Six Things to Check Before Making Your Next AI Query

If you run a small business, you’re more than likely already using some AI tools, whether it’s tidying up an email in ChatGPT, summarising meeting notes, or touching up your marketing material in Canva. The tools are easy to get hold of and can save time, but being too gung-ho with AI tools doesn’t come without risk.

This is the first of four posts on getting started with AI safely, written with small businesses in mind. We’re starting with data, because it’s the hardest thing to take back once it’s been pasted in, and what happens to it next depends a lot on which tool you use and which plan it went into.

To start off our series, here’s six things to check before you make your next AI query.

1) Set Simple Data Rules

Start by agreeing a short list of what must never go into an AI tool. For most small businesses that covers things like:

• Client personal data
• HR and payroll records
• Passwords and login details
• Financial details
• Anything covered by an NDA

Keep it short enough that everyone can remember it; a list of five things people know will be remembered far more easily than a long document in your filing system. If someone’s unsure whether something is on the list, the answer for now is to ask before pasting.

This is particularly important if you’re not using a business-level AI subscription. Speaking of…

2) Pay for Business AI Subscriptions

Free and personal AI accounts allow your data to be used to train the provider’s models, and used for purposes which may not be immediately obvious. This may be fine if you’re running simple queries, but when working with confidential business information, it becomes a problem.

Business plans work differently because they come with contractual protection. Microsoft 365 Copilot, ChatGPT Business and Claude Team all state that they don’t use your business data to train their models by default, though the exact terms change, so it’s worth checking them before you commit.

If you’re on Microsoft 365, you may already have an approved option. Microsoft 365 Copilot Chat is included with Microsoft 365 business plans when staff sign in with their work account, and Microsoft says prompts and responses stay within the Microsoft 365 service boundary and aren’t used to train its models. It doesn’t draw on your SharePoint and OneDrive files the way the paid Copilot add-on does, which we’ll come to in Part 2, but it gives staff a business-grade place to start. It’s worth confirming it’s switched on for your plan.

3) Check the Basics in the Terms

Before anyone uses a tool for business data, it’s worth getting answers to three questions:

• Is our data used for training?
• Where is it stored?
• Can we delete it?

These are usually covered in the provider’s terms or privacy pages, and if you can’t find clear answers, that tells you something too. If you can’t answer all three, the tool isn’t one to use for business data. Terms change fairly often, so it’s worth looking again when you renew or when the provider announces an update.

4) Cover Your UK GDPR Duties

If an AI tool processes personal data, UK GDPR applies just as it does to any other system. Two practical things follow from that.

The first is your privacy notice. If AI processes personal data in your business, your privacy notice should say so.

The second is whether you need a DPIA, which stands for data protection impact assessment. The ICO lists AI as an innovative technology, and a DPIA is required when that’s combined with another high-risk factor, such as evaluating or scoring people or handling sensitive data. Screening CVs is a good example, and so is anything that affects customers directly. If your use is higher risk, the ICO’s DPIA guidance includes a free template you can use.

5) Read Your Client Contracts

Some clients in more regulated industries like finance, law and healthcare may restrict how their data can be handled, and those restrictions could predate AI tools. It’s worth checking what your contracts say about third parties, sub-processors and where data can be stored.

6) Rules Work Better With Controls Behind Them

A data rule only works if people follow it, and it helps to make the safe option the easy one. Giving staff an approved tool means they’ve got less reason to reach for a personal account, and restricting access to other tools with technical controls enforces those decisions.

We’ll cover more about technical functionality that can be used to manage AI tools in a future part of this series.

Coming Up Next

Part 2 looks at getting your data ready before you switch on a tool like Microsoft 365 Copilot, which can find anything a user already has access to.

Not Sure What Your Staff Can Reach?

If you’re not sure which AI tools your team are using, or what your current Microsoft 365 setup would let them get at, that’s a good place to start. It’s something we look at in our Free M365 Assessment.