AI Lead Qualification for Small Businesses: How to Score and Route Every Enquiry
AI lead qualification means using a language model to read each new enquiry, pull out the facts that matter, score how well it fits your business, and send it where it should go. It does not replace your judgment about who makes a good customer. It applies rules you wrote, quickly and consistently, so the enquiries that need attention first are the ones you see first.
This guide explains how it works, what to have the AI return, how to test it, and the risks worth planning for before you switch anything on.
Is it worth doing?
It is worth doing when enquiries arrive faster than you can read them, when quality varies a lot (spam, wrong fit, real work in the same inbox), or when different people handle different types of enquiry.
It is not worth doing when you get a handful a week. Reading them yourself is quicker, and you learn more from each one.
How it works
The AI returns fields. Your rules and your review decide what happens next.
- Capture. The enquiry arrives from a form, email or message and is saved with a timestamp.
- Clean. Cap the length, and drop any personal data the AI does not need to do its job.
- Analyse. Send the text to a language model along with your criteria, and ask for a fixed set of fields back.
- Route. Based on the result, alert a person now, queue the enquiry for later, or file it as spam.
- Log and review. Store the enquiry, the fields and what you did about it, and check a sample every week.
What to ask the AI to return
Keep the output narrow. A fixed set of fields with a fixed list of allowed values is easier to check and much harder to abuse than free text.
| Field | Example values | What it drives |
|---|---|---|
| Fit score | 1 to 5, with your written meaning for each number | Priority |
| Urgency | now, this month, just exploring | Alert or queue |
| Service interest | your own list of services | Who gets it |
| Spam flag | yes or no | Filtering |
| Language | as detected | Who replies |
| Missing details | a short list | Follow-up questions |
| Suggested next step | one short sentence | Reply drafting |
Three design rules matter more than the model you pick:
- Write the scoring rules yourself, in plain language. Say what a 5 looks like for your business: the kind of project, the timeline, the location, the budget range. The model applies your definition. It does not invent one.
- Require structured output and reject anything that doesn't validate. If the fields are missing or a value is outside the allowed list, treat the enquiry as unscored and send it to a person.
- Keep the original enquiry next to the result. You cannot audit a score you can't trace back to its source.
Drafting replies: keep a person in the loop
A model can draft a reply from the enquiry. The safe options are to hold every draft for a person to approve, or to let automation send only a fixed acknowledgement template. A wrong promise, such as a start date or a price, does more damage than a slow reply. For what the acknowledgement should say and when a person should follow up, see our guide to speed to lead.
Risks to plan for
Enquiry text is untrusted input. Anyone can type instructions into a contact form. OWASP ranks prompt injection as the top risk for applications built on language models (OWASP). For a lead workflow that means:
- Treat the enquiry as data to be analysed, never as instructions.
- Give the model no ability to send emails, change records or trigger other actions. It returns fields, and your workflow decides what to do with them.
- Validate the output format and the allowed values every time.
- Do not rely on a line in the prompt telling the model to ignore instructions hidden in the enquiry. Design the workflow so that a fooled model cannot do any harm.
- Hold drafted replies for approval, and log results that look odd.
Wrong scores. Models misread context. Test before you rely on it, review a sample every week, and adjust your rules when you find a pattern.
Confident wrong replies. Covered above: a person approves anything that goes out beyond the fixed acknowledgement.
Personal data. Enquiries contain names, emails and sometimes much more. Send the model only what it needs, check the provider's data terms, and tell people in your privacy notice that enquiries are processed automatically. The UK ICO's guidance on AI and data protection stresses being open about AI-enabled decisions and giving people privacy information when you collect their data (BDO's summary of the guidance). Requirements differ by country and this is not legal advice, so check what applies to you.
Unfair criteria. Score on business fit: the service wanted, the budget range, the timeline, the location. Do not score on names, accents or other personal traits, and keep a person making the final call on who you take on.
Test before you rely on it
- Take a batch of past enquiries. A few dozen is enough to start.
- Run them through and compare the results with how you would have ranked them yourself.
- For every disagreement, decide whether your rule or the model was at fault.
- Include some awkward ones on purpose: an empty message, a message in another language, a sales pitch, and one that contains instructions aimed at the AI.
- Repeat the test after any change to your rules or the model.
Build options
You can build this with no-code automation tools such as Make, Zapier or n8n, or with a script sitting over a spreadsheet. The tool matters less than the design above. Check the model provider's current pricing against your enquiry volume before you commit.
How Corevalo approaches it
Corevalo has built a lead qualification and AI response workflow, which you can see on the Work page. Scope, price and how much stays automatic are agreed per project, through the Business Automation service.
Frequently asked questions
Can AI replace the person who answers enquiries?
No, and it should not try. It sorts and prepares. A person handles the conversation and the decision.
Do I need a CRM first?
Not to start. A spreadsheet that logs each enquiry, its fields and the outcome is enough, and it gives you the review data you will need anyway.
How do I know it is accurate?
Measure it. Count how often its scores disagree with yours, and look at what the disagreements have in common.
Want to see how this would work for your enquiries?
Book a call and we'll map out how your enquiries arrive today and where AI qualification would help.
Sources: OWASP, LLM01:2025 Prompt Injection · ICO, Guidance on AI and data protection · BDO, The ICO's updated AI and data protection guidance
