How to put responsible use of AI into practice in a small firm

A practical guide to the responsible use of AI in a small business: find hidden tools, keep humans accountable, control costs and use free UK toolkits.

Ethics & Technology · 15 October 2026 · 7 min read

Somewhere in your business, someone is probably pasting customer details into a free chatbot to save ten minutes. If you have not approved that tool, you cannot check what data leaves the building, who sees the output or what it costs. That is the real problem behind the responsible use of AI in a small firm. It is less about ethics statements than about knowing what is running, who is accountable for it and what it costs. A few plain habits, none needing a specialist, cover most of the risk.

Find out which AI tools your team is already using

The first gap is visibility. A TechRadar Pro study of UK small businesses’ AI usage found that 24% of UK small and medium-sized businesses had discovered unauthorised AI tools running in their business over the past six months. These are rarely acts of rebellion. A salesperson uses a writing assistant for proposals. A bookkeeper tries a spreadsheet add-on. Each is a sensible shortcut, and each may send client or staff data to a provider whose terms nobody has read.

Start with a conversation, not a crackdown. Ask everyone, including part-timers and freelancers, which AI tools they use and what they put into them. Then check card statements and expense claims for subscriptions you do not recognise. Make it clear that owning up carries no penalty, or you will only hear from the people with nothing to hide.

Put the answers in a simple list: the tool, who uses it, what data goes in and who in the business owns it. Where personal data is involved, the ICO’s AI and data protection risk toolkit helps organisations, SMEs included, assess the risks their AI systems pose to individuals’ rights and freedoms. Check anything touching customer or employee data first. A tool used to brainstorm product names can wait.

Keep a named person responsible for every AI output

AI tools sound sure of themselves, and people act on what they say. TechRadar Pro’s report on AI financial advice found that nearly 70% of UK SMEs act on AI-generated financial or tax advice before consulting their accountant. Tax and finance are exactly where a confident wrong answer costs money and creates legal exposure for you, not for the software provider.

The government’s AI Playbook puts meaningful human control at the centre of safe and responsible AI use, alongside building in legal compliance, including data protection and fairness, from design through deployment. It is written for the public sector, but the principle carries over to any business. AI drafts, a person decides.

In practice, set one rule. For anything involving money, contracts, hiring or what you tell customers, a named person checks the output before it is used. The check has to be real: someone who understands the subject and has time to read the result properly, not a glance on the way to a meeting. Be honest about the trade-off, too. Checking eats into the time saved. If reviewing an AI draft takes as long as writing it yourself, that tool is wrong for that job.

The same thinking applies when you choose tools. A TechRadar report on the AI confidence gap among UK small businesses describes responsible AI as giving users control, being transparent, and supporting people’s judgement rather than overriding it. Before you buy, ask whether your staff can see how the tool reached its answer and whether they can easily overrule it.

If you have built something yourself, such as a custom chatbot or an automated workflow, the bar is higher. The TechRadar Pro study found that only 23% of businesses have a formal documented review process for AI systems they build internally. One page is enough: what the system does, what data it uses, who checks its output and how often it is reviewed. It takes an hour to write and saves an argument later.

Watch the bill as closely as the output

Cost belongs in any discussion of responsible AI use, because spend you cannot see is spend you cannot control. The TechRadar Pro study found that 39% of UK SMBs had experienced unexpectedly high AI bills. KPMG’s Global AI Pulse, reported by ITPro, found that 30% of UK companies are struggling with usage-based costs and 42% have only partial visibility into what they spend on AI. The same research shows 26% of UK companies now use AI as part of everyday work, up from 18% earlier in 2026, so the spending is growing quickly.

Usage-based pricing is the trap. An automation that calls a paid AI service every time a form is submitted gets more expensive the more successful you are. Nobody notices until the invoice arrives.

Four habits keep this under control:

• One owner. Give one person responsibility for all AI spending, so costs are not scattered across team cards.
• Caps and alerts. Where a provider lets you set a spending limit or usage alert, set it on day one.
• A monthly look. Compare usage and cost with the previous month and ask what changed.
• A stated purpose. Every paid tool should have a measurable reason to exist, such as hours saved or errors reduced. If a tool cannot show one after a quarter, cancel it.

A simple framework for the responsible use of AI

You do not need to invent your own framework. The OECD’s Due Diligence Guidance for Responsible AI sets out six steps: embed responsible practice into your policies, identify adverse impacts, mitigate them, track whether you are doing so, communicate what you have done, and put things right when harm occurs. Scaled down to a small firm, that looks like this:

1. Write a one-page policy. List the approved tools, the data that must never go into them (client confidential information and personal data of staff or customers, for a start) and who signs off new tools.
2. Ask what could go wrong. For each tool, consider what happens if it gives a wrong answer, treats customers unfairly or leaks data.
3. Reduce the risk. Add the human check, limit the data going in and choose providers with clear terms.
4. Keep track. Maintain the tool list, review the monthly spend and log mistakes when they happen.
5. Tell people. Make sure staff know the rules. Tell customers when AI plays a part in decisions that affect them.
6. Put it right. If AI output harms a customer, correct it, then fix the process that let it through. Know in advance who is responsible for doing that.

For outside help, the government’s Responsible AI Toolkit, published in March 2024 and last updated in November 2024, collects AI assurance tools and algorithmic transparency standards. It is most useful when you are buying a system that makes or shapes decisions about people, and you want to know what questions to ask the supplier.

Over one third of UK SMEs are now actively using AI, up from 25% a year earlier, according to the TechRadar report on the confidence gap. Your competitors are moving, so the aim is not to slow down. It is to make sure that when a customer, an auditor or your accountant asks how you use AI, you can answer in a minute. Watch for the point where staff adopt tools faster than you review them. When that happens, repeat the first step.

Common questions

Does my small business need an AI policy?

Yes, if anyone on your team uses AI tools for work, a short written policy is worth having. One page is enough. List the tools you have approved, the types of data that must never go into them, who checks AI output before it reaches customers, and who to tell if something goes wrong.

Does UK GDPR apply when my staff use AI tools?

Yes, whenever personal data goes into an AI tool, such as customer names, emails or staff records, UK GDPR rules on handling that data still apply. The ICO publishes an AI and data protection risk toolkit to help organisations assess the risks. Before staff paste anything personal into a tool, check what the provider does with it.

Can I rely on an AI chatbot for tax advice?

Treat it as a starting point, not an answer. Nearly 70% of UK SMEs act on AI-generated financial or tax advice before speaking to their accountant, but chatbots can be confidently wrong, and the legal exposure is yours. Use AI to prepare your questions, then have your accountant confirm anything that affects what you file or pay.

Sources

• ICO: AI and data protection risk toolkit
• Department for Science, Innovation and Technology: Responsible AI Toolkit
• Department for Science, Innovation and Technology: Artificial Intelligence Playbook for the UK Government
• OECD: Due Diligence Guidance for Responsible AI
• TechRadar Pro: Most small businesses aren’t reviewing their own AI usage properly
• TechRadar Pro: AI confidence gap is stalling UK small businesses
• TechRadar Pro: SMBs are acting on financial advice from AI chatbots before talking to their accountant
• ITPro: UK business leaders have a limited understanding of AI usage costs