools per month
Stage 1: configure existing features	Auto-updates, backups, monitoring, Search Console alerts	4–8 h	€0–30
Stage 2: integrations and AI drafts	Enquiry sorting, reports, article and translation drafts	20–60 h	€30–150
Stage 3: purpose-built system	Automated tests in staging, approval-based publishing	80–200 h	€100–500

These ranges are DevNJ's working estimates, not measured statistics, and change with site size and existing systems. Stage 1 alone removes most of the update and monitoring work. Beyond that, compare gains against checking effort as you go.

Expected time savings

For the model site (37 hours a month), here is what we expect after stages 1 and 2, by area. "After sorting" includes time spent checking AI output.

Area	Now (h/month)	After sorting (h/month)	Why it drops
Updates & maintenance	4	1.5	Automated updates and backups
Monitoring & measurement	3	1	Automated monitoring, measurement, link checks
Content	16	11	AI drafts, translation, alt text; checking remains
SEO & search	4	2.5	Automated reports
Enquiries	8	5	Routing and reply drafts
Compliance & quality	2	2	More automated scans, but checks are not cut

In total, 37 hours a month becomes roughly 23, a saving of just under 40%. Trying to cut more than half means cutting the checks on content and enquiries, which sharply raises the risks in sections 7–8.

How to think about the return

Whether automation pays is a simple sum: hours saved × internal hourly cost − tool costs − maintenance hours × internal hourly cost. Is it positive?

On the model site, about 14 hours are saved per month, and stage 2 tools cost €30–150 a month. If maintaining the setup takes 2–3 hours a month, that leaves about 11–12 hours a month. The initial 20–60 hours are recovered in roughly two to five months.

Saved time partly becomes checking time

AI drafts arrive fast, but there is more to check. If a draft goes from three hours to one, but fact-checking and editing take an hour and a half, the real saving is 30 minutes.

Never leave checking time out of the estimate; it is the main safeguard against overestimating the benefit. Japan's AI Guidelines for Business (MIC and METI, version 1.1) also call for human judgement at appropriate points and for measures against over-reliance on automated systems (automation bias).

10. Implementation: a six-week plan

Here is a six-week route from audit to routine. Start small and expand once you have seen the effect.

Fixing a deliverable for each stage makes it less likely to stall.

1. Weeks 1–2: write the tasks down. Add a row each time you actually do a task. Measure frequency and time per run
2. End of week 2: fill in impact and judgement. The owner and their manager decide "impact if it fails" and "judgement needed" together
3. Week 3: sort with the five criteria. Put each task into fully automated, AI draft + human, or kept by people, and decide checkers and records
4. Week 3: set input rules. One page listing what may and may not be entered into AI services, shared with everyone involved
5. Weeks 4–5: pilot just 3–5 tasks. Begin with stage 1 settings (auto-updates, backups, monitoring) and limit AI drafting to a single task
6. End of week 5: compare before and after. Record effort including checking time, and revert tasks that did not get faster
7. Week 6 onwards: review monthly. Check that alerts are read and approvals are not a formality, then add the next tasks

The condition for having something working in six weeks is not trying to automate everything at once. Pilot only three to five tasks.

11. Common failures

These are failures we often see among businesses that have started automating, with ways to prevent them. Most happen when the audit and sorting are skipped.

Failure	What happens	Prevention
Auto-updates without backups	An update breaks the site and it can't be restored	Daily backups and a quarterly restore test
Nobody reads the alerts	Monitoring stops and nobody notices	Send alerts to a shared inbox, not one person. Check monthly
Mass-producing articles with AI	Content thins out and approaches the spam policy	No volume targets. Add your own expertise to each piece
Publishing raw machine translation	Mistranslations erode trust and hurt search	Someone who reads each language checks it
Chatbot quotes prices	A wrong price is treated as a commitment	Don't let it answer price or delivery; offer a human route
Relaxing at "0 errors"	Issues automated scans miss remain	Quarterly keyboard and screen reader checks
Pasting customer data into AI	It may have to be reported as a data breach	Input rules and checking that data isn't used for training
Admin rights for an AI agent	Hidden instructions steer it and data leaks	Minimal rights; people press publish and delete

Five of the eight come from removing human checks. The other three come from having no way to notice a failure. When designing automation, decide "where it stops" as carefully as "what it does".

