Security and privacy are the biggest worries for small businesses using AI. In one 2026 survey of UK small business owners, 44% named them as a barrier, according to Intelligent SME. The worry is reasonable, but it's manageable. This isn't legal advice, but it covers the practical basics.
The main risks
- Pasting customer details into a free AI tool that may store them or use them to train its models
- Staff using personal accounts that the business can't control
- AI giving customers wrong information
- No record of which tools hold which data
Simple rules that cover most of it
- Use business versions of AI tools, where your data isn't used for training by default, and check the settings.
- Don't paste in more personal data than the task needs. Remove names and contact details where you can.
- Never put sensitive data, such as health or financial information, into general AI tools.
- Keep a short list of the AI tools you use and what data goes into them.
- Have a person check anything the AI sends to a customer.
- Update your privacy notice if AI tools process customer data on your behalf.
- Tell customers when they're talking to an automated assistant.
Write a one-page AI policy
A simple policy tells your team which tools they can use, what they mustn't paste in and who to ask. It takes an hour to write and saves a lot of worry.
Where to find official guidance
The ICO publishes guidance on AI and data protection for UK organisations. If you're unsure, take advice before putting customer data into a new tool.