The Global Insight

Tuesday, 22 September 2026Global stories. British perspective.

AI & Business

How to Use AI in a UK Small Business: Eight Workflows That Work, the Data Checks to Run First, and Where AI Is the Wrong Tool

Eight AI workflows a UK small business can run this week, the ICO checks to make before pasting customer data, and the jobs where UK courts show AI fails.

By The Global Insight EditorialPublished Updated 18 min read

Start with one repetitive, text-shaped job — drafting replies, writing up meetings, summarising documents — not with a tool. Remove anything that identifies a customer before you paste it in. Check every fact before it leaves the business. That is the whole method; the rest of this page is eight workflows that apply it, the data checks the ICO expects first, and the jobs where AI is the wrong tool.

Last checked: 22 September 2026.

This is the practical how-to page in our AI coverage, and it deliberately does not repeat the others. If you have not yet chosen a tool, the best AI tools for UK small businesses matches a tool to each job with prices read from the vendors’ pages. For the budget and VAT arithmetic, see what AI tools cost a UK small business. For what you can do without paying, and who owns the output, see free AI tools for UK small businesses. This page assumes you have a tool, or are about to, and want to know what to do with it and what to check.

What UK businesses are using AI for

The Office for National Statistics asked businesses what they use AI for in June 2026 (Business Insights and Conditions Survey, wave 159, published 20 July 2026). Improving business operations was the most common purpose, reported by close to 60% of AI-using businesses. Providing or personalising products or services came second, and was more common among the smallest firms: about 31% of AI-using businesses with 0 to 9 employees.

The same release is useful for setting expectations. Among businesses with 10 or more employees that use AI, only 10% said they used it extensively; among those with 0 to 9 employees the figure was 17%. The most common barriers to adoption the ONS lists are difficulty identifying use cases, cost and lack of expertise. In other words: most firms that use AI use it lightly, and the hardest part is picking the job. The eight workflows below are chosen to solve exactly that.

Step one: pick a job AI is good at

A job is a good first candidate if it passes all four tests below. If it fails one, pick another.

Test Good first job Bad first job
Repetitive — you do it every week in roughly the same shape Replying to “do you deliver to…” enquiries A one-off dispute with a supplier
Text-shaped — the input and output are words or numbers Writing up meeting notes Deciding whom to hire
Checkable — you can tell quickly whether the output is right A product description you can compare with the product A legal argument you cannot verify
Low harm if wrong — a mistake is caught before it costs anyone A first draft you edit A figure sent to HMRC or a customer unchecked

Time the job once by hand before you start. Without a “before” figure, you will not know whether the tool saved anything.

Eight workflows a UK small business can run this week

Each workflow names the kind of tool it needs, the steps, what to check, and whether personal data is involved. Where personal data is involved, run the checks in the next section first.

1. Drafting replies to customer enquiries

  • Tool: a general assistant (ChatGPT, Claude, or Copilot/Gemini inside your email).
  • Steps: keep a short document of your real policies — delivery areas, returns window, prices, opening hours. Paste the policy document and the customer’s question, with names and contact details removed, and ask for a reply in your tone. Edit, then send from your own account.
  • Check: every fact in the reply against your policy document. An assistant fills gaps with plausible inventions; if your policy is silent on something, the draft may not be.
  • Personal data: yes, unless you strip it. The question “a customer asks whether we deliver to Truro on Saturdays” loses nothing without the name.

2. Turning a meeting into notes and actions

  • Tool: a meeting assistant (Fathom, Otter, Fireflies) or the transcript feature in Teams or Meet.
  • Steps: tell attendees at the start that the call is recorded and transcribed. Let the tool produce a summary and action list. Correct the actions and owners, then circulate.
  • Check: names attached to actions, numbers and dates. Transcription mishears figures more than words.
  • Personal data: yes — voices, names and whatever is said. Transparency is your job: the ICO’s guidance requires you to tell people how their data is used.

3. Answering repeat questions on your website

  • Tool: an AI chat agent that learns from your own help content (Tidio’s Lyro, Intercom’s Fin).
  • Steps: write the twenty questions you answer most, with correct answers, as a help page first — the bot is only as good as that page. Connect the agent to it. Make the handover to a person obvious.
  • Check: read the transcripts every week for the first month. Look for answers that are confident and wrong.
  • Personal data: yes. The bot is answering in your business’s name, so anything it says about refunds or delivery is your business saying it. Intercom’s pricing page notes you pay nothing for a conversation where “the customer asks to speak to a human” — a design choice worth copying whatever tool you use.

