For small teams that only use AI tools
If you use tools like ChatGPT, Copilot or meeting assistants, here's the short list of what to do.
2 min read·Updated 8 November 2026Small businessesStartups
Most small teams are deployers of general tools. Your duties are real but light, unless you use AI for something high-risk.
Your short list
- 1List the tools you use and what for. Discover AI can do it from a week of network logs.
- 2Check the purpose. Using AI to screen job applicants, score customers' credit or decide access to essential services is high-risk, even with a general tool. If you do, read Is my system high-risk?.
- 3Write simple rules: which tools are allowed, what data must never go in, who to ask. Use the AI policy checklist.
- 4Support AI literacy: a short session on how the tools work, where they go wrong and your rules. Keep a record of who attended. See the AI literacy plan.
- 5Be transparent: if customers chat with an AI assistant, tell them. If you publish AI-generated images of real people or events, label them.
- 6Check your contracts: what the vendor does with your data, and whether it's used for training.
Tip
SMEs pay the lower of the two fine amounts and get simplified documentation options, but the same obligations apply. A clear list and simple rules go a long way.