12. Japan and Europe compared

If you run sites for both Japanese and European audiences, the points to watch when automating differ slightly. Here they are as differences in how the rules work.

This is not about which is stricter. Japan sets direction through guidelines and warnings; the EU sets obligations in regulation.

Topic	Japan	Europe (Netherlands)
Rules on using AI	AI Guidelines for Business (MIC and METI). Not legally binding	AI Act. Art. 4 from Feb 2025, Art. 50 from Aug 2026
Chatbot disclosure	No general statutory duty	Must be recognisable as AI (unless obvious)
Personal data in AI tools	PPC warning, June 2023	GDPR. AP treated it as a data breach in its August 2024 warning
Accessibility	Reasonable accommodation under the Act for Eliminating Discrimination against Persons with Disabilities (mandatory for businesses since April 2024)	European Accessibility Act (from June 2025)
Search evaluation	Google's policies are the same	Google's policies are the same

Search evaluation is the same; the law differs. If you operate in both, setting the scope of automation and your records to the European standard leaves very little to worry about on the Japanese side.

13. Cases (three fictional companies)

The following are three fictional companies, used to show how audit results differ. They are not real businesses.

The same criteria give different "kept by people" lists depending on the business model. Use the example closest to yours.

Company A: a Japanese parts maker's English site for Europe

80 employees. A 40-page English site, about 20 enquiries a month, mostly quote requests. The sales planning team in Japan runs it alongside other work.

The time sinks were first replies to English enquiries and updates to the English pages. Quotes stay with people. Enquiry sorting, reply drafts and extracting the differences that need updating in English were automated. If a chatbot is added for European buyers, it will say it is AI on the first screen and offer a route to a sales contact.

Company B: a Japanese food webshop in the Netherlands

6 employees. 600 product pages in Japanese, English and Dutch. About 150 enquiries a month, mostly about delivery and stock.

Moving product description translation and alt text to "AI draft + human" helped most. A Dutch-reading colleague checks every Dutch text. At this size the European Accessibility Act may not apply, but a person tests the checkout flow with a keyboard every quarter.

Company C: a consultancy with a Japanese–Dutch bilingual site

3 employees. 20 pages plus a blog, and articles are the main source of enquiries. The director writes them.

When AI drafted the articles, they began to sound like everyone else's. So now AI only proposes outlines and candidate sources, and the director writes the text. The time saved is about three hours a month.

Here are the three companies' tiers side by side.

Company (fictional)	Fully automated	AI draft + human	Kept by people
A (parts maker)	Updates, monitoring, enquiry sorting	English first replies, update differences	Quotes, technical answers
B (food webshop)	Stock-linked display, monitoring, spam filtering	Product texts in 3 languages, alt text	Refunds and complaints, checkout checks
C (consultancy)	Updates, monitoring, reports	Outlines and candidate sources	Article text, proposals

All three fully automate almost the same tasks. What differs is what people keep, because that is where each company's value lies.

14. What not to do

Finally, things every business should avoid. Each seems to save time in the short run and costs much more later.

Don't	Why
Sign up for tools first and look for uses later	Unused tools remain, and only cost and admin grow
Let AI answer prices, contracts or refunds	Wrong answers can be treated as company commitments
Set article volume targets	Mass production without value falls under Google's spam policy
Judge quality by automated scan results alone	Tools cannot determine accessibility or content quality
Leave checking time out of estimates	You overestimate the benefit, and checks become a formality

Most of these happen when the line "a person checks" is dropped. Automation is meant to reduce people's hands, not people's eyes.

15. Checklist

Go through these before you start and again one month in.