4. Bank reconciliation and receipt capture

  • Tool: the AI inside your accounting software — Xero’s JAX, QuickBooks’ AI-powered bank feeds, Sage Copilot, FreeAgent’s Smart Capture.
  • Steps: switch on the bank feed and receipt capture. Let the software suggest categories, and approve or correct them. Corrections are how it learns your patterns.
  • Check: anything VAT-related, and anything unusual, before a return is filed. Book an hour with your accountant after the first month to look at the categorisation.
  • Personal data: some — payee names. This stays inside software you already use for the same purpose.
  • UK timing: if you are a sole trader or landlord with qualifying income over £50,000 for 2024 to 2025, GOV.UK says you should have started using Making Tax Digital for Income Tax from 6 April 2026; the threshold falls to £30,000 from 6 April 2027 and £20,000 from 6 April 2028. Choose software HMRC lists as compatible.

5. Summarising a long contract, tender or lease

  • Tool: a general assistant that accepts file uploads.
  • Steps: upload the document and ask specific questions — “what is the notice period?”, “who pays for repairs to the roof?”, “list every date I must act by”. Ask for the clause number with each answer.
  • Check: every answer against the clause it cites. Use the summary to understand the document and prepare questions for a solicitor, not in place of one.
  • Personal data: possibly — counterparties’ names and signatures. Redact where you can.

6. Product descriptions, social posts and newsletters

  • Tool: a general assistant, or Canva for graphics.
  • Steps: give the tool the real product details, your audience and three examples of your own writing you like. Ask for several versions; pick and edit one.
  • Check: claims. Anything you say about a product in marketing must be true; the tool does not know your product.
  • Never: ask it to write reviews or testimonials. Fake reviews are a banned practice under UK consumer law — see “where AI is the wrong tool” below. And under OpenAI’s terms you may not “Represent that Output was human-generated when it was not.”

7. Spreadsheet formulas and tidying data

  • Tool: a general assistant, or Copilot in Excel / Gemini in Sheets.
  • Steps: describe what you want in words — “a formula that totals column D where column B says ‘paid’” — and paste the result into a copy of the sheet, not the original.
  • Check: the result against a handful of rows you have totalled by hand.
  • Personal data: avoid pasting the sheet itself if it holds customer records. Describe the columns instead.

8. Automating a hand-off between two apps

  • Tool: Zapier or Make.
  • Steps: pick one hand-off you do by hand every day — a website form entry copied into a spreadsheet, say. Build it as one trigger and one action. Only then add an AI step, such as drafting a reply for you to approve.
  • Check: run it on test entries for a week before it touches real customers. Keep a human approval step before anything is sent.
  • Limits: Zapier’s free plan allows two-step Zaps only, with 100 tasks a month; Make’s free plan allows 1,000 credits a month, 2 active scenarios and a 15-minute minimum interval between runs (both read from the vendors’ pricing pages on 22 September 2026).

Before you paste customer data: the checks the ICO expects

Free or paid, big or small, putting a person’s details into an AI tool is processing personal data, and UK GDPR applies to your business as it would to any other system. The ICO’s guidance on AI and data protection is written for organisations of every size; these are the checks it translates into for a small firm.

1. Is it personal data at all? If you can remove it, remove it. Names, email addresses, phone numbers, order histories and complaint details all identify people. Most drafting and summarising tasks work as well without them.

2. Is any of it special category data? The ICO lists the categories the UK GDPR “singles out… as likely to be more sensitive”: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data used for identification; data concerning health; and data concerning a person’s sex life or sexual orientation. Keep all of it out of consumer AI tools. A customer’s note that they need a delivery slot “because of my chemotherapy” is health data.

3. What does your plan do with inputs? On consumer plans the default is that your inputs can be used for training unless you opt out. Anthropic’s plan table lists model training as “Opt-out” on Claude Free, Pro and Max and “None by default” on Team and Enterprise; OpenAI’s Business plan lists “No training on your business data by default”. Set the opt-out before the first paste, not after.

4. Is the vendor a processor, and is that in a contract? In its November 2024 advice for businesses buying AI recruitment tools, the ICO put it plainly: “You must identify who is the controller and processor of personal information. This must be recorded clearly in a contract with the provider.” The same logic applies to any AI tool that handles your customers’ data. Business plans typically come with a data processing agreement; consumer plans generally do not.

5. Do you need a data protection impact assessment? For AI systems processing personal data, the ICO’s guidance says: “In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals’ rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA.” Where you decide a use is not high risk, it adds, “you still need to document how you have made this assessment.” For a small firm pasting anonymised text into an assistant, that documentation can be a paragraph. For a chatbot answering customers, or a tool screening job applicants, do the DPIA.

