Most small businesses I speak to are in the same position with AI. Somebody on the team is already using it. Somebody else is worried about it. And nobody has quite decided what the business actually thinks.
That gap is where the trouble starts. Not because AI is dangerous in itself, but because tools get adopted by accident, one useful shortcut at a time, until client information is sitting somewhere nobody chose and nobody checked.
I have spent over thirty years in technology and watched this pattern repeat with every wave. The tool arrives, enthusiasm races ahead of thinking, and the tidying up comes later and costs more. (I wrote about why AI is not the overnight arrival it appears to be ) This is the practical follow-up. You do not need a technical background or an IT department. You need a few sensible habits.
Start with the problem, not the tool
At Fair Foundations we use a simple test before any significant decision: washing machine or toaster? A washing machine is something you cannot function without. A toaster is nice to have. Some AI tools will turn out to be washing machines for your business, and plenty will be toasters. The skill is knowing which is which before you pay for it.
So before you look at any tool, write the problem down in one sentence. Answering enquiries takes six hours a week. Our reports take three days to draft. If you cannot describe the problem without naming the tool, you are not solving a problem yet. You are shopping.
There is almost always a simpler solution. A better template, a shared inbox, a tidier process. Shiny tools rarely survive contact with actual need.
Know where your data goes
Anything you type into an AI tool leaves your computer and lands on someone else’s servers. What happens next depends on the tool, the plan you are on and the settings you have chosen. Some free versions may use what you enter to improve their models. Business plans usually give you more control.
Personal data does not stop being personal data because you typed it into a chatbot. If it includes names, contact details or anything else about an identifiable person, UK data protection law still applies, and you remain responsible for it whatever tool you use.
The practical rule: do not put personal or confidential information into a tool until you know where it goes. When in doubt, anonymise first. Then write one page saying which tools your people may use, what for, and what must never go in. That is your AI policy. It does not need to be longer.
Decide who is accountable
AI makes mistakes, and it makes them confidently. It can invent a statistic, misread a document or write something that sounds perfectly reasonable and is simply wrong. When that happens, the tool will not be the one answering for it. You will.
So decide in advance. A person checks anything that goes outside the business, and a person owns the result. AI can draft. A human signs off. The higher the stakes, the harder they look.
Be open with your team and your customers
If your team thinks AI is coming to replace them, they will either resist it or use it quietly and not tell you. Say plainly what you are doing and why, and ask what they are already using. The answer is often more than you expect.
Your customers should not be surprised either. If AI touches their data or shapes decisions about them, say so in plain words, in your privacy notice and wherever they will actually see it. When I founded Ethiqana, a fair trade business, the questions that mattered were always where something came from and who it affected. They work just as well here. Who built this tool? Who is affected if it gets things wrong?
Start small, then commit
Our rule at Fair Foundations is that anyone can try anything that is easily undone, and anything that is not needs agreement first. Pick one task, one tool and one month, and use it on low-risk material. See whether it saves time, whether the quality holds and whether anyone is uncomfortable. Then decide. A month of testing costs very little. A rushed rollout can cost months of untangling.
None of this is about avoiding AI. It is about getting the order right: problem first, then the tool, then the rules, then the rollout. In my experience, businesses that work in that order find AI useful. The ones that do it the other way round tend to find it expensive.
I advise businesses and organisations on exactly this: where AI genuinely helps, where it does not, and how to put sensible guardrails in place. If you would like to talk it through, book a free 15-minute discovery call.
