Using AI tools in a small business

Running a small business means a lot of writing, sorting and answering. AI tools can take on some of that work, with a person checking what they produce.

Everyday tasks the tools suit

The government's free AI courses for workers teach the use of AI "for tasks like drafting text, creating content and completing administrative tasks".

The AI Playbook, which the UK government wrote for its own civil servants, says generative AI is better at creative tasks than at looking up facts. In 2023, the National Cyber Security Centre (NCSC) said these tools suit simple tasks more than complex ones. In its view they help experts save time, because the expert can check what the tool produces.

Check what comes back

An AI tool can write something that sounds right and is wrong. The Playbook calls these "hallucinations", where the tool "responds with information that appears to be truthful but is actually false".

It goes further, and says "generative AI models cannot be trusted to produce factual content". It describes a case in Canada where an organisation with a chatbot on its website was held financially responsible for the bad advice the chatbot gave.

One of the Playbook's principles for government staff is that humans should validate any high-risk decision that AI has influenced.

Keeping private details out of chatbots

When you type into a public AI chatbot, the company running it can see what you type. The NCSC's 2023 article says those questions are kept, and that the provider will almost certainly use them at some point to develop its service.

The article recommends two things. Leave sensitive information out of what you type into a public chatbot. And leave out anything that would cause problems if it were made public.

It also suggests reading the tool's terms of use and privacy policy before asking it anything sensitive.

Customers' personal data

The Information Commissioner's Office (ICO) has guidance on AI and data protection, written to suit private businesses as well as public bodies and the third sector. It says the accountability principle makes a business responsible for complying with data protection law, and for being able to show that it does, in any AI system that handles personal data.

A business must tell people how it uses their personal data. Under the ICO's guidance on AI, that privacy information includes why the data is used, how long it will be held and who will receive it. Where the data comes straight from the person, they must be told when it is first collected, before it is used to train an AI model or to apply one to them. Where it comes from somewhere else, they must be told within a reasonable period and no later than one month, or sooner if the business contacts them or passes the data on.

Personal data must also be accurate and, where necessary, kept up to date. The ICO adds that an AI system need not be right 100% of the time to meet this rule.

The ICO has said this guidance may change after the Data (Use and Access) Act. Its pages were checked on 9 November 2026.

Keeping the business secure

The NCSC's guide for managers lists the main flaws in these tools. They can present incorrect statements as facts. They can show bias, and they are often gullible when asked leading questions. They can be tricked by "prompt injection", where someone writes an input designed to make the tool behave in a way nobody intended.

One of its questions for managers asks what the worst outcome would be, for the business or its reputation, if an AI tool it uses failed.

Free training for you and your team

In January 2026, the government said every adult in the UK can take free AI courses through its AI Skills Hub. Some take under 20 minutes, and people who finish them get an AI foundations badge.

Useful links