AI Safety Checklist for Small Businesses
AI tools are incredibly useful. They’re also very easy to paste things into without thinking.
A client’s contract. A customer list. A screenshot with a password visible in the corner. Your bank statement, so it can “help with the budget.” Once it’s pasted, you may not have much control over where it goes or how long it’s kept.
None of that means you should avoid AI. It means you need a few simple rules. Here’s the checklist I use and recommend to clients.
Before you choose a tool
- Read the data policy. Find out whether the company uses your conversations to train its AI, how long it keeps them, and whether you can turn that off. Most major AI assistants let you opt out of training in the settings.
- Know the difference between free and business plans. Business and team plans often come with stronger privacy terms than free personal accounts.
- Be wary of unknown tools. That shiny new AI app from a company you’ve never heard of is a different risk from a major provider. If you can’t find out who runs it and what they do with your data, don’t feed it anything sensitive.
- Check before you connect. When an AI tool asks for access to your email, files, calendar or website, read what it’s asking for. Only grant what it needs.
What not to paste in
Keep these out of AI chats, unless you’re using a tool your business has approved for that kind of data:
- Passwords, API keys and login details. Ever. Watch for them in screenshots and pasted code too.
- Payment card and bank account numbers
- Social Security numbers and other government ID numbers
- Health information about clients or employees
- Client confidential information covered by a contract or NDA
- Full customer lists with names, emails and phone numbers
When you need help with something sensitive, strip out the details first. Replace names with “Client A,” remove account numbers, and summarize instead of pasting the whole document. AI can usually help just as well without the specifics.
Before anything goes out
- Fact-check it. AI can invent statistics, quotes, laws, prices and even sources that look completely real.
- Double-check names, dates and numbers.
- Make sure it sounds like you. Customers notice copy that reads like it came from a robot.
- Check you have the rights. Be careful with AI-generated images that look like real people, brands or someone else’s artwork.
- Disclose AI use where it’s required. Some platforms, including Amazon’s publishing platform, ask whether your content was AI-generated. Answer honestly.
When AI can take action
AI assistants that can send email, edit your website or work in your accounts need extra care:
- Back up before you connect anything that can change your website.
- Use separate credentials like a dedicated Application Password or API key, so you can revoke access without changing your main password.
- Give the lowest permissions that work.
- Review before it sends or publishes, at least until you trust the workflow.
- Revoke access for tools you’ve stopped using.
I go into this more in Connecting AI to Your Website.
Watch for AI-powered scams
AI isn’t only helping businesses. It’s helping scammers too.
- Phishing emails are getting harder to spot. The spelling mistakes are gone. Be suspicious of any urgent request for payment, passwords or gift cards, no matter how polished it looks.
- Voice cloning is real. If “the boss” calls asking for an urgent wire transfer, call them back on a number you know.
- Verify payment changes. If a vendor emails new bank details, confirm by phone before paying. This invoice-fraud scam costs small businesses a fortune every year.
My Email Security Checklist covers how to protect your mailboxes too.
If you have a team
- Write it down. A one-page AI policy listing approved tools and what not to share beats a dozen assumptions.
- Use business accounts instead of everyone signing up for their own free tools.
- Talk about it. Make it easy for people to ask “is it okay to paste this?” before they do.
The quick version
- Use trusted tools, and read the data policy.
- Turn off training on your data where you can.
- Never paste passwords, card numbers, ID numbers or confidential client data.
- Strip out names and details when you can.
- Fact-check everything before it goes out.
- Back up, and use limited access, before letting AI take action.
- Be extra careful with urgent payment requests.
AI can save you hours every week. A few minutes spent on these habits keeps it from costing you something you can’t get back.