6. Have you told people? Your privacy notice should say that you use AI tools, for what, and which vendors. If a chatbot answers customers, make it obvious that it is a bot and how to reach a person.

7. Is the AI making a decision about someone? UK GDPR article 22A, as amended by the Data (Use and Access) Act 2025, covers decisions “based solely on automated processing” that have a “legal or similarly significant effect” on a person. The ICO updated its draft guidance on these rules on 31 March 2026. For a small business the safe rule is simple: a person makes, and can explain, any decision that refuses someone something that matters — a job, credit, a service.

And one that is not about AI. Under the Data Protection (Charges and Information) Regulations 2018, the ICO says, “organisations (including sole traders) that use personal information need to pay a data protection fee, unless they are exempt.” If you are processing customer data through new tools, check you have paid it.

Where AI is the wrong tool

This is the section most guides skip. Each row below is backed by a UK court, regulator or statute, not by opinion.

Job Why AI is the wrong tool The UK evidence
Legal research and citing cases or rules Tools invent sources that sound real High Court, Ayinde v Haringey [2025] EWHC 1383 (Admin); tax tribunal, Harber v HMRC [2023] UKFTT 1007 (TC)
Tax thresholds, deadlines and rates Plausible but wrong figures; no guarantee of currency Harber: a taxpayer’s appeal relied on nine tribunal decisions that did not exist
Screening or rejecting job applicants Bias and excessive data collection found in real tools ICO audits of AI recruitment tools, November 2024
Decisions with a significant effect on a person, made with no human involvement Restricted by law UK GDPR article 22A, as amended by the Data (Use and Access) Act 2025
Writing reviews or testimonials Banned practice CMA fake reviews guidance
Content you need to own exclusively Copyright position unsettled; output not unique CDPA 1988 s9(3); OpenAI and Anthropic terms

In June 2025 the Divisional Court dealt with two cases in which lawyers had put fictitious authorities before the courts. Its judgment is the clearest official statement in the UK of what these tools get wrong:

“Freely available generative artificial intelligence tools, trained on a large language model such as ChatGPT are not capable of conducting reliable legal research. Such tools can produce apparently coherent and plausible responses to prompts, but those coherent and plausible responses may turn out to be entirely incorrect. The responses may make confident assertions that are simply untrue. They may cite sources that do not exist. They may purport to quote passages from a genuine source that do not appear in that source.”

— R (Ayinde) v London Borough of Haringey; Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin).

The lesson for a small business is not “never ask AI a legal question”. It is that an answer with a citation is not a checked answer. Look the source up.

Tax: the tribunal case that should worry every sole trader

In Harber v HMRC [2023] UKFTT 1007 (TC), a taxpayer appealing a penalty gave the tribunal nine earlier decisions in which appellants had supposedly won on similar facts. The tribunal found “none of those authorities were genuine; they had instead been generated by artificial intelligence”. It accepted she had not known, and did not know how to check. She lost the appeal on its merits. The tribunal quoted the Solicitors Regulation Authority’s explanation of why this happens: AI language models “work by anticipating the text that should follow the input they are given, but do not have a concept of ‘reality’.”

For tax and VAT, use AI to explain a concept, then take every threshold, date and rate from GOV.UK.

Hiring: what the ICO found in real recruitment tools

When the ICO audited providers of AI recruitment tools, it made “almost 300 clear recommendations”. It reported that “some AI tools were not processing personal information fairly – for example, by allowing recruiters to filter out candidates with certain protected characteristics”, and that some “collected far more personal information than necessary and retained it indefinitely”. If you use AI anywhere in hiring, the ICO’s six questions apply: a DPIA, a lawful basis, a controller–processor contract, evidence of bias mitigation, transparency to candidates, and data minimisation. For most small employers the proportionate answer is to use AI to write the job advert and not to judge the applicants.

Reviews and testimonials: banned, whoever writes them

UK consumer law now has a “banned practice” covering fake reviews and concealed incentivised reviews. GOV.UK’s guidance for businesses says behaviour falling under a banned practice “is automatically unfair and illegal”, and the CMA’s short guide lists “writing or commissioning others to write fake reviews” among the things businesses must not do. An AI tool that writes a five-star review in a customer’s voice is writing a fake review.