Before you start

• Wrote down a week of tasks in the order they were actually done
• Measured frequency and time per run for each task
• Filled in "impact if it fails" and "judgement needed" with no blanks
• Sorted tasks into three tiers using the five criteria
• Decided the checker and record for each tier
• Put on one page what may and may not be entered into AI
• Confirmed that AI services in use do not train on your inputs (setting or contract)
• Have daily backups and have tried a restore once

One month in

• Someone receives and reads failure alerts from automated tasks
• Approval of AI drafts is not a formality (there is a record of edits)
• Compared before-and-after effort, including checking time
• The chatbot says it is AI on the first screen and offers a human route
• AI does not answer prices, contracts or refunds
• Scheduled human accessibility checks in addition to automated scans
• Reverted tasks where automation had no effect

16. Summary

• Automating website operations starts with an audit of the work, not a tool choice. List 30 tasks across six areas in seven columns
• Whether to hand a task over is mostly decided by two questions: is the correct result defined from outside, and can a failure be undone. Commitments, personal data and frequency complete the picture
• Use three tiers: fully automated, AI draft + human approval, kept by people. Full automation needs failure alerts; approval needs a real check of the content
• Google doesn't penalise AI use as such, but mass generation without added value (including translation) is spam. People fact-check and edit
• In Europe, the AI Act's transparency obligations have applied since 2 August 2026. Chatbots must say they are AI, and AI-written text needs human review and responsibility
• The model site saves just under 40% (37 hours a month to about 23). Include checking time in the estimate
• Over six weeks, start with only three to five tasks, and revert what doesn't help

References

Search and web quality (Google, web.dev, W3C)

• Google Search's guidance about AI-generated content — Google Search Central Blog: Google's stance on AI-generated content (February 2023)
• Spam policies for Google web search — Google Search Central: definition and examples of scaled content abuse
• Guidance on using generative AI content on your website — Google Search Central: fact-checking before publishing, metadata, IPTC metadata for e-commerce
• Creating helpful, reliable, people-first content — Google Search Central: "who, how and why", fake authors
• Tell Google about localized versions of your page — Google Search Central: hreflang for multilingual pages
• Web Vitals — web.dev: LCP, INP and CLS thresholds and the 75th percentile
• Get started with the PageSpeed Insights API — Google for Developers: automating speed measurement (API key recommended for automated use)
• Selecting Web Accessibility Evaluation Tools — W3C WAI: limits of tools and the need for human judgement
• Web Content Accessibility Guidelines (WCAG) 2.2 — W3C: the accessibility standard

EU and Dutch rules

• Article 50: Transparency obligations — AI Act Service Desk (European Commission): text of Article 50
• Transparency obligations under Article 50 of the AI Act — European Commission: meaning of human review, dates and grace period
• AI Literacy - Questions & Answers — European Commission: Article 4 and the Digital Omnibus amendment
• European Accessibility Act — European Commission: dates, covered services, microenterprises
• Regulation (EU) 2016/679 (GDPR) — EUR-Lex: Article 28 (processors), Article 33 (breach notification)
• Caution: use of AI chatbot may lead to data breaches — Autoriteit Persoonsgegevens: warning on personal data in AI chatbots (August 2024)
• AP warns of major security risks with AI agents like OpenClaw — Autoriteit Persoonsgegevens: AI agent warning (February 2026)
• Joint call by ACM and AP on AI chatbots — Autoriteit Persoonsgegevens: customer service chatbots (October 2025, Dutch)

Japanese rules and statistics

• Policies on generative AI use (2026 White Paper on Information and Communications) — Ministry of Internal Affairs and Communications: share of firms with a policy (49.7% to 68.9%, Japanese)
• Warning on the use of generative AI services — Personal Information Protection Commission: warning of 2 June 2023 (Japanese)
• Promoting the elimination of disability discrimination — Cabinet Office: reasonable accommodation mandatory for businesses from April 2024 (Japanese)
• AI Guidelines for Business (version 1.1) — MIC and METI: human judgement and automation bias (Japanese)

Statistics and research

• 20% of EU enterprises use AI technologies — Eurostat: 2023–2025 trend and leading countries
• Use of artificial intelligence in enterprises — Eurostat Statistics Explained: shares by firm size, purposes (marketing or sales 34.7%)
• State of WordPress Security in 2026 — Patchstack: 11,334 vulnerabilities in 2025, 91% in plugins, time to exploitation
• Plugin and themes auto-updates — WordPress.org: how auto-updates and notifications work
• Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 — Gartner: cancellation forecast for agentic AI projects
• Gartner Predicts 50% of Organizations Will Abandon Plans to Reduce Customer Service Workforce Due to AI — Gartner: forecast on reversing customer service staff cuts

All sources were checked on 21 October 2026. Rules and figures change, so check the official sites before making decisions. Effort and cost figures are DevNJ's working estimates, not measured statistics, and vary with site size and team.