Content you need to own

OpenAI’s terms say you “own the Output” and Anthropic’s that it assigns “all our right, title, and interest (if any) in Outputs” — “if any” because nobody promises copyright exists in it. UK law contains an unusual rule, section 9(3) of the Copyright, Designs and Patents Act 1988: “In the case of a literary, dramatic, musical or artistic work which is computer-generated, the author shall be taken to be the person by whom the arrangements necessary for the creation of the work are undertaken.” How that applies to today’s tools has not been settled by a UK court. OpenAI also warns that “output may not be unique and other users may receive similar output”. If your business depends on stopping others copying something — a logo, a brand name, a product design — have a person create it and take advice on protecting it.

A one-page AI policy you can copy

The ONS found that only 11% of UK businesses with 10 or more employees had given AI-related training to more than half their workforce. For a small firm, a single page does most of the job. Adapt this:

  1. Approved tools: [list them, with the plan you pay for]. Staff do not use other AI tools for work.
  2. Never paste: customer names and contact details (use a description instead), anything about health, ethnicity, religion, sexuality or union membership, passwords, bank details, or anything marked confidential by a client.
  3. Training opt-out: set on every account by [name], checked every quarter.
  4. Checking: every figure, date, name and reference in AI output is checked against its source before it leaves the business. The person who sends it is responsible for it.
  5. Customers: our chatbot says it is a bot and offers a person. Our privacy notice says which AI tools we use and why.
  6. Decisions: no decision about a customer, applicant or employee is made by AI alone.
  7. Never: reviews, testimonials, or claiming AI-written work is human-written where a client is paying for human work.
  8. Record: [name] keeps a list of tools, what they are used for, and the date each was checked.

A 30-day rollout

  • Week 1. Pick one job using the four tests. Time it by hand. Set up one assistant and switch on the training opt-out.
  • Week 2. Run the job with AI every time it comes up. Keep a note of every correction you make.
  • Week 3. Time it again. If it is not faster once you count checking time, change the prompt or change the job.
  • Week 4. Write the one-page policy. Decide whether the saving justifies a paid plan or a second tool — and only then read the prices.

Frequently asked questions

Can I paste customer emails into ChatGPT or Claude?

Only after you have removed what identifies the customer, or on a plan and a basis you have checked. A customer’s name, email address or order history is personal data, and putting it into an AI tool is processing it under UK GDPR, with your business as the controller. Most drafting tasks work just as well with “a customer who ordered in March” in place of a name. Never paste health, ethnicity, religious belief or other special category data into a consumer AI tool.

Do I need to tell customers I use AI?

If AI processes their personal data, yes: the ICO’s transparency requirements mean your privacy information must explain how and why you use it. If a chatbot answers them, make it obvious they are talking to a bot and how to reach a person. Separately, OpenAI’s terms forbid representing that its output was human-generated when it was not.

Can AI make decisions about customers or job applicants?

Not on its own where the decision has a legal or similarly significant effect on the person. UK GDPR article 22A, as amended by the Data (Use and Access) Act 2025, restricts decisions based solely on automated processing, and the ICO’s March 2026 draft guidance sets out the safeguards. Refusing credit or rejecting a job application with no meaningful human involvement is the kind of decision the rules are aimed at.

Who owns content that AI writes for my business?

OpenAI and Anthropic both assign their rights in the output to you, but both add “if any”, because whether AI output attracts copyright is unsettled. UK law has an unusual provision: section 9(3) of the Copyright, Designs and Patents Act 1988 says the author of a computer-generated work is “the person by whom the arrangements necessary for the creation of the work are undertaken”. How that applies to modern AI tools has not been settled by a UK court.

Can I use AI to write customer reviews or testimonials?

No. Fake reviews are a banned practice under UK consumer law, which the government’s guidance describes as “automatically unfair and illegal”. Writing or commissioning fake reviews is prohibited whether a person or an AI tool writes them. You can use AI to help you reply to genuine reviews.

Is it safe to use a free AI tool for business work?

For text with the personal data taken out, and with the training opt-out set, a free tier is a reasonable place to start. Anthropic’s consumer terms say it may use your materials for training “unless you opt out of training through your account settings”, and even after opting out, feedback you submit and material flagged for safety review can still be used. Once customer data is routine, move to a business plan with a data processing agreement.

What is the most common mistake small businesses make with AI?

Trusting output that sounds right. In June 2025 the High Court warned that freely available AI tools “can produce apparently coherent and plausible responses” that “may turn out to be entirely incorrect” and “may cite sources that do not exist”. The fix is not avoiding AI but checking every fact, figure and reference against the original source before anything leaves the business.

If the reason you are reaching for AI is that the workload has become too much, that is worth dealing with directly too: our guide to managing work stress in the UK sets out what the HSE framework says about workload and what your employer owes you.

Sources